Search
Find a vulnerability
Search criteria
12 vulnerabilities by CHANGING Inc.
CVE-2021-37909 (GCVE-0-2021-37909)
Vulnerability from nvd – Published: 2021-09-15 19:10 – Updated: 2024-09-17 00:42
VLAI
EPSS
VEX
Title
CHANGING Inc. TSSServiSignAdapter Windows Versions - Improper Input Validation
Summary
WriteRegistry function in TSSServiSign component does not filter and verify users’ input, remote attackers can rewrite to the registry without permissions thus perform hijack attacks to execute arbitrary code.
Severity
9.8 (Critical)
CWE
- CWE-20 - Improper Input Validation
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.twcert.org.tw/tw/cp-132-5093-76f04-1.html | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| CHANGING Inc. | TSSServiSignAdapter |
Affected:
unspecified , ≤ 1.0.20.0316
(custom)
|
Date Public
2021-09-15 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T01:30:08.999Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.twcert.org.tw/tw/cp-132-5093-76f04-1.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"platforms": [
"Windows"
],
"product": "TSSServiSignAdapter",
"vendor": "CHANGING Inc.",
"versions": [
{
"lessThanOrEqual": "1.0.20.0316",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
}
],
"datePublic": "2021-09-15T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "WriteRegistry function in TSSServiSign component does not filter and verify users\u2019 input, remote attackers can rewrite to the registry without permissions thus perform hijack attacks to execute arbitrary code."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "CWE-20 Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-09-15T19:10:22.000Z",
"orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"shortName": "twcert"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.twcert.org.tw/tw/cp-132-5093-76f04-1.html"
}
],
"solutions": [
{
"lang": "en",
"value": "Update to version 1.0.21.0520"
}
],
"source": {
"advisory": "TVN-202105006",
"discovery": "EXTERNAL"
},
"title": "CHANGING Inc. TSSServiSignAdapter Windows Versions - Improper Input Validation",
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"AKA": "TWCERT/CC",
"ASSIGNER": "cve@cert.org.tw",
"DATE_PUBLIC": "2021-09-15T19:04:00.000Z",
"ID": "CVE-2021-37909",
"STATE": "PUBLIC",
"TITLE": "CHANGING Inc. TSSServiSignAdapter Windows Versions - Improper Input Validation"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "TSSServiSignAdapter",
"version": {
"version_data": [
{
"platform": "Windows",
"version_affected": "\u003c=",
"version_value": "1.0.20.0316"
}
]
}
}
]
},
"vendor_name": "CHANGING Inc."
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "WriteRegistry function in TSSServiSign component does not filter and verify users\u2019 input, remote attackers can rewrite to the registry without permissions thus perform hijack attacks to execute arbitrary code."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-20 Improper Input Validation"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.twcert.org.tw/tw/cp-132-5093-76f04-1.html",
"refsource": "MISC",
"url": "https://www.twcert.org.tw/tw/cp-132-5093-76f04-1.html"
}
]
},
"solution": [
{
"lang": "en",
"value": "Update to version 1.0.21.0520"
}
],
"source": {
"advisory": "TVN-202105006",
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"assignerShortName": "twcert",
"cveId": "CVE-2021-37909",
"datePublished": "2021-09-15T19:10:22.691Z",
"dateReserved": "2021-08-02T00:00:00.000Z",
"dateUpdated": "2024-09-17T00:42:01.361Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2020-25846 (GCVE-0-2020-25846)
Vulnerability from nvd – Published: 2020-12-31 07:45 – Updated: 2024-09-17 01:41
VLAI
EPSS
VEX
Title
CHANGING Inc. NHIServiSignAdapter Windows Versions - Information Leakage -2
Summary
The digest generation function of NHIServiSignAdapter has not been verified for source file path, which leads to the SMB request being redirected to a malicious host, resulting in the leakage of user's credential.
Severity
7.5 (High)
CWE
- Information Leakage
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.twcert.org.tw/tw/cp-132-4274-7bd65-1.html | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| CHANGING Inc. | NHIServiSignAdapter |
Affected:
1.0.20.0218
|
Date Public
2020-12-31 00:00
Credits
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T15:40:37.096Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.twcert.org.tw/tw/cp-132-4274-7bd65-1.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"platforms": [
"Windows"
],
"product": "NHIServiSignAdapter",
"vendor": "CHANGING Inc.",
"versions": [
{
"status": "affected",
"version": "1.0.20.0218"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "DEVCORE"
}
],
"datePublic": "2020-12-31T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "The digest generation function of NHIServiSignAdapter has not been verified for source file path, which leads to the SMB request being redirected to a malicious host, resulting in the leakage of user\u0027s credential."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Information Leakage",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-12-31T07:45:47.000Z",
"orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"shortName": "twcert"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.twcert.org.tw/tw/cp-132-4274-7bd65-1.html"
}
],
"solutions": [
{
"lang": "en",
"value": "Update to version 1.0.20.1109"
}
],
"source": {
"advisory": "TVN-202012005",
"discovery": "EXTERNAL"
},
"title": "CHANGING Inc. NHIServiSignAdapter Windows Versions - Information Leakage -2",
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"AKA": "TWCERT/CC",
"ASSIGNER": "cve@cert.org.tw",
"DATE_PUBLIC": "2020-12-31T07:24:00.000Z",
"ID": "CVE-2020-25846",
"STATE": "PUBLIC",
"TITLE": "CHANGING Inc. NHIServiSignAdapter Windows Versions - Information Leakage -2"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "NHIServiSignAdapter",
"version": {
"version_data": [
{
"platform": "Windows",
"version_affected": "=",
"version_value": "1.0.20.0218"
}
]
}
}
]
},
"vendor_name": "CHANGING Inc."
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "DEVCORE"
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The digest generation function of NHIServiSignAdapter has not been verified for source file path, which leads to the SMB request being redirected to a malicious host, resulting in the leakage of user\u0027s credential."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Information Leakage"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.twcert.org.tw/tw/cp-132-4274-7bd65-1.html",
"refsource": "MISC",
"url": "https://www.twcert.org.tw/tw/cp-132-4274-7bd65-1.html"
}
]
},
"solution": [
{
"lang": "en",
"value": "Update to version 1.0.20.1109"
}
],
"source": {
"advisory": "TVN-202012005",
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"assignerShortName": "twcert",
"cveId": "CVE-2020-25846",
"datePublished": "2020-12-31T07:45:48.074Z",
"dateReserved": "2020-09-23T00:00:00.000Z",
"dateUpdated": "2024-09-17T01:41:45.846Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2020-25845 (GCVE-0-2020-25845)
Vulnerability from nvd – Published: 2020-12-31 07:45 – Updated: 2024-09-16 18:08
VLAI
EPSS
VEX
Title
CHANGING Inc. NHIServiSignAdapter Windows Versions - Information Leakage -1
Summary
Multiple functions of NHIServiSignAdapter failed to verify the users’ file path, which leads to the SMB request being redirected to a malicious host, resulting in the leakage of user's credential.
Severity
7.5 (High)
CWE
- Information Leakage
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.twcert.org.tw/tw/cp-132-4273-24e01-1.html | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| CHANGING Inc. | NHIServiSignAdapter |
Affected:
1.0.20.0218
|
Date Public
2020-12-31 00:00
Credits
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T15:40:36.942Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.twcert.org.tw/tw/cp-132-4273-24e01-1.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"platforms": [
"Windows"
],
"product": "NHIServiSignAdapter",
"vendor": "CHANGING Inc.",
"versions": [
{
"status": "affected",
"version": "1.0.20.0218"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "DEVCORE"
}
],
"datePublic": "2020-12-31T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Multiple functions of NHIServiSignAdapter failed to verify the users\u2019 file path, which leads to the SMB request being redirected to a malicious host, resulting in the leakage of user\u0027s credential."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Information Leakage",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-12-31T07:45:47.000Z",
"orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"shortName": "twcert"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.twcert.org.tw/tw/cp-132-4273-24e01-1.html"
}
],
"solutions": [
{
"lang": "en",
"value": "Update to version 1.0.20.1109"
}
],
"source": {
"advisory": "TVN-202012004",
"discovery": "EXTERNAL"
},
"title": "CHANGING Inc. NHIServiSignAdapter Windows Versions - Information Leakage -1",
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"AKA": "TWCERT/CC",
"ASSIGNER": "cve@cert.org.tw",
"DATE_PUBLIC": "2020-12-31T07:21:00.000Z",
"ID": "CVE-2020-25845",
"STATE": "PUBLIC",
"TITLE": "CHANGING Inc. NHIServiSignAdapter Windows Versions - Information Leakage -1"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "NHIServiSignAdapter",
"version": {
"version_data": [
{
"platform": "Windows",
"version_affected": "=",
"version_value": "1.0.20.0218"
}
]
}
}
]
},
"vendor_name": "CHANGING Inc."
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "DEVCORE"
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Multiple functions of NHIServiSignAdapter failed to verify the users\u2019 file path, which leads to the SMB request being redirected to a malicious host, resulting in the leakage of user\u0027s credential."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Information Leakage"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.twcert.org.tw/tw/cp-132-4273-24e01-1.html",
"refsource": "MISC",
"url": "https://www.twcert.org.tw/tw/cp-132-4273-24e01-1.html"
}
]
},
"solution": [
{
"lang": "en",
"value": "Update to version 1.0.20.1109"
}
],
"source": {
"advisory": "TVN-202012004",
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"assignerShortName": "twcert",
"cveId": "CVE-2020-25845",
"datePublished": "2020-12-31T07:45:47.467Z",
"dateReserved": "2020-09-23T00:00:00.000Z",
"dateUpdated": "2024-09-16T18:08:11.534Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2020-25844 (GCVE-0-2020-25844)
Vulnerability from nvd – Published: 2020-12-31 07:45 – Updated: 2024-09-16 16:53
VLAI
EPSS
VEX
Title
CHANGING Inc. NHIServiSignAdapter Windows Versions - Stack Overflow
Summary
The digest generation function of NHIServiSignAdapter has not been verified for parameter’s length, which leads to a stack overflow loophole. Remote attackers can use the leak to execute code without privilege.
Severity
8.1 (High)
CWE
- CWE-121 - Stack-based Buffer Overflow
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.twcert.org.tw/tw/cp-132-4272-23ba4-1.html | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| CHANGING Inc. | NHIServiSignAdapter |
Affected:
1.0.20.0218
|
Date Public
2020-12-31 00:00
Credits
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T15:40:36.977Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.twcert.org.tw/tw/cp-132-4272-23ba4-1.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"platforms": [
"Windows"
],
"product": "NHIServiSignAdapter",
"vendor": "CHANGING Inc.",
"versions": [
{
"status": "affected",
"version": "1.0.20.0218"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "DEVORE"
}
],
"datePublic": "2020-12-31T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "The digest generation function of NHIServiSignAdapter has not been verified for parameter\u2019s length, which leads to a stack overflow loophole. Remote attackers can use the leak to execute code without privilege."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "CWE-121 Stack-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-12-31T07:45:46.000Z",
"orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"shortName": "twcert"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.twcert.org.tw/tw/cp-132-4272-23ba4-1.html"
}
],
"solutions": [
{
"lang": "en",
"value": "Update to version 1.0.20.1109"
}
],
"source": {
"advisory": "TVN-202012003",
"discovery": "EXTERNAL"
},
"title": "CHANGING Inc. NHIServiSignAdapter Windows Versions - Stack Overflow",
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"AKA": "TWCERT/CC",
"ASSIGNER": "cve@cert.org.tw",
"DATE_PUBLIC": "2020-12-31T07:18:00.000Z",
"ID": "CVE-2020-25844",
"STATE": "PUBLIC",
"TITLE": "CHANGING Inc. NHIServiSignAdapter Windows Versions - Stack Overflow"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "NHIServiSignAdapter",
"version": {
"version_data": [
{
"platform": "Windows",
"version_affected": "=",
"version_value": "1.0.20.0218"
}
]
}
}
]
},
"vendor_name": "CHANGING Inc."
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "DEVORE"
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The digest generation function of NHIServiSignAdapter has not been verified for parameter\u2019s length, which leads to a stack overflow loophole. Remote attackers can use the leak to execute code without privilege."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-121 Stack-based Buffer Overflow"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.twcert.org.tw/tw/cp-132-4272-23ba4-1.html",
"refsource": "MISC",
"url": "https://www.twcert.org.tw/tw/cp-132-4272-23ba4-1.html"
}
]
},
"solution": [
{
"lang": "en",
"value": "Update to version 1.0.20.1109"
}
],
"source": {
"advisory": "TVN-202012003",
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"assignerShortName": "twcert",
"cveId": "CVE-2020-25844",
"datePublished": "2020-12-31T07:45:46.812Z",
"dateReserved": "2020-09-23T00:00:00.000Z",
"dateUpdated": "2024-09-16T16:53:50.623Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2020-25843 (GCVE-0-2020-25843)
Vulnerability from nvd – Published: 2020-12-31 07:45 – Updated: 2024-09-16 18:28
VLAI
EPSS
VEX
Title
CHANGING Inc. NHIServiSignAdapter Windows Versions - Heap Overflow
Summary
NHIServiSignAdapter fails to verify the length of digital credential files’ path which leads to a heap overflow loophole. Remote attackers can use the leak to execute code without privilege.
Severity
8.1 (High)
CWE
- CWE-122 - Heap-based Buffer Overflow
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.twcert.org.tw/tw/cp-132-4271-951cd-1.html | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| CHANGING Inc. | NHIServiSignAdapter |
Affected:
1.0.20.0218
|
Date Public
2020-12-31 00:00
Credits
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T15:40:36.954Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.twcert.org.tw/tw/cp-132-4271-951cd-1.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"platforms": [
"Windows"
],
"product": "NHIServiSignAdapter",
"vendor": "CHANGING Inc.",
"versions": [
{
"status": "affected",
"version": "1.0.20.0218"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "DEVCORE"
}
],
"datePublic": "2020-12-31T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "NHIServiSignAdapter fails to verify the length of digital credential files\u2019 path which leads to a heap overflow loophole. Remote attackers can use the leak to execute code without privilege."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-122",
"description": "CWE-122 Heap-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-12-31T07:45:46.000Z",
"orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"shortName": "twcert"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.twcert.org.tw/tw/cp-132-4271-951cd-1.html"
}
],
"solutions": [
{
"lang": "en",
"value": "Update to version 1.0.20.1109"
}
],
"source": {
"advisory": "TVN-202012002",
"discovery": "EXTERNAL"
},
"title": "CHANGING Inc. NHIServiSignAdapter Windows Versions - Heap Overflow",
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"AKA": "TWCERT/CC",
"ASSIGNER": "cve@cert.org.tw",
"DATE_PUBLIC": "2020-12-31T07:14:00.000Z",
"ID": "CVE-2020-25843",
"STATE": "PUBLIC",
"TITLE": "CHANGING Inc. NHIServiSignAdapter Windows Versions - Heap Overflow"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "NHIServiSignAdapter",
"version": {
"version_data": [
{
"platform": "Windows",
"version_affected": "=",
"version_value": "1.0.20.0218"
}
]
}
}
]
},
"vendor_name": "CHANGING Inc."
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "DEVCORE"
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "NHIServiSignAdapter fails to verify the length of digital credential files\u2019 path which leads to a heap overflow loophole. Remote attackers can use the leak to execute code without privilege."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-122 Heap-based Buffer Overflow"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.twcert.org.tw/tw/cp-132-4271-951cd-1.html",
"refsource": "MISC",
"url": "https://www.twcert.org.tw/tw/cp-132-4271-951cd-1.html"
}
]
},
"solution": [
{
"lang": "en",
"value": "Update to version 1.0.20.1109"
}
],
"source": {
"advisory": "TVN-202012002",
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"assignerShortName": "twcert",
"cveId": "CVE-2020-25843",
"datePublished": "2020-12-31T07:45:46.167Z",
"dateReserved": "2020-09-23T00:00:00.000Z",
"dateUpdated": "2024-09-16T18:28:28.082Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2020-25842 (GCVE-0-2020-25842)
Vulnerability from nvd – Published: 2020-12-31 07:45 – Updated: 2024-09-16 19:25
VLAI
EPSS
VEX
Title
CHANGING Inc. NHIServiSignAdapter Windows Versions - Arbitrary File Access
Summary
The encryption function of NHIServiSignAdapter fail to verify the file path input by users. Remote attacker can access arbitrary files through the flaw without privilege.
Severity
7.5 (High)
CWE
- Arbitrary File Access
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.twcert.org.tw/tw/cp-132-4270-72392-1.html | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| CHANGING Inc. | NHIServiSignAdapter |
Affected:
1.0.20.0218
|
Date Public
2020-12-31 00:00
Credits
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T15:40:36.997Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.twcert.org.tw/tw/cp-132-4270-72392-1.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"platforms": [
"Windows"
],
"product": "NHIServiSignAdapter",
"vendor": "CHANGING Inc.",
"versions": [
{
"status": "affected",
"version": "1.0.20.0218"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "DEVCORE"
}
],
"datePublic": "2020-12-31T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "The encryption function of NHIServiSignAdapter fail to verify the file path input by users. Remote attacker can access arbitrary files through the flaw without privilege."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Arbitrary File Access",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-12-31T07:45:45.000Z",
"orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"shortName": "twcert"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.twcert.org.tw/tw/cp-132-4270-72392-1.html"
}
],
"solutions": [
{
"lang": "en",
"value": "Update to version 1.0.20.1109"
}
],
"source": {
"advisory": "TVN-202012001",
"discovery": "EXTERNAL"
},
"title": "CHANGING Inc. NHIServiSignAdapter Windows Versions - Arbitrary File Access",
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"AKA": "TWCERT/CC",
"ASSIGNER": "cve@cert.org.tw",
"DATE_PUBLIC": "2020-12-31T06:53:00.000Z",
"ID": "CVE-2020-25842",
"STATE": "PUBLIC",
"TITLE": "CHANGING Inc. NHIServiSignAdapter Windows Versions - Arbitrary File Access"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "NHIServiSignAdapter",
"version": {
"version_data": [
{
"platform": "Windows",
"version_affected": "=",
"version_value": "1.0.20.0218"
}
]
}
}
]
},
"vendor_name": "CHANGING Inc."
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "DEVCORE"
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The encryption function of NHIServiSignAdapter fail to verify the file path input by users. Remote attacker can access arbitrary files through the flaw without privilege."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Arbitrary File Access"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.twcert.org.tw/tw/cp-132-4270-72392-1.html",
"refsource": "MISC",
"url": "https://www.twcert.org.tw/tw/cp-132-4270-72392-1.html"
}
]
},
"solution": [
{
"lang": "en",
"value": "Update to version 1.0.20.1109"
}
],
"source": {
"advisory": "TVN-202012001",
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"assignerShortName": "twcert",
"cveId": "CVE-2020-25842",
"datePublished": "2020-12-31T07:45:45.548Z",
"dateReserved": "2020-09-23T00:00:00.000Z",
"dateUpdated": "2024-09-16T19:25:28.103Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-37909 (GCVE-0-2021-37909)
Vulnerability from cvelistv5 – Published: 2021-09-15 19:10 – Updated: 2024-09-17 00:42
VLAI
EPSS
VEX
Title
CHANGING Inc. TSSServiSignAdapter Windows Versions - Improper Input Validation
Summary
WriteRegistry function in TSSServiSign component does not filter and verify users’ input, remote attackers can rewrite to the registry without permissions thus perform hijack attacks to execute arbitrary code.
Severity
9.8 (Critical)
CWE
- CWE-20 - Improper Input Validation
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.twcert.org.tw/tw/cp-132-5093-76f04-1.html | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| CHANGING Inc. | TSSServiSignAdapter |
Affected:
unspecified , ≤ 1.0.20.0316
(custom)
|
Date Public
2021-09-15 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T01:30:08.999Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.twcert.org.tw/tw/cp-132-5093-76f04-1.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"platforms": [
"Windows"
],
"product": "TSSServiSignAdapter",
"vendor": "CHANGING Inc.",
"versions": [
{
"lessThanOrEqual": "1.0.20.0316",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
}
],
"datePublic": "2021-09-15T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "WriteRegistry function in TSSServiSign component does not filter and verify users\u2019 input, remote attackers can rewrite to the registry without permissions thus perform hijack attacks to execute arbitrary code."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "CWE-20 Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-09-15T19:10:22.000Z",
"orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"shortName": "twcert"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.twcert.org.tw/tw/cp-132-5093-76f04-1.html"
}
],
"solutions": [
{
"lang": "en",
"value": "Update to version 1.0.21.0520"
}
],
"source": {
"advisory": "TVN-202105006",
"discovery": "EXTERNAL"
},
"title": "CHANGING Inc. TSSServiSignAdapter Windows Versions - Improper Input Validation",
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"AKA": "TWCERT/CC",
"ASSIGNER": "cve@cert.org.tw",
"DATE_PUBLIC": "2021-09-15T19:04:00.000Z",
"ID": "CVE-2021-37909",
"STATE": "PUBLIC",
"TITLE": "CHANGING Inc. TSSServiSignAdapter Windows Versions - Improper Input Validation"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "TSSServiSignAdapter",
"version": {
"version_data": [
{
"platform": "Windows",
"version_affected": "\u003c=",
"version_value": "1.0.20.0316"
}
]
}
}
]
},
"vendor_name": "CHANGING Inc."
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "WriteRegistry function in TSSServiSign component does not filter and verify users\u2019 input, remote attackers can rewrite to the registry without permissions thus perform hijack attacks to execute arbitrary code."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-20 Improper Input Validation"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.twcert.org.tw/tw/cp-132-5093-76f04-1.html",
"refsource": "MISC",
"url": "https://www.twcert.org.tw/tw/cp-132-5093-76f04-1.html"
}
]
},
"solution": [
{
"lang": "en",
"value": "Update to version 1.0.21.0520"
}
],
"source": {
"advisory": "TVN-202105006",
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"assignerShortName": "twcert",
"cveId": "CVE-2021-37909",
"datePublished": "2021-09-15T19:10:22.691Z",
"dateReserved": "2021-08-02T00:00:00.000Z",
"dateUpdated": "2024-09-17T00:42:01.361Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2020-25846 (GCVE-0-2020-25846)
Vulnerability from cvelistv5 – Published: 2020-12-31 07:45 – Updated: 2024-09-17 01:41
VLAI
EPSS
VEX
Title
CHANGING Inc. NHIServiSignAdapter Windows Versions - Information Leakage -2
Summary
The digest generation function of NHIServiSignAdapter has not been verified for source file path, which leads to the SMB request being redirected to a malicious host, resulting in the leakage of user's credential.
Severity
7.5 (High)
CWE
- Information Leakage
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.twcert.org.tw/tw/cp-132-4274-7bd65-1.html | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| CHANGING Inc. | NHIServiSignAdapter |
Affected:
1.0.20.0218
|
Date Public
2020-12-31 00:00
Credits
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T15:40:37.096Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.twcert.org.tw/tw/cp-132-4274-7bd65-1.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"platforms": [
"Windows"
],
"product": "NHIServiSignAdapter",
"vendor": "CHANGING Inc.",
"versions": [
{
"status": "affected",
"version": "1.0.20.0218"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "DEVCORE"
}
],
"datePublic": "2020-12-31T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "The digest generation function of NHIServiSignAdapter has not been verified for source file path, which leads to the SMB request being redirected to a malicious host, resulting in the leakage of user\u0027s credential."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Information Leakage",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-12-31T07:45:47.000Z",
"orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"shortName": "twcert"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.twcert.org.tw/tw/cp-132-4274-7bd65-1.html"
}
],
"solutions": [
{
"lang": "en",
"value": "Update to version 1.0.20.1109"
}
],
"source": {
"advisory": "TVN-202012005",
"discovery": "EXTERNAL"
},
"title": "CHANGING Inc. NHIServiSignAdapter Windows Versions - Information Leakage -2",
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"AKA": "TWCERT/CC",
"ASSIGNER": "cve@cert.org.tw",
"DATE_PUBLIC": "2020-12-31T07:24:00.000Z",
"ID": "CVE-2020-25846",
"STATE": "PUBLIC",
"TITLE": "CHANGING Inc. NHIServiSignAdapter Windows Versions - Information Leakage -2"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "NHIServiSignAdapter",
"version": {
"version_data": [
{
"platform": "Windows",
"version_affected": "=",
"version_value": "1.0.20.0218"
}
]
}
}
]
},
"vendor_name": "CHANGING Inc."
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "DEVCORE"
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The digest generation function of NHIServiSignAdapter has not been verified for source file path, which leads to the SMB request being redirected to a malicious host, resulting in the leakage of user\u0027s credential."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Information Leakage"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.twcert.org.tw/tw/cp-132-4274-7bd65-1.html",
"refsource": "MISC",
"url": "https://www.twcert.org.tw/tw/cp-132-4274-7bd65-1.html"
}
]
},
"solution": [
{
"lang": "en",
"value": "Update to version 1.0.20.1109"
}
],
"source": {
"advisory": "TVN-202012005",
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"assignerShortName": "twcert",
"cveId": "CVE-2020-25846",
"datePublished": "2020-12-31T07:45:48.074Z",
"dateReserved": "2020-09-23T00:00:00.000Z",
"dateUpdated": "2024-09-17T01:41:45.846Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2020-25845 (GCVE-0-2020-25845)
Vulnerability from cvelistv5 – Published: 2020-12-31 07:45 – Updated: 2024-09-16 18:08
VLAI
EPSS
VEX
Title
CHANGING Inc. NHIServiSignAdapter Windows Versions - Information Leakage -1
Summary
Multiple functions of NHIServiSignAdapter failed to verify the users’ file path, which leads to the SMB request being redirected to a malicious host, resulting in the leakage of user's credential.
Severity
7.5 (High)
CWE
- Information Leakage
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.twcert.org.tw/tw/cp-132-4273-24e01-1.html | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| CHANGING Inc. | NHIServiSignAdapter |
Affected:
1.0.20.0218
|
Date Public
2020-12-31 00:00
Credits
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T15:40:36.942Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.twcert.org.tw/tw/cp-132-4273-24e01-1.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"platforms": [
"Windows"
],
"product": "NHIServiSignAdapter",
"vendor": "CHANGING Inc.",
"versions": [
{
"status": "affected",
"version": "1.0.20.0218"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "DEVCORE"
}
],
"datePublic": "2020-12-31T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Multiple functions of NHIServiSignAdapter failed to verify the users\u2019 file path, which leads to the SMB request being redirected to a malicious host, resulting in the leakage of user\u0027s credential."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Information Leakage",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-12-31T07:45:47.000Z",
"orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"shortName": "twcert"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.twcert.org.tw/tw/cp-132-4273-24e01-1.html"
}
],
"solutions": [
{
"lang": "en",
"value": "Update to version 1.0.20.1109"
}
],
"source": {
"advisory": "TVN-202012004",
"discovery": "EXTERNAL"
},
"title": "CHANGING Inc. NHIServiSignAdapter Windows Versions - Information Leakage -1",
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"AKA": "TWCERT/CC",
"ASSIGNER": "cve@cert.org.tw",
"DATE_PUBLIC": "2020-12-31T07:21:00.000Z",
"ID": "CVE-2020-25845",
"STATE": "PUBLIC",
"TITLE": "CHANGING Inc. NHIServiSignAdapter Windows Versions - Information Leakage -1"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "NHIServiSignAdapter",
"version": {
"version_data": [
{
"platform": "Windows",
"version_affected": "=",
"version_value": "1.0.20.0218"
}
]
}
}
]
},
"vendor_name": "CHANGING Inc."
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "DEVCORE"
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Multiple functions of NHIServiSignAdapter failed to verify the users\u2019 file path, which leads to the SMB request being redirected to a malicious host, resulting in the leakage of user\u0027s credential."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Information Leakage"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.twcert.org.tw/tw/cp-132-4273-24e01-1.html",
"refsource": "MISC",
"url": "https://www.twcert.org.tw/tw/cp-132-4273-24e01-1.html"
}
]
},
"solution": [
{
"lang": "en",
"value": "Update to version 1.0.20.1109"
}
],
"source": {
"advisory": "TVN-202012004",
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"assignerShortName": "twcert",
"cveId": "CVE-2020-25845",
"datePublished": "2020-12-31T07:45:47.467Z",
"dateReserved": "2020-09-23T00:00:00.000Z",
"dateUpdated": "2024-09-16T18:08:11.534Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2020-25844 (GCVE-0-2020-25844)
Vulnerability from cvelistv5 – Published: 2020-12-31 07:45 – Updated: 2024-09-16 16:53
VLAI
EPSS
VEX
Title
CHANGING Inc. NHIServiSignAdapter Windows Versions - Stack Overflow
Summary
The digest generation function of NHIServiSignAdapter has not been verified for parameter’s length, which leads to a stack overflow loophole. Remote attackers can use the leak to execute code without privilege.
Severity
8.1 (High)
CWE
- CWE-121 - Stack-based Buffer Overflow
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.twcert.org.tw/tw/cp-132-4272-23ba4-1.html | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| CHANGING Inc. | NHIServiSignAdapter |
Affected:
1.0.20.0218
|
Date Public
2020-12-31 00:00
Credits
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T15:40:36.977Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.twcert.org.tw/tw/cp-132-4272-23ba4-1.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"platforms": [
"Windows"
],
"product": "NHIServiSignAdapter",
"vendor": "CHANGING Inc.",
"versions": [
{
"status": "affected",
"version": "1.0.20.0218"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "DEVORE"
}
],
"datePublic": "2020-12-31T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "The digest generation function of NHIServiSignAdapter has not been verified for parameter\u2019s length, which leads to a stack overflow loophole. Remote attackers can use the leak to execute code without privilege."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "CWE-121 Stack-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-12-31T07:45:46.000Z",
"orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"shortName": "twcert"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.twcert.org.tw/tw/cp-132-4272-23ba4-1.html"
}
],
"solutions": [
{
"lang": "en",
"value": "Update to version 1.0.20.1109"
}
],
"source": {
"advisory": "TVN-202012003",
"discovery": "EXTERNAL"
},
"title": "CHANGING Inc. NHIServiSignAdapter Windows Versions - Stack Overflow",
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"AKA": "TWCERT/CC",
"ASSIGNER": "cve@cert.org.tw",
"DATE_PUBLIC": "2020-12-31T07:18:00.000Z",
"ID": "CVE-2020-25844",
"STATE": "PUBLIC",
"TITLE": "CHANGING Inc. NHIServiSignAdapter Windows Versions - Stack Overflow"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "NHIServiSignAdapter",
"version": {
"version_data": [
{
"platform": "Windows",
"version_affected": "=",
"version_value": "1.0.20.0218"
}
]
}
}
]
},
"vendor_name": "CHANGING Inc."
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "DEVORE"
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The digest generation function of NHIServiSignAdapter has not been verified for parameter\u2019s length, which leads to a stack overflow loophole. Remote attackers can use the leak to execute code without privilege."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-121 Stack-based Buffer Overflow"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.twcert.org.tw/tw/cp-132-4272-23ba4-1.html",
"refsource": "MISC",
"url": "https://www.twcert.org.tw/tw/cp-132-4272-23ba4-1.html"
}
]
},
"solution": [
{
"lang": "en",
"value": "Update to version 1.0.20.1109"
}
],
"source": {
"advisory": "TVN-202012003",
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"assignerShortName": "twcert",
"cveId": "CVE-2020-25844",
"datePublished": "2020-12-31T07:45:46.812Z",
"dateReserved": "2020-09-23T00:00:00.000Z",
"dateUpdated": "2024-09-16T16:53:50.623Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2020-25843 (GCVE-0-2020-25843)
Vulnerability from cvelistv5 – Published: 2020-12-31 07:45 – Updated: 2024-09-16 18:28
VLAI
EPSS
VEX
Title
CHANGING Inc. NHIServiSignAdapter Windows Versions - Heap Overflow
Summary
NHIServiSignAdapter fails to verify the length of digital credential files’ path which leads to a heap overflow loophole. Remote attackers can use the leak to execute code without privilege.
Severity
8.1 (High)
CWE
- CWE-122 - Heap-based Buffer Overflow
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.twcert.org.tw/tw/cp-132-4271-951cd-1.html | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| CHANGING Inc. | NHIServiSignAdapter |
Affected:
1.0.20.0218
|
Date Public
2020-12-31 00:00
Credits
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T15:40:36.954Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.twcert.org.tw/tw/cp-132-4271-951cd-1.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"platforms": [
"Windows"
],
"product": "NHIServiSignAdapter",
"vendor": "CHANGING Inc.",
"versions": [
{
"status": "affected",
"version": "1.0.20.0218"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "DEVCORE"
}
],
"datePublic": "2020-12-31T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "NHIServiSignAdapter fails to verify the length of digital credential files\u2019 path which leads to a heap overflow loophole. Remote attackers can use the leak to execute code without privilege."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-122",
"description": "CWE-122 Heap-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-12-31T07:45:46.000Z",
"orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"shortName": "twcert"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.twcert.org.tw/tw/cp-132-4271-951cd-1.html"
}
],
"solutions": [
{
"lang": "en",
"value": "Update to version 1.0.20.1109"
}
],
"source": {
"advisory": "TVN-202012002",
"discovery": "EXTERNAL"
},
"title": "CHANGING Inc. NHIServiSignAdapter Windows Versions - Heap Overflow",
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"AKA": "TWCERT/CC",
"ASSIGNER": "cve@cert.org.tw",
"DATE_PUBLIC": "2020-12-31T07:14:00.000Z",
"ID": "CVE-2020-25843",
"STATE": "PUBLIC",
"TITLE": "CHANGING Inc. NHIServiSignAdapter Windows Versions - Heap Overflow"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "NHIServiSignAdapter",
"version": {
"version_data": [
{
"platform": "Windows",
"version_affected": "=",
"version_value": "1.0.20.0218"
}
]
}
}
]
},
"vendor_name": "CHANGING Inc."
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "DEVCORE"
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "NHIServiSignAdapter fails to verify the length of digital credential files\u2019 path which leads to a heap overflow loophole. Remote attackers can use the leak to execute code without privilege."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-122 Heap-based Buffer Overflow"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.twcert.org.tw/tw/cp-132-4271-951cd-1.html",
"refsource": "MISC",
"url": "https://www.twcert.org.tw/tw/cp-132-4271-951cd-1.html"
}
]
},
"solution": [
{
"lang": "en",
"value": "Update to version 1.0.20.1109"
}
],
"source": {
"advisory": "TVN-202012002",
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"assignerShortName": "twcert",
"cveId": "CVE-2020-25843",
"datePublished": "2020-12-31T07:45:46.167Z",
"dateReserved": "2020-09-23T00:00:00.000Z",
"dateUpdated": "2024-09-16T18:28:28.082Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2020-25842 (GCVE-0-2020-25842)
Vulnerability from cvelistv5 – Published: 2020-12-31 07:45 – Updated: 2024-09-16 19:25
VLAI
EPSS
VEX
Title
CHANGING Inc. NHIServiSignAdapter Windows Versions - Arbitrary File Access
Summary
The encryption function of NHIServiSignAdapter fail to verify the file path input by users. Remote attacker can access arbitrary files through the flaw without privilege.
Severity
7.5 (High)
CWE
- Arbitrary File Access
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.twcert.org.tw/tw/cp-132-4270-72392-1.html | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| CHANGING Inc. | NHIServiSignAdapter |
Affected:
1.0.20.0218
|
Date Public
2020-12-31 00:00
Credits
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T15:40:36.997Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.twcert.org.tw/tw/cp-132-4270-72392-1.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"platforms": [
"Windows"
],
"product": "NHIServiSignAdapter",
"vendor": "CHANGING Inc.",
"versions": [
{
"status": "affected",
"version": "1.0.20.0218"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "DEVCORE"
}
],
"datePublic": "2020-12-31T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "The encryption function of NHIServiSignAdapter fail to verify the file path input by users. Remote attacker can access arbitrary files through the flaw without privilege."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Arbitrary File Access",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-12-31T07:45:45.000Z",
"orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"shortName": "twcert"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.twcert.org.tw/tw/cp-132-4270-72392-1.html"
}
],
"solutions": [
{
"lang": "en",
"value": "Update to version 1.0.20.1109"
}
],
"source": {
"advisory": "TVN-202012001",
"discovery": "EXTERNAL"
},
"title": "CHANGING Inc. NHIServiSignAdapter Windows Versions - Arbitrary File Access",
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"AKA": "TWCERT/CC",
"ASSIGNER": "cve@cert.org.tw",
"DATE_PUBLIC": "2020-12-31T06:53:00.000Z",
"ID": "CVE-2020-25842",
"STATE": "PUBLIC",
"TITLE": "CHANGING Inc. NHIServiSignAdapter Windows Versions - Arbitrary File Access"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "NHIServiSignAdapter",
"version": {
"version_data": [
{
"platform": "Windows",
"version_affected": "=",
"version_value": "1.0.20.0218"
}
]
}
}
]
},
"vendor_name": "CHANGING Inc."
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "DEVCORE"
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The encryption function of NHIServiSignAdapter fail to verify the file path input by users. Remote attacker can access arbitrary files through the flaw without privilege."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Arbitrary File Access"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.twcert.org.tw/tw/cp-132-4270-72392-1.html",
"refsource": "MISC",
"url": "https://www.twcert.org.tw/tw/cp-132-4270-72392-1.html"
}
]
},
"solution": [
{
"lang": "en",
"value": "Update to version 1.0.20.1109"
}
],
"source": {
"advisory": "TVN-202012001",
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"assignerShortName": "twcert",
"cveId": "CVE-2020-25842",
"datePublished": "2020-12-31T07:45:45.548Z",
"dateReserved": "2020-09-23T00:00:00.000Z",
"dateUpdated": "2024-09-16T19:25:28.103Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}