{"cve":"CVE-2014-0771","nvd":{"published":"2014-04-12T04:37:31.643","modified":"2026-06-17T00:03:36.767","status":"Modified","description":"The BWOCXRUN.BwocxrunCtrl.1 control contains a method named \n“OpenUrlToBuffer.” This method takes a URL as a parameter and returns \nits contents to the caller in JavaScript. The URLs are accessed in the \nsecurity context of the current browser session. The control does not \nperform any URL validation and allows “file://” URLs that access the \nlocal disk.\n\n\nThe method can be used to open a URL (including file URLs) and read \nfile URLs through JavaScript. This method could also be used to reach \nany arbitrary URL to which the browser has access.","cvss_v4":null,"cvss_v3":null,"cwes":["CWE-538","CWE-200"],"references":["http://webaccess.advantech.com/","http://www.securityfocus.com/bid/66740","https://www.cisa.gov/news-events/ics-advisories/icsa-14-079-03","http://ics-cert.us-cert.gov/advisories/ICSA-14-079-03"],"products":["advantech:advantech_webaccess"],"source":"nvd","synced_at":"2026-10-19T20:32:06.812358378+00:00"},"epss":{"cve":"CVE-2014-0771","score":0.01409,"percentile":0.72645,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}