CHANGING

ChangingTech MegaServiSignAdapter component has a vulnerability of improper input validation.

RAVA certificate validation system has insufficient validation for user input.

IDExpert Windows Logon Agent developed by Changing has a Remote Code Execution vulnerability, allowing unauthenticated remote attackers to force the system to download arbitrary DLL files from a remote source and execute…

IDExpert Windows Logon Agent developed by Changing has a Remote Code Execution vulnerability, allowing unauthenticated remote attackers to force the system to download arbitrary executable files from a remote source and…

WriteRegistry function in TSSServiSign component does not filter and verify users’ input, remote attackers can rewrite to the registry without permissions thus perform hijack attacks to execute arbitrary code.

The digest generation function of NHIServiSignAdapter has not been verified for parameter’s length, which leads to a stack overflow loophole.

NHIServiSignAdapter fails to verify the length of digital credential files’ path which leads to a heap overflow loophole.

CGServiSign developed by Changing has a OS Command Injection vulnerability.

SysJust Syuan-Gu-Da-Shih, versions before 20191223, contain vulnerability of Request Forgery, allowing attackers to launch inquiries into network architecture or system files of the server via forged inquests.

Clinic Image System developed by Changing has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read database contents.

ChangingTec ServiSign component has insufficient filtering for special characters in the connection response parameter.

RAVA certification validation system has a path traversal vulnerability.

A Remote Code Execution(RCE) vulnerability exists in some designated applications in ServiSign security plugin, as long as the interface is captured, attackers are able to launch RCE and executes arbitrary command on tar…

ChangingTec ServiSign component has a path traversal vulnerability due to insufficient filtering for special characters in the DLL file path.

TSA developed by Changing has a Missing Authentication vulnerability, allowing unauthenticated remote attackers to read, modify, and delete database contents.

Clinic Image System developed by Changing contains hard-coded Credentials, allowing unauthenticated remote attackers to log into the system using administrator credentials embedded in the source code.

The specific API in TCBServiSign Windows Version from CHANGING Information Technology does not properly validate server-side input.

The specific API in TCBServiSign Windows Version from CHANGING Information Technology does not properly validate server-side input.

The login mechanism via device authentication of CGFIDO from Changing Information Technology has an Authentication Bypass vulnerability.

The passwordless login mechanism in CGFIDO from Changing Information Technology has an Authentication Bypass vulnerability, allowing remote attackers with regular privileges to send a crafted request to switch to the ide…

ChangingTech MegaServiSignAdapter component has a path traversal vulnerability within its file reading function.

Changing MOTP (Mobile One Time Password) system’s specific function parameter has insufficient validation for user input.

SQL Injection in SysJust Syuan-Gu-Da-Shih, versions before 20191223, allowing attackers to perform unwanted SQL queries and access arbitrary file in the database.

An arbitrary-file-access vulnerability exists in ServiSign security plugin, as long as the attackers learn the specific API function, they may access arbitrary files on target system via crafted API parameter.

ChangingTech MegaServiSignAdapter component has a vulnerability of Out-of-bounds Read due to insufficient validation for parameter length.