Posted by disclosure via Fulldisclosure on Oct 060day Rubbish Research Team is publicly disclosing a vulnerability in Advantech WebAccess Node 9.2.3, the closed-source industrial SCADA/HMI web server from Advantech (Taiwan). Type: unrestricted file upload (CWE-434) compounded by path traversal (CWE-22), on a page that performs no authorization decision at all (CWE-306). CWE-73 and CWE-862 also map; CWE-250/CWE-269 apply conditionally where the pool runs at high privilege. In the WaCrpt ASP.NET...