CVE-2013-1627

HighCVSS 7.8/10Last modified Jun 16, 2026

Description

Absolute path traversal vulnerability in NTWebServer.exe in Indusoft Studio 7.0 and earlier and Advantech Studio 7.0 and earlier allows remote attackers to read arbitrary files via a full pathname in an argument to the sub_401A90 CreateFileW function.

Metrics

CVSS 2.0 7.8/10AV:N/AC:L/Au:N/C:C/I:N/A:N

Weakness enumeration

CWE-22

Affected software

No affected versions have been published.

Timeline

Published
Mar 11, 2013
Last modified
Jun 16, 2026
NVD status
Modified

Related CVEs from 2013

CVE-2013-16296.8pip before 1.3 uses HTTP to retrieve packages from the PyPI repository, and does not perform integrity checks on package contents, which allCVE-2013-16306.8pyshop before 0.7.1 uses HTTP to retrieve packages from the PyPI repository, and does not perform integrity checks on package contents, whicCVE-2013-16315.3Verax NMS prior to 2.1.0 leaks connection details when any user executes a Repair Table actionCVE-2013-16336.8easy_install in setuptools before 0.7 uses HTTP to retrieve packages from the PyPI repository, and does not perform integrity checks on packCVE-2013-16347.5A denial of service vulnerability exists in some motherboard implementations of Intel e1000e/82574L network controller devices through 2013-CVE-2013-16357.5ext/soap/soap.c in PHP before 5.3.22 and 5.4.x before 5.4.13 does not validate the relationship between the soap.wsdl_cache_dir directive anCVE-2013-16364.3Cross-site scripting (XSS) vulnerability in open-flash-chart.swf in Open Flash Chart (aka Open-Flash Chart), as used in the Pretty Link LiteCVE-2013-16379.3Opera before 12.13 allows remote attackers to execute arbitrary code via vectors involving DOM events.CVE-2013-16389.3Opera before 12.13 allows remote attackers to execute arbitrary code via crafted clipPaths in an SVG document.CVE-2013-16396.8Opera before 12.13 does not send CORS preflight requests in all required cases, which allows remote attackers to bypass a CSRF protection meCVE-2013-16409.0The (1) template and (2) inline_template functions in the master server in Puppet before 2.6.18, 2.7.x before 2.7.21, and 3.1.x before 3.1.1CVE-2013-16417.8Directory traversal vulnerability in the zip download functionality in QuiXplorer before 2.5.5 allows remote attackers to read arbitrary fil