Z0Mb1E

Multiple relative path traversal vulnerabilities exist, allowing a low-privilege user to overwrite files outside the application's control. The issue affects the WebAccess/SCADA ViewSrv and DrawSrv, where an IOCTL 0x0000277d directory traversal remote code execution vulnerability is present.

The issue is caused by a lack of proper validation of the length of user-supplied data, which may allow remote code execution due to multiple heap-based buffer overflow vulnerabilities.

Multiple stack-based buffer overflow vulnerabilities exist due to a lack of proper validation of the length of user-supplied data, which may allow remote code execution.

Multiple relative path traversal vulnerabilities exist that may allow a low privilege user to overwrite files outside the application’s control. The issue affects the WebAccess/SCADA system, including components such as DATACORE, ViewSrv, and DrawSrv, which are vulnerable to directory traversal and command injection attacks.

The issue arises from improper input sanitization, which may allow an attacker to inject SQL commands. This can lead to SQL injection and information disclosure vulnerabilities. Specifically, certain IOCTL commands, such as `IOCTL 0x00013c74`, `IOCTL 0x00013c75`, `IOCTL 0x00013c71`, `IOCTL 0x00013c76`, and `IOCTL 0x00013c77`, are affected.

An out-of-bounds vulnerability exists that may allow access to unauthorized data. This issue affects the WebAccess/SCADA system, specifically the DrawSrv and ViewSrv components, which can be exploited through the IOCTL 0x00002722, leading to an out-of-bounds read information disclosure.

An improper validation issue exists, allowing an attacker to inject specially crafted input into memory where it can be executed. This could potentially lead to remote code execution.

The issue is related to multiple stack-based buffer overflow vulnerabilities in the file transfer service of Advantech DiagAnywhere Server. These vulnerabilities could allow an unauthenticated attacker to execute arbitrary code with the privileges of the user running the server. The vulnerabilities exist in various functions, including FOLDER CREATE, FILE OPEN RO, FOLDER REMOVE, FILE CREATE, and SET CURR DIR.