Security Vulnerabilities - CVEs Published In January 2016
Unrestricted file upload vulnerability in the uploadImageCommon function in the UploadAjaxAction script in the WebAccess Dashboard Viewer in Advantech WebAccess before 8.1 allows remote attackers to write to files of arbitrary types via unspecified vectors.
CVSS Score
9.8
EPSS Score
0.737
Published
2016-01-15
Advantech WebAccess before 8.1 allows remote attackers to obtain sensitive information via crafted input.
CVSS Score
7.5
EPSS Score
0.005
Published
2016-01-15
Advantech WebAccess before 8.1 allows remote attackers to bypass an intended administrative requirement and obtain file or folder access via unspecified vectors.
CVSS Score
7.5
EPSS Score
0.002
Published
2016-01-15
Advantech WebAccess before 8.1 allows remote attackers to cause a denial of service (out-of-bounds memory access) via unspecified vectors.
CVSS Score
7.5
EPSS Score
0.002
Published
2016-01-15
Web Viewer 1.0.0.193 on Samsung SRN-1670D devices allows attackers to bypass filesystem encryption via XOR calculations.
CVSS Score
7.5
EPSS Score
0.002
Published
2016-01-15
Web Viewer 1.0.0.193 on Samsung SRN-1670D devices allows remote attackers to discover credentials by reading detailed error messages.
CVSS Score
7.5
EPSS Score
0.005
Published
2016-01-15
Web Viewer 1.0.0.193 on Samsung SRN-1670D devices allows remote attackers to read arbitrary files via a request to an unspecified PHP script.
CVSS Score
8.6
EPSS Score
0.522
Published
2016-01-15
Advantech WebAccess before 8.1 allows remote attackers to execute arbitrary code via vectors involving a browser plugin.
CVSS Score
8.1
EPSS Score
0.006
Published
2016-01-15
Cisco Aironet 1800 devices with software 7.2, 7.3, 7.4, 8.1(112.3), 8.1(112.4), and 8.1(15.14) have a default account, which makes it easier for remote attackers to obtain access via unspecified vectors, aka Bug ID CSCuw58062.
CVSS Score
7.3
EPSS Score
0.004
Published
2016-01-15
The DCERPC Inspection implementation in Cisco Adaptive Security Appliance (ASA) Software 9.4.1 through 9.5.1 allows remote authenticated users to bypass an intended DCERPC-only ACL by sending arbitrary network traffic, aka Bug ID CSCuu67782.
CVSS Score
4.3
EPSS Score
0.002
Published
2016-01-15