Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
21 results
Sep 23, 2026CGServiSign developed by Changing has a OS Command Injection vulnerability.CVE-2026-15027 · Other software · Changing · reported by twcert@cert.org.twHigh 8.6
CGServiSign developed by Changing has a OS Command Injection vulnerability. Unauthenticated remote attackers can induce victims to visit a malicious web page and inject arbitrary OS commands through the local service interface, resulting in command execution on the victim's local computer.
- Product
- CGServiSign
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Aug 2, 2024The specific API in HWATAIServiSign Windows Version from CHANGING Information Technology does not properly validate the length of server-side inputs.CVE-2024-40723 · Other software · CHANGING Information Technology · reported by twcert@cert.org.twMedium 4.3
The specific API in HWATAIServiSign Windows Version from CHANGING Information Technology does not properly validate the length of server-side inputs. When a user visits a spoofed website, unauthenticated remote attackers can cause a stack-based buffer overflow in the HWATAIServiSign, temporarily disrupting its service.
- Product
- HWATAIServiSign Windows Version
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Aug 2, 2024The specific API in TCBServiSign Windows Version from CHANGING Information Technology does does not properly validate the length of server-side input.CVE-2024-40722 · Other software · CHANGING Information Technology · reported by twcert@cert.org.twMedium 4.3
The specific API in TCBServiSign Windows Version from CHANGING Information Technology does does not properly validate the length of server-side input. When a user visits a spoofed website, unauthenticated remote attackers can cause a stack-based buffer overflow in the TCBServiSign, temporarily disrupting its service.
- Product
- TCBServiSign Windows Version
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Aug 2, 2024The specific API in TCBServiSign Windows Version from CHANGING Information Technology does not properly validate server-side input.CVE-2024-40721 · Other software · CHANGING Information Technology · reported by twcert@cert.org.twHigh 8.8
The specific API in TCBServiSign Windows Version from CHANGING Information Technology does not properly validate server-side input. When a user visits a spoofed website, unauthenticated remote attackers can cause the TCBServiSign to load a DLL from an arbitrary path.
- Product
- TCBServiSign Windows Version
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Aug 2, 2024The specific API in TCBServiSign Windows Version from CHANGING Information Technology does not properly validate server-side input.CVE-2024-40720 · Other software · CHANGING Information Technology · reported by twcert@cert.org.twHigh 8.8
The specific API in TCBServiSign Windows Version from CHANGING Information Technology does not properly validate server-side input. When a user visits a spoofed website, unauthenticated remote attackers can modify the `HKEY_CURRENT_USER` registry to execute arbitrary commands.
- Product
- TCBServiSign Windows Version
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Aug 2, 2024The encryption strength of the authorization keys in CHANGING Information Technology TCBServiSign Windows Version is insufficient.CVE-2024-40719 · Other software · CHANGING Information Technology · reported by twcert@cert.org.twMedium 6.5
The encryption strength of the authorization keys in CHANGING Information Technology TCBServiSign Windows Version is insufficient. When a remote attacker tricks a victim into visiting a malicious website, TCBServiSign will treat that website as a legitimate server and interact with it.
- Product
- TCBServiSign Windows Version
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Jan 31, 2023ChangingTech MegaServiSignAdapter component has a vulnerability of Out-of-bounds Read due to insufficient validation for parameter length.CVE-2022-39061 · Other software · ChangingTec · reported by twcert@cert.org.twMedium 6.5
ChangingTech MegaServiSignAdapter component has a vulnerability of Out-of-bounds Read due to insufficient validation for parameter length. An unauthenticated remote attacker can exploit this vulnerability to access partial sensitive content in memory and disrupts partial services.
- Product
- MegaServiSignAdapter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Jan 31, 2023ChangingTech MegaServiSignAdapter component has a vulnerability of improper input validation.CVE-2022-39060 · Other software · ChangingTec · reported by twcert@cert.org.twCritical 9.8
ChangingTech MegaServiSignAdapter component has a vulnerability of improper input validation. An unauthenticated remote attacker can exploit this vulnerability to access and modify HKEY_CURRENT_USER subkey (ex: AutoRUN) in Registry where malicious scripts can be executed to take control of the system or to terminate the service.
- Product
- MegaServiSignAdapter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Jan 31, 2023ChangingTech MegaServiSignAdapter component has a path traversal vulnerability within its file reading function.CVE-2022-39059 · Other software · ChangingTec · reported by twcert@cert.org.twHigh 7.5
ChangingTech MegaServiSignAdapter component has a path traversal vulnerability within its file reading function. An unauthenticated remote attacker can exploit this vulnerability to access arbitrary system files.
- Product
- MegaServiSignAdapter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Jan 2, 2023ChangingTec ServiSign component has a path traversal vulnerability due to insufficient filtering for special characters in the DLL file path.CVE-2022-46306 · Other software · ChangingTec · reported by twcert@cert.org.twHigh 8.8
ChangingTec ServiSign component has a path traversal vulnerability due to insufficient filtering for special characters in the DLL file path. An unauthenticated remote attacker can host a malicious website for the component user to access, which triggers the component to load malicious DLL files under arbitrary file path and allows the attacker to perform arbitrary system operation and disrupt of service.
- Product
- ServiSign
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Jan 2, 2023ChangingTec ServiSign component has a path traversal vulnerability.CVE-2022-46305 · Other software · ChangingTec · reported by twcert@cert.org.twMedium 6.5
ChangingTec ServiSign component has a path traversal vulnerability. An unauthenticated LAN attacker can exploit this vulnerability to bypass authentication and access arbitrary system files.
- Product
- ServiSign
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Jan 2, 2023ChangingTec ServiSign component has insufficient filtering for special characters in the connection response parameter.CVE-2022-46304 · Other software · ChangingTec · reported by twcert@cert.org.twHigh 8.8
ChangingTec ServiSign component has insufficient filtering for special characters in the connection response parameter. An unauthenticated remote attacker can host a malicious website for the component user to access, which triggers command injection and allows the attacker to execute arbitrary system command to perform arbitrary system operation or disrupt service.
- Product
- ServiSign
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Sep 15, 2021WriteRegistry function in TSSServiSign component does not filter and verify users’ input, remote attackers can rewrite to the registry without permissions thus CVE-2021-37909 · Other software · CHANGING Inc. · reported by twcert@cert.org.twCritical 9.8
WriteRegistry function in TSSServiSign component does not filter and verify users’ input, remote attackers can rewrite to the registry without permissions thus perform hijack attacks to execute arbitrary code.
- Product
- TSSServiSignAdapter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Dec 31, 2020The digest generation function of NHIServiSignAdapter has not been verified for source file path, which leads to the SMB request being redirected to a maliciousCVE-2020-25846 · Other software · CHANGING Inc. · reported by twcert@cert.org.twHigh 7.5
The digest generation function of NHIServiSignAdapter has not been verified for source file path, which leads to the SMB request being redirected to a malicious host, resulting in the leakage of user's credential.
- Product
- NHIServiSignAdapter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Dec 31, 2020Multiple functions of NHIServiSignAdapter failed to verify the users’ file path, which leads to the SMB request being redirected to a malicious host, resulting CVE-2020-25845 · Other software · CHANGING Inc. · reported by twcert@cert.org.twHigh 7.5
Multiple functions of NHIServiSignAdapter failed to verify the users’ file path, which leads to the SMB request being redirected to a malicious host, resulting in the leakage of user's credential.
- Product
- NHIServiSignAdapter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Dec 31, 2020The digest generation function of NHIServiSignAdapter has not been verified for parameter’s length, which leads to a stack overflow loophole.CVE-2020-25844 · Other software · CHANGING Inc. · reported by twcert@cert.org.twHigh 8.1
The digest generation function of NHIServiSignAdapter has not been verified for parameter’s length, which leads to a stack overflow loophole. Remote attackers can use the leak to execute code without privilege.
- Product
- NHIServiSignAdapter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Dec 31, 2020NHIServiSignAdapter fails to verify the length of digital credential files’ path which leads to a heap overflow loophole.CVE-2020-25843 · Other software · CHANGING Inc. · reported by twcert@cert.org.twHigh 8.1
NHIServiSignAdapter fails to verify the length of digital credential files’ path which leads to a heap overflow loophole. Remote attackers can use the leak to execute code without privilege.
- Product
- NHIServiSignAdapter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Dec 31, 2020The encryption function of NHIServiSignAdapter fail to verify the file path input by users.CVE-2020-25842 · Other software · CHANGING Inc. · reported by twcert@cert.org.twHigh 7.5
The encryption function of NHIServiSignAdapter fail to verify the file path input by users. Remote attacker can access arbitrary files through the flaw without privilege.
- Product
- NHIServiSignAdapter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Feb 3, 2020An arbitrary-file-access vulnerability exists in ServiSign security plugin, as long as the attackers learn the specific API function, they may access arbitrary CVE-2020-3927 · Other software · CHANGING · reported by twcert@cert.org.twHigh 8.3
An arbitrary-file-access vulnerability exists in ServiSign security plugin, as long as the attackers learn the specific API function, they may access arbitrary files on target system via crafted API parameter.
- Product
- ServiSign Windows versions
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtvn.twcert.org.twchtsecurity.com
Feb 3, 2020An arbitrary-file-access vulnerability exists in ServiSign security plugin, as long as the attackers learn the specific API function, they may access arbitrary CVE-2020-3926 · Other software · CHANGING · reported by twcert@cert.org.twMedium 6.1
An arbitrary-file-access vulnerability exists in ServiSign security plugin, as long as the attackers learn the specific API function, they may access arbitrary files on target system via crafted API parameter.
- Product
- ServiSign Windows versions
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtvn.twcert.org.twchtsecurity.com
Feb 3, 2020A Remote Code Execution(RCE) vulnerability exists in some designated applications in ServiSign security plugin, as long as the interface is captured, attackers CVE-2020-3925 · Other software · CHANGING · reported by twcert@cert.org.twHigh 8.3
A Remote Code Execution(RCE) vulnerability exists in some designated applications in ServiSign security plugin, as long as the interface is captured, attackers are able to launch RCE and executes arbitrary command on target system via malicious crafted scripts.
- Product
- ServiSign Windows versions
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtvn.twcert.org.twchtsecurity.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.