CHANGING Information Technology vulnerabilities
We track 8 vulnerabilities in CHANGING Information Technology products across 4 products. 8 are rated high or critical, and none are known to be exploited. The most recent was published on December 31, 2024.
Latest CHANGING Information Technology vulnerabilities
- 8.8 High severity
CGFIDO: Authentication Bypass by Capture-replay
The login mechanism via device authentication of CGFIDO from Changing Information Technology has an Authentication Bypass vulnerability. If a user visits a forged website, the agent program deployed on their device will send an authentication signature to the
- 8.8 High severity
CGFIDO: Authentication Bypass by Assumed-Immutable Data
The passwordless login mechanism in CGFIDO from Changing Information Technology has an Authentication Bypass vulnerability, allowing remote attackers with regular privileges to send a crafted request to switch to the identity of any user, including administrat
- 7.2 High severity
IDExpert: Improper Neutralization of Special Elements used in an OS Command
IDExpert from CHANGING Information Technology does not properly validate a specific parameter in the administrator interface, allowing remote attackers with administrative privileges to inject and execute OS commands on the server.
- 8.8 High severity
The specific API in TCBServiSign Windows Version from CHANGING Information Technology does not…
The specific API in TCBServiSign Windows Version from CHANGING Information Technology does not properly validate server-side input. When a user visits a spoofed website, unauthenticated remote attackers can cause the TCBServiSign to load a DLL from an arbitrar
- 8.8 High severity
The specific API in TCBServiSign Windows Version from CHANGING Information Technology does not…
The specific API in TCBServiSign Windows Version from CHANGING Information Technology does not properly validate server-side input. When a user visits a spoofed website, unauthenticated remote attackers can modify the `HKEY_CURRENT_USER` registry to execute ar
- 7.5 High severity
RAVA certificate validation system: Improper Limitation of a Pathname to a Restricted Directory
RAVA certification validation system has a path traversal vulnerability. An unauthenticated remote attacker can exploit this vulnerability to bypass authentication and access arbitrary system files.
- 7.2 High severity
RAVA certificate validation system: Improper Neutralization of Special Elements used in an OS Command
RAVA certificate validation system has insufficient filtering for special parameter of the web page input field. A remote attacker with administrator privilege can exploit this vulnerability to perform arbitrary system command and disrupt service.
- 9.8 Critical severity
RAVA certificate validation system: Improper Neutralization of Special Elements used in an SQL Command
RAVA certificate validation system has insufficient validation for user input. An unauthenticated remote attacker can inject arbitrary SQL command to access, modify and delete database.