CVE-2017-16753

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

An Improper Input Validation issue was discovered in Advantech WebAccess versions prior to 8.3. WebAccess allows some inputs that may cause the program to crash.

Metrics

CVSS 3.0 7.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-20

Affected software

Vendor	Product	Versions
n/a	Advantech WebAccess	Advantech WebAccess

References

http://www.securityfocus.com/bid/102424Third Party Advisory, VDB Entry
https://ics-cert.us-cert.gov/advisories/ICSA-18-004-02Broken Link, Third Party Advisory, US Government Resource
http://www.securityfocus.com/bid/102424Third Party Advisory, VDB Entry
https://ics-cert.us-cert.gov/advisories/ICSA-18-004-02Broken Link, Third Party Advisory, US Government Resource

Timeline

Published: Jan 5, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-167545.3Bolt before 3.3.6 does not properly restrict access to _profiler routes, related to EventListener/ProfilerListener.php and Provider/EventLis CVE-2017-167556.1An issue was discovered in Userscape HelpSpot before 4.7.2. A reflected cross-site scripting vulnerability exists in the "return" parameter CVE-2017-167568.8An issue was discovered in Userscape HelpSpot before 4.7.2. A cross-site request forgery vulnerability exists on POST requests to the "index CVE-2017-167577.8Hola VPN 1.34 has weak permissions (Everyone:F) under %PROGRAMFILES%, which allows local users to gain privileges via a Trojan horse 7za.exe CVE-2017-167584.8Cross-site scripting (XSS) vulnerability in admin/partials/uif-access-token-display.php in the Ultimate Instagram Feed plugin before 1.3 for CVE-2017-167595.9The installation process in LibreNMS before 2017-08-18 allows remote attackers to read arbitrary files, related to html/install.php.CVE-2017-167606.1Inedo BuildMaster before 5.8.2 has XSS.CVE-2017-167616.1An Open Redirect vulnerability in Inedo BuildMaster before 5.8.2 allows remote attackers to redirect users to arbitrary web sites.CVE-2017-167627.5Sanic before 0.5.1 allows reading arbitrary files with directory traversal, as demonstrated by the /static/..%2f substring.CVE-2017-167639.8An exploitable vulnerability exists in the YAML parsing functionality in config.py in Confire 0.2.0. Due to the user-specific configuration CVE-2017-167649.8An exploitable vulnerability exists in the YAML parsing functionality in the read_yaml_file method in io_utils.py in django_make_app 0.1.3. CVE-2017-167656.1XSS exists on D-Link DWR-933 1.00(WW)B17 devices via cgi-bin/gui.cgi.