Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
90 vulnerabilities by HGiga
CVE-2021-22852 (GCVE-0-2021-22852)
Vulnerability from cvelistv5 – Published: 2021-01-19 10:05 – Updated: 2024-09-16 16:33
VLAI
EPSS
VEX
Title
HGiga OAKloud Portal - SQL injection -2
Summary
HGiga EIP product contains SQL Injection vulnerability. Attackers can inject SQL commands into specific URL parameter (online registration) to obtain database schema and data.
Severity
8.8 (High)
CWE
- CWE-89 - SQL Injection
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://www.chtsecurity.com/news/eb024200-7cf9-4c… | x_refsource_MISC |
| https://www.twcert.org.tw/tw/cp-132-4328-97765-1.html | x_refsource_MISC |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| HGiga | OAKSv20 OAKlouds-mol_course_v3 2.0 |
Affected:
2.0-124 , ≤ 2.0-146
(custom)
|
|
| HGiga | OAKSv30 OAKlouds-mol_course_v3 3.0 |
Affected:
3.0-124 , ≤ 3.0-146
(custom)
|
Date Public
2021-01-19 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T18:51:07.484Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.chtsecurity.com/news/eb024200-7cf9-4c58-a063-c451dbc9daef"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.twcert.org.tw/tw/cp-132-4328-97765-1.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "OAKSv20 OAKlouds-mol_course_v3 2.0",
"vendor": "HGiga",
"versions": [
{
"lessThanOrEqual": "2.0-146",
"status": "affected",
"version": "2.0-124",
"versionType": "custom"
}
]
},
{
"product": "OAKSv30 OAKlouds-mol_course_v3 3.0",
"vendor": "HGiga",
"versions": [
{
"lessThanOrEqual": "3.0-146",
"status": "affected",
"version": "3.0-124",
"versionType": "custom"
}
]
}
],
"datePublic": "2021-01-19T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "HGiga EIP product contains SQL Injection vulnerability. Attackers can inject SQL commands into specific URL parameter (online registration) to obtain database schema and data."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89 SQL Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-01-19T10:05:36.000Z",
"orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"shortName": "twcert"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.chtsecurity.com/news/eb024200-7cf9-4c58-a063-c451dbc9daef"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.twcert.org.tw/tw/cp-132-4328-97765-1.html"
}
],
"solutions": [
{
"lang": "en",
"value": "OAKSv30 OAKlouds-mol_course_v3 3.0 \u003e= 3.0-147\nOAKSv20 OAKlouds-mol_course_v3 2.0 \u003e= 2.0-147"
}
],
"source": {
"advisory": "TVN-202101006",
"discovery": "EXTERNAL"
},
"title": "HGiga OAKloud Portal - SQL injection -2",
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"AKA": "TWCERT/CC",
"ASSIGNER": "cve@cert.org.tw",
"DATE_PUBLIC": "2021-01-19T08:53:00.000Z",
"ID": "CVE-2021-22852",
"STATE": "PUBLIC",
"TITLE": "HGiga OAKloud Portal - SQL injection -2"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "OAKSv20 OAKlouds-mol_course_v3 2.0",
"version": {
"version_data": [
{
"version_affected": "\u003c=",
"version_name": "2.0-124",
"version_value": "2.0-146"
}
]
}
},
{
"product_name": "OAKSv30 OAKlouds-mol_course_v3 3.0",
"version": {
"version_data": [
{
"version_affected": "\u003c=",
"version_name": "3.0-124",
"version_value": "3.0-146"
}
]
}
}
]
},
"vendor_name": "HGiga"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "HGiga EIP product contains SQL Injection vulnerability. Attackers can inject SQL commands into specific URL parameter (online registration) to obtain database schema and data."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-89 SQL Injection"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.chtsecurity.com/news/eb024200-7cf9-4c58-a063-c451dbc9daef",
"refsource": "MISC",
"url": "https://www.chtsecurity.com/news/eb024200-7cf9-4c58-a063-c451dbc9daef"
},
{
"name": "https://www.twcert.org.tw/tw/cp-132-4328-97765-1.html",
"refsource": "MISC",
"url": "https://www.twcert.org.tw/tw/cp-132-4328-97765-1.html"
}
]
},
"solution": [
{
"lang": "en",
"value": "OAKSv30 OAKlouds-mol_course_v3 3.0 \u003e= 3.0-147\nOAKSv20 OAKlouds-mol_course_v3 2.0 \u003e= 2.0-147"
}
],
"source": {
"advisory": "TVN-202101006",
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"assignerShortName": "twcert",
"cveId": "CVE-2021-22852",
"datePublished": "2021-01-19T10:05:36.386Z",
"dateReserved": "2021-01-06T00:00:00.000Z",
"dateUpdated": "2024-09-16T16:33:42.943Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-22851 (GCVE-0-2021-22851)
Vulnerability from cvelistv5 – Published: 2021-01-19 10:05 – Updated: 2024-09-16 17:43
VLAI
EPSS
VEX
Title
HGiga OAKloud Portal - SQL injection -1
Summary
HGiga EIP product contains SQL Injection vulnerability. Attackers can inject SQL commands into specific URL parameter (document management page) to obtain database schema and data.
Severity
9.8 (Critical)
CWE
- CWE-89 - SQL Injection
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://www.chtsecurity.com/news/eb024200-7cf9-4c… | x_refsource_MISC |
| https://www.twcert.org.tw/tw/cp-132-4327-50e99-1.html | x_refsource_MISC |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| HGiga | OAKSv20 OAKlouds-document_v3 2.0 |
Affected:
unspecified , < 2.0-54
(custom)
|
|
| HGiga | OAKSv30 OAKlouds-document_v3 3.0 |
Affected:
unspecified , < 3.0-54
(custom)
|
Date Public
2021-01-19 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T18:51:07.514Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.chtsecurity.com/news/eb024200-7cf9-4c58-a063-c451dbc9daef"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.twcert.org.tw/tw/cp-132-4327-50e99-1.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "OAKSv20 OAKlouds-document_v3 2.0",
"vendor": "HGiga",
"versions": [
{
"lessThan": "2.0-54",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "OAKSv30 OAKlouds-document_v3 3.0",
"vendor": "HGiga",
"versions": [
{
"lessThan": "3.0-54",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
}
],
"datePublic": "2021-01-19T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "HGiga EIP product contains SQL Injection vulnerability. Attackers can inject SQL commands into specific URL parameter (document management page) to obtain database schema and data."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89 SQL Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-01-19T10:05:35.000Z",
"orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"shortName": "twcert"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.chtsecurity.com/news/eb024200-7cf9-4c58-a063-c451dbc9daef"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.twcert.org.tw/tw/cp-132-4327-50e99-1.html"
}
],
"solutions": [
{
"lang": "en",
"value": "OAKSv20 OAKlouds-document_v3 2.0 \u003e= 2.0-54\nOAKSv30 OAKlouds-document_v3 3.0 \u003e= 3.0-54"
}
],
"source": {
"advisory": "TVN-202101005",
"discovery": "EXTERNAL"
},
"title": "HGiga OAKloud Portal - SQL injection -1",
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"AKA": "TWCERT/CC",
"ASSIGNER": "cve@cert.org.tw",
"DATE_PUBLIC": "2021-01-19T08:53:00.000Z",
"ID": "CVE-2021-22851",
"STATE": "PUBLIC",
"TITLE": "HGiga OAKloud Portal - SQL injection -1"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "OAKSv20 OAKlouds-document_v3 2.0",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_value": "2.0-54"
}
]
}
},
{
"product_name": "OAKSv30 OAKlouds-document_v3 3.0",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_value": "3.0-54"
}
]
}
}
]
},
"vendor_name": "HGiga"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "HGiga EIP product contains SQL Injection vulnerability. Attackers can inject SQL commands into specific URL parameter (document management page) to obtain database schema and data."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-89 SQL Injection"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.chtsecurity.com/news/eb024200-7cf9-4c58-a063-c451dbc9daef",
"refsource": "MISC",
"url": "https://www.chtsecurity.com/news/eb024200-7cf9-4c58-a063-c451dbc9daef"
},
{
"name": "https://www.twcert.org.tw/tw/cp-132-4327-50e99-1.html",
"refsource": "MISC",
"url": "https://www.twcert.org.tw/tw/cp-132-4327-50e99-1.html"
}
]
},
"solution": [
{
"lang": "en",
"value": "OAKSv20 OAKlouds-document_v3 2.0 \u003e= 2.0-54\nOAKSv30 OAKlouds-document_v3 3.0 \u003e= 3.0-54"
}
],
"source": {
"advisory": "TVN-202101005",
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"assignerShortName": "twcert",
"cveId": "CVE-2021-22851",
"datePublished": "2021-01-19T10:05:35.751Z",
"dateReserved": "2021-01-06T00:00:00.000Z",
"dateUpdated": "2024-09-16T17:43:24.218Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-22850 (GCVE-0-2021-22850)
Vulnerability from cvelistv5 – Published: 2021-01-19 10:05 – Updated: 2024-09-17 01:16
VLAI
EPSS
VEX
Title
HGiga OAKloud Portal - Security Misconfiguration
Summary
HGiga EIP product lacks ineffective access control in certain pages that allow attackers to access database or perform privileged functions.
Severity
5.3 (Medium)
CWE
- CWE-732 - Incorrect Permission Assignment for Critical Resource
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://www.twcert.org.tw/tw/cp-132-4326-3d9d2-1.html | x_refsource_MISC |
| https://www.chtsecurity.com/news/eb024200-7cf9-4c… | x_refsource_MISC |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| HGiga | OAKSv20 OAKlouds-document_v3 |
Affected:
2.0
|
|
| HGiga | OAKSv30 OAKlouds-document_v3 |
Affected:
3.0
|
Date Public
2021-01-19 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T18:51:07.467Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.twcert.org.tw/tw/cp-132-4326-3d9d2-1.html"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.chtsecurity.com/news/eb024200-7cf9-4c58-a063-c451dbc9daef"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "OAKSv20 OAKlouds-document_v3",
"vendor": "HGiga",
"versions": [
{
"status": "affected",
"version": "2.0"
}
]
},
{
"product": "OAKSv30 OAKlouds-document_v3",
"vendor": "HGiga",
"versions": [
{
"status": "affected",
"version": "3.0"
}
]
}
],
"datePublic": "2021-01-19T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "HGiga EIP product lacks ineffective access control in certain pages that allow attackers to access database or perform privileged functions."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-732",
"description": "CWE-732 Incorrect Permission Assignment for Critical Resource",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-01-19T10:05:34.000Z",
"orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"shortName": "twcert"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.twcert.org.tw/tw/cp-132-4326-3d9d2-1.html"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.chtsecurity.com/news/eb024200-7cf9-4c58-a063-c451dbc9daef"
}
],
"solutions": [
{
"lang": "en",
"value": "Contact HGiga Inc. for corresponding measures."
}
],
"source": {
"advisory": "TVN-202101004",
"discovery": "EXTERNAL"
},
"title": "HGiga OAKloud Portal - Security Misconfiguration",
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"AKA": "TWCERT/CC",
"ASSIGNER": "cve@cert.org.tw",
"DATE_PUBLIC": "2021-01-19T08:53:00.000Z",
"ID": "CVE-2021-22850",
"STATE": "PUBLIC",
"TITLE": "HGiga OAKloud Portal - Security Misconfiguration"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "OAKSv20 OAKlouds-document_v3",
"version": {
"version_data": [
{
"version_affected": "=",
"version_value": "2.0"
}
]
}
},
{
"product_name": "OAKSv30 OAKlouds-document_v3",
"version": {
"version_data": [
{
"version_affected": "=",
"version_value": "3.0"
}
]
}
}
]
},
"vendor_name": "HGiga"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "HGiga EIP product lacks ineffective access control in certain pages that allow attackers to access database or perform privileged functions."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-732 Incorrect Permission Assignment for Critical Resource"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.twcert.org.tw/tw/cp-132-4326-3d9d2-1.html",
"refsource": "MISC",
"url": "https://www.twcert.org.tw/tw/cp-132-4326-3d9d2-1.html"
},
{
"name": "https://www.chtsecurity.com/news/eb024200-7cf9-4c58-a063-c451dbc9daef",
"refsource": "MISC",
"url": "https://www.chtsecurity.com/news/eb024200-7cf9-4c58-a063-c451dbc9daef"
}
]
},
"solution": [
{
"lang": "en",
"value": "Contact HGiga Inc. for corresponding measures."
}
],
"source": {
"advisory": "TVN-202101004",
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"assignerShortName": "twcert",
"cveId": "CVE-2021-22850",
"datePublished": "2021-01-19T10:05:35.059Z",
"dateReserved": "2021-01-06T00:00:00.000Z",
"dateUpdated": "2024-09-17T01:16:31.598Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2020-35851 (GCVE-0-2020-35851)
Vulnerability from cvelistv5 – Published: 2020-12-31 07:45 – Updated: 2024-09-17 04:25
VLAI
EPSS
VEX
Title
HGiga MailSherlock - Command Injection
Summary
HGiga MailSherlock does not validate specific parameters properly. Attackers can use the vulnerability to launch Command inject attacks remotely and execute arbitrary commands of the system.
Severity
8.1 (High)
CWE
- CWE-78 - OS Command Injection
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.twcert.org.tw/en/cp-139-4264-f10f4-2.html | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| HGiga | MailSherlock MSR45/SSR45 |
Affected:
unspecified , < 115
(custom)
|
Date Public
2020-12-31 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T17:16:13.138Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.twcert.org.tw/en/cp-139-4264-f10f4-2.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"platforms": [
"iSherlock-user-4.5"
],
"product": "MailSherlock MSR45/SSR45",
"vendor": "HGiga",
"versions": [
{
"lessThan": "115",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Robin Tung, Dio Lin of CHT Security Co., Ltd."
}
],
"datePublic": "2020-12-31T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "HGiga MailSherlock does not validate specific parameters properly. Attackers can use the vulnerability to launch Command inject attacks remotely and execute arbitrary commands of the system."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78 OS Command Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-12-31T07:45:52.000Z",
"orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"shortName": "twcert"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.twcert.org.tw/en/cp-139-4264-f10f4-2.html"
}
],
"solutions": [
{
"lang": "en",
"value": "Update MailSherlock MSR45/SSR45 Module to iSherlock-user-4.5-115.i386.rpm"
}
],
"source": {
"advisory": "TVN-202011002",
"discovery": "EXTERNAL"
},
"title": "HGiga MailSherlock - Command Injection",
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"AKA": "TWCERT/CC",
"ASSIGNER": "cve@cert.org.tw",
"DATE_PUBLIC": "2020-12-31T05:00:00.000Z",
"ID": "CVE-2020-35851",
"STATE": "PUBLIC",
"TITLE": "HGiga MailSherlock - Command Injection"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "MailSherlock MSR45/SSR45",
"version": {
"version_data": [
{
"platform": "iSherlock-user-4.5",
"version_affected": "\u003c",
"version_value": "115"
}
]
}
}
]
},
"vendor_name": "HGiga"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "Robin Tung, Dio Lin of CHT Security Co., Ltd."
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "HGiga MailSherlock does not validate specific parameters properly. Attackers can use the vulnerability to launch Command inject attacks remotely and execute arbitrary commands of the system."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-78 OS Command Injection"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.twcert.org.tw/en/cp-139-4264-f10f4-2.html",
"refsource": "MISC",
"url": "https://www.twcert.org.tw/en/cp-139-4264-f10f4-2.html"
}
]
},
"solution": [
{
"lang": "en",
"value": "Update MailSherlock MSR45/SSR45 Module to iSherlock-user-4.5-115.i386.rpm"
}
],
"source": {
"advisory": "TVN-202011002",
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"assignerShortName": "twcert",
"cveId": "CVE-2020-35851",
"datePublished": "2020-12-31T07:45:52.468Z",
"dateReserved": "2020-12-30T00:00:00.000Z",
"dateUpdated": "2024-09-17T04:25:22.980Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2020-35743 (GCVE-0-2020-35743)
Vulnerability from cvelistv5 – Published: 2020-12-31 07:45 – Updated: 2024-09-17 02:37
VLAI
EPSS
VEX
Title
HGiga MailSherlock - SQL Injection -3
Summary
HGiga MailSherlock contains a SQL injection flaw. Attackers can inject and launch SQL commands in a URL parameter of specific cgi pages.
Severity
CWE
- CWE-89 - SQL Injection
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.twcert.org.tw/tw/cp-132-4262-03785-1.html | x_refsource_MISC |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| HGiga | MailSherlock MSR45/SSR45 |
Affected:
unspecified , < 120
(custom)
|
|
| HGiga | MailSherlock MSR45/SSR45 |
Affected:
unspecified , < 133
(custom)
|
Date Public
2020-12-31 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T17:09:15.204Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.twcert.org.tw/tw/cp-132-4262-03785-1.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"platforms": [
"iSherlock-user-4.5"
],
"product": "MailSherlock MSR45/SSR45",
"vendor": "HGiga",
"versions": [
{
"lessThan": "120",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"platforms": [
"iSherlock-antispam-4.5"
],
"product": "MailSherlock MSR45/SSR45",
"vendor": "HGiga",
"versions": [
{
"lessThan": "133",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Robin Tung, Dio Lin of CHT Security Co., Ltd."
}
],
"datePublic": "2020-12-31T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "HGiga MailSherlock contains a SQL injection flaw. Attackers can inject and launch SQL commands in a URL parameter of specific cgi pages."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89 SQL Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-12-31T07:45:51.000Z",
"orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"shortName": "twcert"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.twcert.org.tw/tw/cp-132-4262-03785-1.html"
}
],
"solutions": [
{
"lang": "en",
"value": "Update MailSherlock MSR45/SSR45 Module to:\niSherlock-user-4.5-120.i386.rpm\niSherlock-antispam-4.5-133.i386.rpm"
}
],
"source": {
"advisory": "TVN-202011008",
"discovery": "EXTERNAL"
},
"title": "HGiga MailSherlock - SQL Injection -3",
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"AKA": "TWCERT/CC",
"ASSIGNER": "cve@cert.org.tw",
"DATE_PUBLIC": "2020-12-31T05:00:00.000Z",
"ID": "CVE-2020-35743",
"STATE": "PUBLIC",
"TITLE": "HGiga MailSherlock - SQL Injection -3"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "MailSherlock MSR45/SSR45",
"version": {
"version_data": [
{
"platform": "iSherlock-user-4.5",
"version_affected": "\u003c",
"version_value": "120"
},
{
"platform": "iSherlock-antispam-4.5",
"version_affected": "\u003c",
"version_value": "133"
}
]
}
}
]
},
"vendor_name": "HGiga"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "Robin Tung, Dio Lin of CHT Security Co., Ltd."
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "HGiga MailSherlock contains a SQL injection flaw. Attackers can inject and launch SQL commands in a URL parameter of specific cgi pages."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-89 SQL Injection"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.twcert.org.tw/tw/cp-132-4262-03785-1.html",
"refsource": "MISC",
"url": "https://www.twcert.org.tw/tw/cp-132-4262-03785-1.html"
}
]
},
"solution": [
{
"lang": "en",
"value": "Update MailSherlock MSR45/SSR45 Module to:\niSherlock-user-4.5-120.i386.rpm\niSherlock-antispam-4.5-133.i386.rpm"
}
],
"source": {
"advisory": "TVN-202011008",
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"assignerShortName": "twcert",
"cveId": "CVE-2020-35743",
"datePublished": "2020-12-31T07:45:51.808Z",
"dateReserved": "2020-12-28T00:00:00.000Z",
"dateUpdated": "2024-09-17T02:37:09.672Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2020-35742 (GCVE-0-2020-35742)
Vulnerability from cvelistv5 – Published: 2020-12-31 07:45 – Updated: 2024-09-16 18:03
VLAI
EPSS
VEX
Title
HGiga MailSherlock - SQL Injection -1
Summary
HGiga MailSherlock contains a vulnerability of SQL Injection. Attackers can inject and launch SQL commands in a URL parameter.
Severity
CWE
- CWE-89 - SQL Injection
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.twcert.org.tw/tw/cp-132-4261-d5379-1.html | x_refsource_MISC |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| HGiga | MailSherlock MSR45/SSR45 |
Affected:
unspecified , < 120
(custom)
|
|
| HGiga | MailSherlock MSR45/SSR45 |
Affected:
unspecified , < 133
(custom)
|
Date Public
2020-12-31 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T17:09:15.146Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.twcert.org.tw/tw/cp-132-4261-d5379-1.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"platforms": [
"iSherlock-user-4.5"
],
"product": "MailSherlock MSR45/SSR45",
"vendor": "HGiga",
"versions": [
{
"lessThan": "120",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"platforms": [
"iSherlock-antispam-4.5"
],
"product": "MailSherlock MSR45/SSR45",
"vendor": "HGiga",
"versions": [
{
"lessThan": "133",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Robin Tung, Dio Lin of CHT Security Co., Ltd."
}
],
"datePublic": "2020-12-31T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "HGiga MailSherlock contains a vulnerability of SQL Injection. Attackers can inject and launch SQL commands in a URL parameter."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89 SQL Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-12-31T07:45:51.000Z",
"orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"shortName": "twcert"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.twcert.org.tw/tw/cp-132-4261-d5379-1.html"
}
],
"solutions": [
{
"lang": "en",
"value": "Update MailSherlock MSR45/SSR45 Module to:\niSherlock-user-4.5-120.i386.rpm\niSherlock-antispam-4.5-133.i386.rpm"
}
],
"source": {
"advisory": "TVN-202011006",
"discovery": "EXTERNAL"
},
"title": "HGiga MailSherlock - SQL Injection -1",
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"AKA": "TWCERT/CC",
"ASSIGNER": "cve@cert.org.tw",
"DATE_PUBLIC": "2020-12-31T05:00:00.000Z",
"ID": "CVE-2020-35742",
"STATE": "PUBLIC",
"TITLE": "HGiga MailSherlock - SQL Injection -1"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "MailSherlock MSR45/SSR45",
"version": {
"version_data": [
{
"platform": "iSherlock-user-4.5",
"version_affected": "\u003c",
"version_value": "120"
},
{
"platform": "iSherlock-antispam-4.5",
"version_affected": "\u003c",
"version_value": "133"
}
]
}
}
]
},
"vendor_name": "HGiga"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "Robin Tung, Dio Lin of CHT Security Co., Ltd."
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "HGiga MailSherlock contains a vulnerability of SQL Injection. Attackers can inject and launch SQL commands in a URL parameter."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-89 SQL Injection"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.twcert.org.tw/tw/cp-132-4261-d5379-1.html",
"refsource": "MISC",
"url": "https://www.twcert.org.tw/tw/cp-132-4261-d5379-1.html"
}
]
},
"solution": [
{
"lang": "en",
"value": "Update MailSherlock MSR45/SSR45 Module to:\niSherlock-user-4.5-120.i386.rpm\niSherlock-antispam-4.5-133.i386.rpm"
}
],
"source": {
"advisory": "TVN-202011006",
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"assignerShortName": "twcert",
"cveId": "CVE-2020-35742",
"datePublished": "2020-12-31T07:45:51.201Z",
"dateReserved": "2020-12-28T00:00:00.000Z",
"dateUpdated": "2024-09-16T18:03:00.267Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2020-35741 (GCVE-0-2020-35741)
Vulnerability from cvelistv5 – Published: 2020-12-31 07:45 – Updated: 2024-09-16 22:55
VLAI
EPSS
VEX
Title
HGiga MailSherlock - XSS -2
Summary
HGiga MailSherlock does not validate user parameters on multiple login pages. Attackers can use the vulnerability to inject JavaScript syntax for XSS attacks.
Severity
CWE
- CWE-79 - Cross-site Scripting (XSS)
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.twcert.org.tw/tw/cp-132-4260-ba376-1.html | x_refsource_MISC |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| HGiga | MailSherlock MSR45/SSR45 |
Affected:
unspecified , < 120
(custom)
|
|
| HGiga | MailSherlock MSR45/SSR45 |
Affected:
unspecified , < 133
(custom)
|
Date Public
2020-12-31 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T17:09:15.252Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.twcert.org.tw/tw/cp-132-4260-ba376-1.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"platforms": [
"iSherlock-user-4.5"
],
"product": "MailSherlock MSR45/SSR45",
"vendor": "HGiga",
"versions": [
{
"lessThan": "120",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"platforms": [
"iSherlock-antispam-4.5"
],
"product": "MailSherlock MSR45/SSR45",
"vendor": "HGiga",
"versions": [
{
"lessThan": "133",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Robin Tung, Dio Lin of CHT Security Co., Ltd."
}
],
"datePublic": "2020-12-31T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "HGiga MailSherlock does not validate user parameters on multiple login pages. Attackers can use the vulnerability to inject JavaScript syntax for XSS attacks."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Cross-site Scripting (XSS)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-12-31T07:45:50.000Z",
"orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"shortName": "twcert"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.twcert.org.tw/tw/cp-132-4260-ba376-1.html"
}
],
"solutions": [
{
"lang": "en",
"value": "Update MailSherlock MSR45/SSR45 Module to:\niSherlock-user-4.5-120.i386.rpm\niSherlock-antispam-4.5-133.i386.rpm"
}
],
"source": {
"advisory": "TVN-202011005",
"discovery": "EXTERNAL"
},
"title": "HGiga MailSherlock - XSS -2",
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"AKA": "TWCERT/CC",
"ASSIGNER": "cve@cert.org.tw",
"DATE_PUBLIC": "2020-12-31T05:00:00.000Z",
"ID": "CVE-2020-35741",
"STATE": "PUBLIC",
"TITLE": "HGiga MailSherlock - XSS -2"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "MailSherlock MSR45/SSR45",
"version": {
"version_data": [
{
"platform": "iSherlock-user-4.5",
"version_affected": "\u003c",
"version_value": "120"
},
{
"platform": "iSherlock-antispam-4.5",
"version_affected": "\u003c",
"version_value": "133"
}
]
}
}
]
},
"vendor_name": "HGiga"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "Robin Tung, Dio Lin of CHT Security Co., Ltd."
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "HGiga MailSherlock does not validate user parameters on multiple login pages. Attackers can use the vulnerability to inject JavaScript syntax for XSS attacks."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-79 Cross-site Scripting (XSS)"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.twcert.org.tw/tw/cp-132-4260-ba376-1.html",
"refsource": "MISC",
"url": "https://www.twcert.org.tw/tw/cp-132-4260-ba376-1.html"
}
]
},
"solution": [
{
"lang": "en",
"value": "Update MailSherlock MSR45/SSR45 Module to:\niSherlock-user-4.5-120.i386.rpm\niSherlock-antispam-4.5-133.i386.rpm"
}
],
"source": {
"advisory": "TVN-202011005",
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"assignerShortName": "twcert",
"cveId": "CVE-2020-35741",
"datePublished": "2020-12-31T07:45:50.593Z",
"dateReserved": "2020-12-28T00:00:00.000Z",
"dateUpdated": "2024-09-16T22:55:57.902Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2020-35740 (GCVE-0-2020-35740)
Vulnerability from cvelistv5 – Published: 2020-12-31 07:45 – Updated: 2024-09-16 23:36
VLAI
EPSS
VEX
Title
HGiga MailSherlock - XSS -1
Summary
HGiga MailSherlock does not validate specific URL parameters properly that allows attackers to inject JavaScript syntax for XSS attacks.
Severity
CWE
- CWE-79 - Cross-site Scripting (XSS)
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.twcert.org.tw/tw/cp-132-4259-90f23-1.html | x_refsource_MISC |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| HGiga | MailSherlock MSR45/SSR45 |
Affected:
unspecified , < 120
(custom)
|
|
| HGiga | MailSherlock MSR45/SSR45 |
Affected:
unspecified , < 133
(custom)
|
Date Public
2020-12-31 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T17:09:15.246Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.twcert.org.tw/tw/cp-132-4259-90f23-1.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"platforms": [
"iSherlock-user-4.5"
],
"product": "MailSherlock MSR45/SSR45",
"vendor": "HGiga",
"versions": [
{
"lessThan": "120",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"platforms": [
"iSherlock-antispam-4.5"
],
"product": "MailSherlock MSR45/SSR45",
"vendor": "HGiga",
"versions": [
{
"lessThan": "133",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Robin Tung, Dio Lin of CHT Security Co., Ltd."
}
],
"datePublic": "2020-12-31T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "HGiga MailSherlock does not validate specific URL parameters properly that allows attackers to inject JavaScript syntax for XSS attacks."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Cross-site Scripting (XSS)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-12-31T07:45:49.000Z",
"orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"shortName": "twcert"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.twcert.org.tw/tw/cp-132-4259-90f23-1.html"
}
],
"solutions": [
{
"lang": "en",
"value": "Update MailSherlock MSR45/SSR45 Module to:\niSherlock-user-4.5-120.i386.rpm\niSherlock-antispam-4.5-133.i386.rpm"
}
],
"source": {
"advisory": "TVN-202011004",
"discovery": "EXTERNAL"
},
"title": "HGiga MailSherlock - XSS -1",
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"AKA": "TWCERT/CC",
"ASSIGNER": "cve@cert.org.tw",
"DATE_PUBLIC": "2020-12-31T05:00:00.000Z",
"ID": "CVE-2020-35740",
"STATE": "PUBLIC",
"TITLE": "HGiga MailSherlock - XSS -1"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "MailSherlock MSR45/SSR45",
"version": {
"version_data": [
{
"platform": "iSherlock-user-4.5",
"version_affected": "\u003c",
"version_value": "120"
},
{
"platform": "iSherlock-antispam-4.5",
"version_affected": "\u003c",
"version_value": "133"
}
]
}
}
]
},
"vendor_name": "HGiga"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "Robin Tung, Dio Lin of CHT Security Co., Ltd."
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "HGiga MailSherlock does not validate specific URL parameters properly that allows attackers to inject JavaScript syntax for XSS attacks."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-79 Cross-site Scripting (XSS)"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.twcert.org.tw/tw/cp-132-4259-90f23-1.html",
"refsource": "MISC",
"url": "https://www.twcert.org.tw/tw/cp-132-4259-90f23-1.html"
}
]
},
"solution": [
{
"lang": "en",
"value": "Update MailSherlock MSR45/SSR45 Module to:\niSherlock-user-4.5-120.i386.rpm\niSherlock-antispam-4.5-133.i386.rpm"
}
],
"source": {
"advisory": "TVN-202011004",
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"assignerShortName": "twcert",
"cveId": "CVE-2020-35740",
"datePublished": "2020-12-31T07:45:49.988Z",
"dateReserved": "2020-12-28T00:00:00.000Z",
"dateUpdated": "2024-09-16T23:36:40.227Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2020-25850 (GCVE-0-2020-25850)
Vulnerability from cvelistv5 – Published: 2020-12-31 07:45 – Updated: 2024-09-16 20:36
VLAI
EPSS
VEX
Title
HGiga MailSherlock - Arbitrary File Download
Summary
The function, view the source code, of HGiga MailSherlock does not validate specific characters. Remote attackers can use this flaw to download arbitrary system files.
Severity
8.1 (High)
CWE
- Arbitrary File Download
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.twcert.org.tw/tw/cp-132-4258-0a8a0-1.html | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| HGiga | MailSherlock MSR45/SSR45 |
Affected:
unspecified , < 117
(custom)
|
Date Public
2020-12-31 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T15:49:05.969Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.twcert.org.tw/tw/cp-132-4258-0a8a0-1.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"platforms": [
"iSherlock-user-4.5"
],
"product": "MailSherlock MSR45/SSR45",
"vendor": "HGiga",
"versions": [
{
"lessThan": "117",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Robin Tung, Dio Lin of CHT Security Co., Ltd."
}
],
"datePublic": "2020-12-31T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "The function, view the source code, of HGiga MailSherlock does not validate specific characters. Remote attackers can use this flaw to download arbitrary system files."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Arbitrary File Download",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-12-31T07:45:49.000Z",
"orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"shortName": "twcert"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.twcert.org.tw/tw/cp-132-4258-0a8a0-1.html"
}
],
"solutions": [
{
"lang": "en",
"value": "Update MailSherlock MSR45/SSR45 Module to iSherlock-user-4.5-117.i386.rpm"
}
],
"source": {
"advisory": "TVN-202011003",
"discovery": "EXTERNAL"
},
"title": "HGiga MailSherlock - Arbitrary File Download",
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"AKA": "TWCERT/CC",
"ASSIGNER": "cve@cert.org.tw",
"DATE_PUBLIC": "2020-12-31T05:00:00.000Z",
"ID": "CVE-2020-25850",
"STATE": "PUBLIC",
"TITLE": "HGiga MailSherlock - Arbitrary File Download"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "MailSherlock MSR45/SSR45",
"version": {
"version_data": [
{
"platform": "iSherlock-user-4.5",
"version_affected": "\u003c",
"version_value": "117"
}
]
}
}
]
},
"vendor_name": "HGiga"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "Robin Tung, Dio Lin of CHT Security Co., Ltd."
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The function, view the source code, of HGiga MailSherlock does not validate specific characters. Remote attackers can use this flaw to download arbitrary system files."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Arbitrary File Download"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.twcert.org.tw/tw/cp-132-4258-0a8a0-1.html",
"refsource": "MISC",
"url": "https://www.twcert.org.tw/tw/cp-132-4258-0a8a0-1.html"
}
]
},
"solution": [
{
"lang": "en",
"value": "Update MailSherlock MSR45/SSR45 Module to iSherlock-user-4.5-117.i386.rpm"
}
],
"source": {
"advisory": "TVN-202011003",
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"assignerShortName": "twcert",
"cveId": "CVE-2020-25850",
"datePublished": "2020-12-31T07:45:49.379Z",
"dateReserved": "2020-09-23T00:00:00.000Z",
"dateUpdated": "2024-09-16T20:36:52.413Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2020-25848 (GCVE-0-2020-25848)
Vulnerability from cvelistv5 – Published: 2020-12-31 07:45 – Updated: 2024-09-17 00:11
VLAI
EPSS
VEX
Title
HGiga MailSherlock - Broken Authentication
Summary
HGiga MailSherlock contains weak authentication flaw that attackers grant privilege remotely with default password generation mechanism.
Severity
9.8 (Critical)
CWE
- Broken Authentication
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.twcert.org.tw/tw/cp-132-4256-cfc5a-1.html | x_refsource_MISC |
Impacted products
5 products
| Vendor | Product | Version | |
|---|---|---|---|
| HGiga | MailSherlock MSR45/SSR45 |
Affected:
unspecified , < 243
(custom)
|
|
| HGiga | MailSherlock MSR45/SSR45 |
Affected:
unspecified , < 114
(custom)
|
|
| HGiga | MailSherlock MSR45/SSR45 |
Affected:
unspecified , < 122
(custom)
|
|
| HGiga | MailSherlock MSR45/SSR45 |
Affected:
unspecified , < 143
(custom)
|
|
| HGiga | MailSherlock MSR45/SSR45 |
Affected:
unspecified , < 130
(custom)
|
Date Public
2020-12-31 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T15:49:05.445Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.twcert.org.tw/tw/cp-132-4256-cfc5a-1.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"platforms": [
"iSherlock-base-4.5"
],
"product": "MailSherlock MSR45/SSR45",
"vendor": "HGiga",
"versions": [
{
"lessThan": "243",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"platforms": [
"iSherlock-user-4.5"
],
"product": "MailSherlock MSR45/SSR45",
"vendor": "HGiga",
"versions": [
{
"lessThan": "114",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"platforms": [
"iSherlock-useradmin-4.5"
],
"product": "MailSherlock MSR45/SSR45",
"vendor": "HGiga",
"versions": [
{
"lessThan": "122",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"platforms": [
"iSherlock-audit-4.5"
],
"product": "MailSherlock MSR45/SSR45",
"vendor": "HGiga",
"versions": [
{
"lessThan": "143",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"platforms": [
"iSherlock-antispam-4.5"
],
"product": "MailSherlock MSR45/SSR45",
"vendor": "HGiga",
"versions": [
{
"lessThan": "130",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Robin Tung, Dio Lin of CHT Security Co., Ltd."
}
],
"datePublic": "2020-12-31T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "HGiga MailSherlock contains weak authentication flaw that attackers grant privilege remotely with default password generation mechanism."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Broken Authentication",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-12-31T07:45:48.000Z",
"orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"shortName": "twcert"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.twcert.org.tw/tw/cp-132-4256-cfc5a-1.html"
}
],
"solutions": [
{
"lang": "en",
"value": "Update MailSherlock MSR45/SSR45 Module to:\niSherlock-base-4.5-243.i386.rpm\t\niSherlock-user-4.5-114.i386.rpm\niSherlock-useradmin-4.5-122.i386.rpm\niSherlock-audit-4.5-143.i386.rpm\niSherlock-antispam-4.5-130.i386.rpm"
}
],
"source": {
"advisory": "TVN-202011001",
"discovery": "EXTERNAL"
},
"title": "HGiga MailSherlock - Broken Authentication",
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"AKA": "TWCERT/CC",
"ASSIGNER": "cve@cert.org.tw",
"DATE_PUBLIC": "2020-12-31T05:00:00.000Z",
"ID": "CVE-2020-25848",
"STATE": "PUBLIC",
"TITLE": "HGiga MailSherlock - Broken Authentication"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "MailSherlock MSR45/SSR45",
"version": {
"version_data": [
{
"platform": "iSherlock-base-4.5",
"version_affected": "\u003c",
"version_value": "243"
},
{
"platform": "iSherlock-user-4.5",
"version_affected": "\u003c",
"version_value": "114"
},
{
"platform": "iSherlock-useradmin-4.5",
"version_affected": "\u003c",
"version_value": "122"
},
{
"platform": "iSherlock-audit-4.5",
"version_affected": "\u003c",
"version_value": "143"
},
{
"platform": "iSherlock-antispam-4.5",
"version_affected": "\u003c",
"version_value": "130"
}
]
}
}
]
},
"vendor_name": "HGiga"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "Robin Tung, Dio Lin of CHT Security Co., Ltd."
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "HGiga MailSherlock contains weak authentication flaw that attackers grant privilege remotely with default password generation mechanism."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Broken Authentication"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.twcert.org.tw/tw/cp-132-4256-cfc5a-1.html",
"refsource": "MISC",
"url": "https://www.twcert.org.tw/tw/cp-132-4256-cfc5a-1.html"
}
]
},
"solution": [
{
"lang": "en",
"value": "Update MailSherlock MSR45/SSR45 Module to:\niSherlock-base-4.5-243.i386.rpm\t\niSherlock-user-4.5-114.i386.rpm\niSherlock-useradmin-4.5-122.i386.rpm\niSherlock-audit-4.5-143.i386.rpm\niSherlock-antispam-4.5-130.i386.rpm"
}
],
"source": {
"advisory": "TVN-202011001",
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"assignerShortName": "twcert",
"cveId": "CVE-2020-25848",
"datePublished": "2020-12-31T07:45:48.728Z",
"dateReserved": "2020-09-23T00:00:00.000Z",
"dateUpdated": "2024-09-17T00:11:14.724Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2020-10512 (GCVE-0-2020-10512)
Vulnerability from cvelistv5 – Published: 2020-04-15 06:20 – Updated: 2024-09-16 20:07
VLAI
EPSS
VEX
Title
HGiga C&Cmail - SQL Injection
Summary
HGiga C&Cmail CCMAILQ before olln-calendar-6.0-100.i386.rpm and CCMAILN before olln-calendar-5.0-100.i386.rpm contains a SQL Injection vulnerability which allows attackers to injecting SQL commands in the URL parameter to execute unauthorized commands.
Severity
8.8 (High)
CWE
- CWE-89 - SQL Injection
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://www.twcert.org.tw/tw/cp-132-3536-79545-1.html | x_refsource_MISC |
| https://gist.github.com/tonykuo76/d52014bbe81995e… | x_refsource_CONFIRM |
| https://www.chtsecurity.com/news/545daf88-adb4-44… | x_refsource_CONFIRM |
Impacted products
Date Public
2020-04-15 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T11:06:09.506Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.twcert.org.tw/tw/cp-132-3536-79545-1.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://gist.github.com/tonykuo76/d52014bbe81995eda499201446aec57a"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.chtsecurity.com/news/545daf88-adb4-4417-9870-426490c1429e"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "C\u0026Cmail",
"vendor": "HGiga",
"versions": [
{
"status": "affected",
"version": "CCMAILQ before olln-calendar-6.0-100.i386.rpm"
},
{
"status": "affected",
"version": "CCMAILN before olln-calendar-5.0-100.i386.rpm"
}
]
}
],
"datePublic": "2020-04-15T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "HGiga C\u0026Cmail CCMAILQ before olln-calendar-6.0-100.i386.rpm and CCMAILN before olln-calendar-5.0-100.i386.rpm contains a SQL Injection vulnerability which allows attackers to injecting SQL commands in the URL parameter to execute unauthorized commands."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89 SQL Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-04-30T17:14:37.000Z",
"orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"shortName": "twcert"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.twcert.org.tw/tw/cp-132-3536-79545-1.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://gist.github.com/tonykuo76/d52014bbe81995eda499201446aec57a"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.chtsecurity.com/news/545daf88-adb4-4417-9870-426490c1429e"
}
],
"solutions": [
{
"lang": "en",
"value": "Contact HGiga Inc. for updated version."
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "HGiga C\u0026Cmail - SQL Injection",
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"AKA": "TWCERT/CC",
"ASSIGNER": "cve@cert.org.tw",
"DATE_PUBLIC": "2020-04-15T05:30:00.000Z",
"ID": "CVE-2020-10512",
"STATE": "PUBLIC",
"TITLE": "HGiga C\u0026Cmail - SQL Injection"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "C\u0026Cmail",
"version": {
"version_data": [
{
"version_value": "CCMAILQ before olln-calendar-6.0-100.i386.rpm"
},
{
"version_value": "CCMAILN before olln-calendar-5.0-100.i386.rpm"
}
]
}
}
]
},
"vendor_name": "HGiga"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "HGiga C\u0026Cmail CCMAILQ before olln-calendar-6.0-100.i386.rpm and CCMAILN before olln-calendar-5.0-100.i386.rpm contains a SQL Injection vulnerability which allows attackers to injecting SQL commands in the URL parameter to execute unauthorized commands."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-89 SQL Injection"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.twcert.org.tw/tw/cp-132-3536-79545-1.html",
"refsource": "MISC",
"url": "https://www.twcert.org.tw/tw/cp-132-3536-79545-1.html"
},
{
"name": "https://gist.github.com/tonykuo76/d52014bbe81995eda499201446aec57a",
"refsource": "CONFIRM",
"url": "https://gist.github.com/tonykuo76/d52014bbe81995eda499201446aec57a"
},
{
"name": "https://www.chtsecurity.com/news/545daf88-adb4-4417-9870-426490c1429e",
"refsource": "CONFIRM",
"url": "https://www.chtsecurity.com/news/545daf88-adb4-4417-9870-426490c1429e"
}
]
},
"solution": [
{
"lang": "en",
"value": "Contact HGiga Inc. for updated version."
}
],
"source": {
"discovery": "UNKNOWN"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"assignerShortName": "twcert",
"cveId": "CVE-2020-10512",
"datePublished": "2020-04-15T06:20:23.231Z",
"dateReserved": "2020-03-12T00:00:00.000Z",
"dateUpdated": "2024-09-16T20:07:25.313Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2020-10511 (GCVE-0-2020-10511)
Vulnerability from cvelistv5 – Published: 2020-04-15 06:20 – Updated: 2024-09-16 23:06
VLAI
EPSS
VEX
Title
HGiga C&Cmail - Broken Access Control
Summary
HGiga C&Cmail CCMAILQ before olln-base-6.0-418.i386.rpm and CCMAILN before olln-base-5.0-418.i386.rpm contains insecure configurations. Attackers can exploit these flaws to access unauthorized functionality via a crafted URL.
Severity
9.8 (Critical)
CWE
- Broken Access Control
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://www.twcert.org.tw/tw/cp-132-3535-e40ec-1.html | x_refsource_MISC |
| https://gist.github.com/tonykuo76/7d41c414f23ef1e… | x_refsource_CONFIRM |
| https://www.chtsecurity.com/news/19400b04-ea92-4e… | x_refsource_CONFIRM |
Impacted products
Date Public
2020-04-15 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T11:06:09.538Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.twcert.org.tw/tw/cp-132-3535-e40ec-1.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://gist.github.com/tonykuo76/7d41c414f23ef1e47c97f7b97e1b33b0"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.chtsecurity.com/news/19400b04-ea92-4eaa-afa7-2449fd9b2e0b"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "C\u0026Cmail",
"vendor": "HGiga",
"versions": [
{
"status": "affected",
"version": "CCMAILQ before olln-base-6.0-418.i386.rpm"
},
{
"status": "affected",
"version": "CCMAILN before olln-base-5.0-418.i386.rpm"
}
]
}
],
"datePublic": "2020-04-15T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "HGiga C\u0026Cmail CCMAILQ before olln-base-6.0-418.i386.rpm and CCMAILN before olln-base-5.0-418.i386.rpm contains insecure configurations. Attackers can exploit these flaws to access unauthorized functionality via a crafted URL."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Broken Access Control",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-04-30T17:17:11.000Z",
"orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"shortName": "twcert"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.twcert.org.tw/tw/cp-132-3535-e40ec-1.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://gist.github.com/tonykuo76/7d41c414f23ef1e47c97f7b97e1b33b0"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.chtsecurity.com/news/19400b04-ea92-4eaa-afa7-2449fd9b2e0b"
}
],
"solutions": [
{
"lang": "en",
"value": "Contact HGiga Inc. for updated version."
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "HGiga C\u0026Cmail - Broken Access Control",
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"AKA": "TWCERT/CC",
"ASSIGNER": "cve@cert.org.tw",
"DATE_PUBLIC": "2020-04-15T05:30:00.000Z",
"ID": "CVE-2020-10511",
"STATE": "PUBLIC",
"TITLE": "HGiga C\u0026Cmail - Broken Access Control"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "C\u0026Cmail",
"version": {
"version_data": [
{
"version_value": "CCMAILQ before olln-base-6.0-418.i386.rpm"
},
{
"version_value": "CCMAILN before olln-base-5.0-418.i386.rpm"
}
]
}
}
]
},
"vendor_name": "HGiga"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "HGiga C\u0026Cmail CCMAILQ before olln-base-6.0-418.i386.rpm and CCMAILN before olln-base-5.0-418.i386.rpm contains insecure configurations. Attackers can exploit these flaws to access unauthorized functionality via a crafted URL."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Broken Access Control"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.twcert.org.tw/tw/cp-132-3535-e40ec-1.html",
"refsource": "MISC",
"url": "https://www.twcert.org.tw/tw/cp-132-3535-e40ec-1.html"
},
{
"name": "https://gist.github.com/tonykuo76/7d41c414f23ef1e47c97f7b97e1b33b0",
"refsource": "CONFIRM",
"url": "https://gist.github.com/tonykuo76/7d41c414f23ef1e47c97f7b97e1b33b0"
},
{
"name": "https://www.chtsecurity.com/news/19400b04-ea92-4eaa-afa7-2449fd9b2e0b",
"refsource": "CONFIRM",
"url": "https://www.chtsecurity.com/news/19400b04-ea92-4eaa-afa7-2449fd9b2e0b"
}
]
},
"solution": [
{
"lang": "en",
"value": "Contact HGiga Inc. for updated version."
}
],
"source": {
"discovery": "UNKNOWN"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"assignerShortName": "twcert",
"cveId": "CVE-2020-10511",
"datePublished": "2020-04-15T06:20:22.802Z",
"dateReserved": "2020-03-12T00:00:00.000Z",
"dateUpdated": "2024-09-16T23:06:55.203Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2019-9883 (GCVE-0-2019-9883)
Vulnerability from cvelistv5 – Published: 2019-06-03 18:03 – Updated: 2024-08-04 22:01
VLAI
EPSS
VEX
Title
Multi modules of MailSherlock MSR35 and MSR45 lead to a CSRF vulnerability. It allows attacker to elevate privilege of specific account.
Summary
Multi modules of MailSherlock MSR35 and MSR45 lead to a CSRF vulnerability. It allows attacker to elevate privilege of specific account via useradmin/cf_new.cgi?chief=&wk_group=full&cf_name=test&cf_account=test&cf_email=&cf_acl=Management&apply_lang=&dn= without any authorizes.
Severity
No CVSS data available.
CWE
- CWE-352 - Cross-Site Request Forgery (CSRF)
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://tvn.twcert.org.tw/taiwanvn/TVN-201904003 | x_refsource_MISC |
| http://surl.twcert.org.tw/mChNi | x_refsource_MISC |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| OAKlouds | MailSherlock MSR35 |
Affected:
iSherlock-base , < 1.5-328
(custom)
Affected: iSherlock-useradmin , < 1.5-239 (custom) Affected: iSherlock-sysinfo , < 1.5-196 (custom) Affected: iSherlock-user , < 1.5-127 (custom) |
|
| OAKlouds | MailSherlock MSR45 |
Affected:
iSherlock-base , < 4.5-206
(custom)
Affected: iSherlock-useradmin , < 4.5-106 (custom) Affected: iSherlock-sysinfo , < 4.5-109 (custom) Affected: iSherlock-user , < 4.5-81 (custom) |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T22:01:54.986Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://tvn.twcert.org.tw/taiwanvn/TVN-201904003"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://surl.twcert.org.tw/mChNi"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "MailSherlock MSR35",
"vendor": "OAKlouds",
"versions": [
{
"lessThan": "1.5-328",
"status": "affected",
"version": "iSherlock-base",
"versionType": "custom"
},
{
"lessThan": "1.5-239",
"status": "affected",
"version": "iSherlock-useradmin",
"versionType": "custom"
},
{
"lessThan": "1.5-196",
"status": "affected",
"version": "iSherlock-sysinfo",
"versionType": "custom"
},
{
"lessThan": "1.5-127",
"status": "affected",
"version": "iSherlock-user",
"versionType": "custom"
}
]
},
{
"product": "MailSherlock MSR45",
"vendor": "OAKlouds",
"versions": [
{
"lessThan": "4.5-206",
"status": "affected",
"version": "iSherlock-base",
"versionType": "custom"
},
{
"lessThan": "4.5-106",
"status": "affected",
"version": "iSherlock-useradmin",
"versionType": "custom"
},
{
"lessThan": "4.5-109",
"status": "affected",
"version": "iSherlock-sysinfo",
"versionType": "custom"
},
{
"lessThan": "4.5-81",
"status": "affected",
"version": "iSherlock-user",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "AurOraD@d"
}
],
"descriptions": [
{
"lang": "en",
"value": "Multi modules of MailSherlock MSR35 and MSR45 lead to a CSRF vulnerability. It allows attacker to elevate privilege of specific account via useradmin/cf_new.cgi?chief=\u0026wk_group=full\u0026cf_name=test\u0026cf_account=test\u0026cf_email=\u0026cf_acl=Management\u0026apply_lang=\u0026dn= without any authorizes."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-352",
"description": "CWE-352 Cross-Site Request Forgery (CSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-06-03T18:03:21.000Z",
"orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"shortName": "twcert"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://tvn.twcert.org.tw/taiwanvn/TVN-201904003"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://surl.twcert.org.tw/mChNi"
}
],
"source": {
"discovery": "USER"
},
"title": "Multi modules of MailSherlock MSR35 and MSR45 lead to a CSRF vulnerability. It allows attacker to elevate privilege of specific account.",
"x_generator": {
"engine": "Vulnogram 0.0.6"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@cert.org.tw",
"ID": "CVE-2019-9883",
"STATE": "PUBLIC",
"TITLE": "Multi modules of MailSherlock MSR35 and MSR45 lead to a CSRF vulnerability. It allows attacker to elevate privilege of specific account."
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "MailSherlock MSR35",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "iSherlock-base",
"version_value": "1.5-328"
},
{
"version_affected": "\u003c",
"version_name": "iSherlock-useradmin",
"version_value": "1.5-239"
},
{
"version_affected": "\u003c",
"version_name": "iSherlock-sysinfo",
"version_value": "1.5-196"
},
{
"version_affected": "\u003c",
"version_name": "iSherlock-user",
"version_value": "1.5-127"
}
]
}
},
{
"product_name": "MailSherlock MSR45",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "iSherlock-base",
"version_value": "4.5-206"
},
{
"version_affected": "\u003c",
"version_name": "iSherlock-useradmin",
"version_value": "4.5-106"
},
{
"version_affected": "\u003c",
"version_name": "iSherlock-sysinfo",
"version_value": "4.5-109"
},
{
"version_affected": "\u003c",
"version_name": "iSherlock-user",
"version_value": "4.5-81"
}
]
}
}
]
},
"vendor_name": "OAKlouds"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "AurOraD@d"
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Multi modules of MailSherlock MSR35 and MSR45 lead to a CSRF vulnerability. It allows attacker to elevate privilege of specific account via useradmin/cf_new.cgi?chief=\u0026wk_group=full\u0026cf_name=test\u0026cf_account=test\u0026cf_email=\u0026cf_acl=Management\u0026apply_lang=\u0026dn= without any authorizes."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.6"
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-352 Cross-Site Request Forgery (CSRF)"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://tvn.twcert.org.tw/taiwanvn/TVN-201904003",
"refsource": "MISC",
"url": "https://tvn.twcert.org.tw/taiwanvn/TVN-201904003"
},
{
"name": "http://surl.twcert.org.tw/mChNi",
"refsource": "MISC",
"url": "http://surl.twcert.org.tw/mChNi"
}
]
},
"source": {
"discovery": "USER"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"assignerShortName": "twcert",
"cveId": "CVE-2019-9883",
"datePublished": "2019-06-03T18:03:21.000Z",
"dateReserved": "2019-03-19T00:00:00.000Z",
"dateUpdated": "2024-08-04T22:01:54.986Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2019-9882 (GCVE-0-2019-9882)
Vulnerability from cvelistv5 – Published: 2019-06-03 18:03 – Updated: 2024-08-04 22:01
VLAI
EPSS
VEX
Title
Multi modules of MailSherlock MSR35 and MSR45 lead to a CSRF vulnerability. It allows attacker to add malicious email sources into whitelist.
Summary
Multi modules of MailSherlock MSR35 and MSR45 lead to a CSRF vulnerability. It allows attacker to add malicious email sources into whitelist via user/save_list.php?ACSION=&type=email&category=white&locate=big5&cmd=add&new=hacker@socialengineering.com&new_memo=&add=%E6%96%B0%E5%A2%9E without any authorizes.
Severity
No CVSS data available.
CWE
- CWE-352 - Cross-Site Request Forgery (CSRF)
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://tvn.twcert.org.tw/taiwanvn/TVN-201904002 | x_refsource_MISC |
| http://surl.twcert.org.tw/MtWeJ | x_refsource_MISC |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| OAKlouds | MailSherlock MSR35 |
Affected:
iSherlock-base , < 1.5-328
(custom)
Affected: iSherlock-useradmin , < 1.5-239 (custom) Affected: iSherlock-sysinfo , < 1.5-196 (custom) Affected: iSherlock-user , < 1.5-127 (custom) |
|
| OAKlouds | MailSherlock MSR45 |
Affected:
iSherlock-base , < 4.5-206
(custom)
Affected: iSherlock-useradmin , < 4.5-106 (custom) Affected: iSherlock-sysinfo , < 4.5-109 (custom) Affected: iSherlock-user , < 4.5-81 (custom) |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T22:01:54.950Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://tvn.twcert.org.tw/taiwanvn/TVN-201904002"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://surl.twcert.org.tw/MtWeJ"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "MailSherlock MSR35",
"vendor": "OAKlouds",
"versions": [
{
"lessThan": "1.5-328",
"status": "affected",
"version": "iSherlock-base",
"versionType": "custom"
},
{
"lessThan": "1.5-239",
"status": "affected",
"version": "iSherlock-useradmin",
"versionType": "custom"
},
{
"lessThan": "1.5-196",
"status": "affected",
"version": "iSherlock-sysinfo",
"versionType": "custom"
},
{
"lessThan": "1.5-127",
"status": "affected",
"version": "iSherlock-user",
"versionType": "custom"
}
]
},
{
"product": "MailSherlock MSR45",
"vendor": "OAKlouds",
"versions": [
{
"lessThan": "4.5-206",
"status": "affected",
"version": "iSherlock-base",
"versionType": "custom"
},
{
"lessThan": "4.5-106",
"status": "affected",
"version": "iSherlock-useradmin",
"versionType": "custom"
},
{
"lessThan": "4.5-109",
"status": "affected",
"version": "iSherlock-sysinfo",
"versionType": "custom"
},
{
"lessThan": "4.5-81",
"status": "affected",
"version": "iSherlock-user",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "AurOraD@d"
}
],
"descriptions": [
{
"lang": "en",
"value": "Multi modules of MailSherlock MSR35 and MSR45 lead to a CSRF vulnerability. It allows attacker to add malicious email sources into whitelist via user/save_list.php?ACSION=\u0026type=email\u0026category=white\u0026locate=big5\u0026cmd=add\u0026new=hacker@socialengineering.com\u0026new_memo=\u0026add=%E6%96%B0%E5%A2%9E without any authorizes."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-352",
"description": "CWE-352 Cross-Site Request Forgery (CSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-06-03T18:03:21.000Z",
"orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"shortName": "twcert"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://tvn.twcert.org.tw/taiwanvn/TVN-201904002"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://surl.twcert.org.tw/MtWeJ"
}
],
"source": {
"discovery": "USER"
},
"title": "Multi modules of MailSherlock MSR35 and MSR45 lead to a CSRF vulnerability. It allows attacker to add malicious email sources into whitelist.",
"x_generator": {
"engine": "Vulnogram 0.0.6"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@cert.org.tw",
"ID": "CVE-2019-9882",
"STATE": "PUBLIC",
"TITLE": "Multi modules of MailSherlock MSR35 and MSR45 lead to a CSRF vulnerability. It allows attacker to add malicious email sources into whitelist."
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "MailSherlock MSR35",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "iSherlock-base",
"version_value": "1.5-328"
},
{
"version_affected": "\u003c",
"version_name": "iSherlock-useradmin",
"version_value": "1.5-239"
},
{
"version_affected": "\u003c",
"version_name": "iSherlock-sysinfo",
"version_value": "1.5-196"
},
{
"version_affected": "\u003c",
"version_name": "iSherlock-user",
"version_value": "1.5-127"
}
]
}
},
{
"product_name": "MailSherlock MSR45",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "iSherlock-base",
"version_value": "4.5-206"
},
{
"version_affected": "\u003c",
"version_name": "iSherlock-useradmin",
"version_value": "4.5-106"
},
{
"version_affected": "\u003c",
"version_name": "iSherlock-sysinfo",
"version_value": "4.5-109"
},
{
"version_affected": "\u003c",
"version_name": "iSherlock-user",
"version_value": "4.5-81"
}
]
}
}
]
},
"vendor_name": "OAKlouds"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "AurOraD@d"
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Multi modules of MailSherlock MSR35 and MSR45 lead to a CSRF vulnerability. It allows attacker to add malicious email sources into whitelist via user/save_list.php?ACSION=\u0026type=email\u0026category=white\u0026locate=big5\u0026cmd=add\u0026new=hacker@socialengineering.com\u0026new_memo=\u0026add=%E6%96%B0%E5%A2%9E without any authorizes."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.6"
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-352 Cross-Site Request Forgery (CSRF)"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://tvn.twcert.org.tw/taiwanvn/TVN-201904002",
"refsource": "MISC",
"url": "https://tvn.twcert.org.tw/taiwanvn/TVN-201904002"
},
{
"name": "http://surl.twcert.org.tw/MtWeJ",
"refsource": "MISC",
"url": "http://surl.twcert.org.tw/MtWeJ"
}
]
},
"source": {
"discovery": "USER"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"assignerShortName": "twcert",
"cveId": "CVE-2019-9882",
"datePublished": "2019-06-03T18:03:21.000Z",
"dateReserved": "2019-03-19T00:00:00.000Z",
"dateUpdated": "2024-08-04T22:01:54.950Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2018-17542 (GCVE-0-2018-17542)
Vulnerability from cvelistv5 – Published: 2019-02-11 20:00 – Updated: 2024-09-16 18:54
VLAI
EPSS
VEX
Title
SQL Injection exists in MailSherlock before 1.5.235 for OAKlouds
Summary
SQL Injection exists in MailSherlock before 1.5.235 for OAKlouds allows an unauthenticated user to extract the subjects of the emails of other users within the enterprise via the select_mid parameter in an letgo.cgi request.
Severity
4.3 (Medium)
CWE
- SQL Injection
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://twcert.org.tw/subpages/ServeThePublic/pub… | x_refsource_CONFIRM |
| https://twcert.org.tw/subpages/ServeThePublic/pub… | x_refsource_CONFIRM |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| OAKlouds | MailSherlock |
Affected:
unspecified , < 1.5.235
(custom)
|
Date Public
2018-11-23 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T10:54:09.287Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://twcert.org.tw/subpages/ServeThePublic/public_document_details.aspx?id=73"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://twcert.org.tw/subpages/ServeThePublic/public_document_details.aspx?lang=en-US\u0026id=28"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "MailSherlock",
"vendor": "OAKlouds",
"versions": [
{
"lessThan": "1.5.235",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Researcher from a Technology enterprise"
}
],
"datePublic": "2018-11-23T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "SQL Injection exists in MailSherlock before 1.5.235 for OAKlouds allows an unauthenticated user to extract the subjects of the emails of other users within the enterprise via the select_mid parameter in an letgo.cgi request."
}
],
"metrics": [
{
"cvssV3_0": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "SQL Injection",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-02-11T19:57:01.000Z",
"orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"shortName": "twcert"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://twcert.org.tw/subpages/ServeThePublic/public_document_details.aspx?id=73"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://twcert.org.tw/subpages/ServeThePublic/public_document_details.aspx?lang=en-US\u0026id=28"
}
],
"solutions": [
{
"lang": "en",
"value": "Update the software to the latest version."
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "SQL Injection exists in MailSherlock before 1.5.235 for OAKlouds",
"x_legacyV4Record": {
"CVE_data_meta": {
"AKA": "",
"ASSIGNER": "cve@cert.org.tw",
"DATE_PUBLIC": "2018-11-23T16:00:00.000Z",
"ID": "CVE-2018-17542",
"STATE": "PUBLIC",
"TITLE": "SQL Injection exists in MailSherlock before 1.5.235 for OAKlouds"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "MailSherlock",
"version": {
"version_data": [
{
"affected": "\u003c",
"platform": "",
"version_affected": "\u003c",
"version_name": "",
"version_value": "1.5.235"
}
]
}
}
]
},
"vendor_name": "OAKlouds"
}
]
}
},
"configuration": [],
"credit": [
{
"lang": "eng",
"value": "Researcher from a Technology enterprise"
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "SQL Injection exists in MailSherlock before 1.5.235 for OAKlouds allows an unauthenticated user to extract the subjects of the emails of other users within the enterprise via the select_mid parameter in an letgo.cgi request."
}
]
},
"exploit": [],
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
"version": "3.0"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "SQL Injection"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://twcert.org.tw/subpages/ServeThePublic/public_document_details.aspx?id=73",
"refsource": "CONFIRM",
"url": "https://twcert.org.tw/subpages/ServeThePublic/public_document_details.aspx?id=73"
},
{
"name": "https://twcert.org.tw/subpages/ServeThePublic/public_document_details.aspx?lang=en-US\u0026id=28",
"refsource": "CONFIRM",
"url": "https://twcert.org.tw/subpages/ServeThePublic/public_document_details.aspx?lang=en-US\u0026id=28"
}
]
},
"solution": [
{
"lang": "en",
"value": "Update the software to the latest version."
}
],
"source": {
"advisory": "",
"defect": [],
"discovery": "UNKNOWN"
},
"work_around": []
}
}
},
"cveMetadata": {
"assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"assignerShortName": "twcert",
"cveId": "CVE-2018-17542",
"datePublished": "2019-02-11T20:00:00.000Z",
"dateReserved": "2018-09-26T00:00:00.000Z",
"dateUpdated": "2024-09-16T18:54:20.899Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-22852 (GCVE-0-2021-22852)
Vulnerability from nvd – Published: 2021-01-19 10:05 – Updated: 2024-09-16 16:33
VLAI
EPSS
VEX
Title
HGiga OAKloud Portal - SQL injection -2
Summary
HGiga EIP product contains SQL Injection vulnerability. Attackers can inject SQL commands into specific URL parameter (online registration) to obtain database schema and data.
Severity
8.8 (High)
CWE
- CWE-89 - SQL Injection
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://www.chtsecurity.com/news/eb024200-7cf9-4c… | x_refsource_MISC |
| https://www.twcert.org.tw/tw/cp-132-4328-97765-1.html | x_refsource_MISC |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| HGiga | OAKSv20 OAKlouds-mol_course_v3 2.0 |
Affected:
2.0-124 , ≤ 2.0-146
(custom)
|
|
| HGiga | OAKSv30 OAKlouds-mol_course_v3 3.0 |
Affected:
3.0-124 , ≤ 3.0-146
(custom)
|
Date Public
2021-01-19 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T18:51:07.484Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.chtsecurity.com/news/eb024200-7cf9-4c58-a063-c451dbc9daef"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.twcert.org.tw/tw/cp-132-4328-97765-1.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "OAKSv20 OAKlouds-mol_course_v3 2.0",
"vendor": "HGiga",
"versions": [
{
"lessThanOrEqual": "2.0-146",
"status": "affected",
"version": "2.0-124",
"versionType": "custom"
}
]
},
{
"product": "OAKSv30 OAKlouds-mol_course_v3 3.0",
"vendor": "HGiga",
"versions": [
{
"lessThanOrEqual": "3.0-146",
"status": "affected",
"version": "3.0-124",
"versionType": "custom"
}
]
}
],
"datePublic": "2021-01-19T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "HGiga EIP product contains SQL Injection vulnerability. Attackers can inject SQL commands into specific URL parameter (online registration) to obtain database schema and data."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89 SQL Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-01-19T10:05:36.000Z",
"orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"shortName": "twcert"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.chtsecurity.com/news/eb024200-7cf9-4c58-a063-c451dbc9daef"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.twcert.org.tw/tw/cp-132-4328-97765-1.html"
}
],
"solutions": [
{
"lang": "en",
"value": "OAKSv30 OAKlouds-mol_course_v3 3.0 \u003e= 3.0-147\nOAKSv20 OAKlouds-mol_course_v3 2.0 \u003e= 2.0-147"
}
],
"source": {
"advisory": "TVN-202101006",
"discovery": "EXTERNAL"
},
"title": "HGiga OAKloud Portal - SQL injection -2",
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"AKA": "TWCERT/CC",
"ASSIGNER": "cve@cert.org.tw",
"DATE_PUBLIC": "2021-01-19T08:53:00.000Z",
"ID": "CVE-2021-22852",
"STATE": "PUBLIC",
"TITLE": "HGiga OAKloud Portal - SQL injection -2"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "OAKSv20 OAKlouds-mol_course_v3 2.0",
"version": {
"version_data": [
{
"version_affected": "\u003c=",
"version_name": "2.0-124",
"version_value": "2.0-146"
}
]
}
},
{
"product_name": "OAKSv30 OAKlouds-mol_course_v3 3.0",
"version": {
"version_data": [
{
"version_affected": "\u003c=",
"version_name": "3.0-124",
"version_value": "3.0-146"
}
]
}
}
]
},
"vendor_name": "HGiga"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "HGiga EIP product contains SQL Injection vulnerability. Attackers can inject SQL commands into specific URL parameter (online registration) to obtain database schema and data."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-89 SQL Injection"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.chtsecurity.com/news/eb024200-7cf9-4c58-a063-c451dbc9daef",
"refsource": "MISC",
"url": "https://www.chtsecurity.com/news/eb024200-7cf9-4c58-a063-c451dbc9daef"
},
{
"name": "https://www.twcert.org.tw/tw/cp-132-4328-97765-1.html",
"refsource": "MISC",
"url": "https://www.twcert.org.tw/tw/cp-132-4328-97765-1.html"
}
]
},
"solution": [
{
"lang": "en",
"value": "OAKSv30 OAKlouds-mol_course_v3 3.0 \u003e= 3.0-147\nOAKSv20 OAKlouds-mol_course_v3 2.0 \u003e= 2.0-147"
}
],
"source": {
"advisory": "TVN-202101006",
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"assignerShortName": "twcert",
"cveId": "CVE-2021-22852",
"datePublished": "2021-01-19T10:05:36.386Z",
"dateReserved": "2021-01-06T00:00:00.000Z",
"dateUpdated": "2024-09-16T16:33:42.943Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-22851 (GCVE-0-2021-22851)
Vulnerability from nvd – Published: 2021-01-19 10:05 – Updated: 2024-09-16 17:43
VLAI
EPSS
VEX
Title
HGiga OAKloud Portal - SQL injection -1
Summary
HGiga EIP product contains SQL Injection vulnerability. Attackers can inject SQL commands into specific URL parameter (document management page) to obtain database schema and data.
Severity
9.8 (Critical)
CWE
- CWE-89 - SQL Injection
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://www.chtsecurity.com/news/eb024200-7cf9-4c… | x_refsource_MISC |
| https://www.twcert.org.tw/tw/cp-132-4327-50e99-1.html | x_refsource_MISC |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| HGiga | OAKSv20 OAKlouds-document_v3 2.0 |
Affected:
unspecified , < 2.0-54
(custom)
|
|
| HGiga | OAKSv30 OAKlouds-document_v3 3.0 |
Affected:
unspecified , < 3.0-54
(custom)
|
Date Public
2021-01-19 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T18:51:07.514Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.chtsecurity.com/news/eb024200-7cf9-4c58-a063-c451dbc9daef"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.twcert.org.tw/tw/cp-132-4327-50e99-1.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "OAKSv20 OAKlouds-document_v3 2.0",
"vendor": "HGiga",
"versions": [
{
"lessThan": "2.0-54",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "OAKSv30 OAKlouds-document_v3 3.0",
"vendor": "HGiga",
"versions": [
{
"lessThan": "3.0-54",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
}
],
"datePublic": "2021-01-19T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "HGiga EIP product contains SQL Injection vulnerability. Attackers can inject SQL commands into specific URL parameter (document management page) to obtain database schema and data."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89 SQL Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-01-19T10:05:35.000Z",
"orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"shortName": "twcert"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.chtsecurity.com/news/eb024200-7cf9-4c58-a063-c451dbc9daef"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.twcert.org.tw/tw/cp-132-4327-50e99-1.html"
}
],
"solutions": [
{
"lang": "en",
"value": "OAKSv20 OAKlouds-document_v3 2.0 \u003e= 2.0-54\nOAKSv30 OAKlouds-document_v3 3.0 \u003e= 3.0-54"
}
],
"source": {
"advisory": "TVN-202101005",
"discovery": "EXTERNAL"
},
"title": "HGiga OAKloud Portal - SQL injection -1",
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"AKA": "TWCERT/CC",
"ASSIGNER": "cve@cert.org.tw",
"DATE_PUBLIC": "2021-01-19T08:53:00.000Z",
"ID": "CVE-2021-22851",
"STATE": "PUBLIC",
"TITLE": "HGiga OAKloud Portal - SQL injection -1"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "OAKSv20 OAKlouds-document_v3 2.0",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_value": "2.0-54"
}
]
}
},
{
"product_name": "OAKSv30 OAKlouds-document_v3 3.0",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_value": "3.0-54"
}
]
}
}
]
},
"vendor_name": "HGiga"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "HGiga EIP product contains SQL Injection vulnerability. Attackers can inject SQL commands into specific URL parameter (document management page) to obtain database schema and data."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-89 SQL Injection"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.chtsecurity.com/news/eb024200-7cf9-4c58-a063-c451dbc9daef",
"refsource": "MISC",
"url": "https://www.chtsecurity.com/news/eb024200-7cf9-4c58-a063-c451dbc9daef"
},
{
"name": "https://www.twcert.org.tw/tw/cp-132-4327-50e99-1.html",
"refsource": "MISC",
"url": "https://www.twcert.org.tw/tw/cp-132-4327-50e99-1.html"
}
]
},
"solution": [
{
"lang": "en",
"value": "OAKSv20 OAKlouds-document_v3 2.0 \u003e= 2.0-54\nOAKSv30 OAKlouds-document_v3 3.0 \u003e= 3.0-54"
}
],
"source": {
"advisory": "TVN-202101005",
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"assignerShortName": "twcert",
"cveId": "CVE-2021-22851",
"datePublished": "2021-01-19T10:05:35.751Z",
"dateReserved": "2021-01-06T00:00:00.000Z",
"dateUpdated": "2024-09-16T17:43:24.218Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-22850 (GCVE-0-2021-22850)
Vulnerability from nvd – Published: 2021-01-19 10:05 – Updated: 2024-09-17 01:16
VLAI
EPSS
VEX
Title
HGiga OAKloud Portal - Security Misconfiguration
Summary
HGiga EIP product lacks ineffective access control in certain pages that allow attackers to access database or perform privileged functions.
Severity
5.3 (Medium)
CWE
- CWE-732 - Incorrect Permission Assignment for Critical Resource
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://www.twcert.org.tw/tw/cp-132-4326-3d9d2-1.html | x_refsource_MISC |
| https://www.chtsecurity.com/news/eb024200-7cf9-4c… | x_refsource_MISC |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| HGiga | OAKSv20 OAKlouds-document_v3 |
Affected:
2.0
|
|
| HGiga | OAKSv30 OAKlouds-document_v3 |
Affected:
3.0
|
Date Public
2021-01-19 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T18:51:07.467Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.twcert.org.tw/tw/cp-132-4326-3d9d2-1.html"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.chtsecurity.com/news/eb024200-7cf9-4c58-a063-c451dbc9daef"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "OAKSv20 OAKlouds-document_v3",
"vendor": "HGiga",
"versions": [
{
"status": "affected",
"version": "2.0"
}
]
},
{
"product": "OAKSv30 OAKlouds-document_v3",
"vendor": "HGiga",
"versions": [
{
"status": "affected",
"version": "3.0"
}
]
}
],
"datePublic": "2021-01-19T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "HGiga EIP product lacks ineffective access control in certain pages that allow attackers to access database or perform privileged functions."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-732",
"description": "CWE-732 Incorrect Permission Assignment for Critical Resource",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-01-19T10:05:34.000Z",
"orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"shortName": "twcert"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.twcert.org.tw/tw/cp-132-4326-3d9d2-1.html"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.chtsecurity.com/news/eb024200-7cf9-4c58-a063-c451dbc9daef"
}
],
"solutions": [
{
"lang": "en",
"value": "Contact HGiga Inc. for corresponding measures."
}
],
"source": {
"advisory": "TVN-202101004",
"discovery": "EXTERNAL"
},
"title": "HGiga OAKloud Portal - Security Misconfiguration",
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"AKA": "TWCERT/CC",
"ASSIGNER": "cve@cert.org.tw",
"DATE_PUBLIC": "2021-01-19T08:53:00.000Z",
"ID": "CVE-2021-22850",
"STATE": "PUBLIC",
"TITLE": "HGiga OAKloud Portal - Security Misconfiguration"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "OAKSv20 OAKlouds-document_v3",
"version": {
"version_data": [
{
"version_affected": "=",
"version_value": "2.0"
}
]
}
},
{
"product_name": "OAKSv30 OAKlouds-document_v3",
"version": {
"version_data": [
{
"version_affected": "=",
"version_value": "3.0"
}
]
}
}
]
},
"vendor_name": "HGiga"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "HGiga EIP product lacks ineffective access control in certain pages that allow attackers to access database or perform privileged functions."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-732 Incorrect Permission Assignment for Critical Resource"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.twcert.org.tw/tw/cp-132-4326-3d9d2-1.html",
"refsource": "MISC",
"url": "https://www.twcert.org.tw/tw/cp-132-4326-3d9d2-1.html"
},
{
"name": "https://www.chtsecurity.com/news/eb024200-7cf9-4c58-a063-c451dbc9daef",
"refsource": "MISC",
"url": "https://www.chtsecurity.com/news/eb024200-7cf9-4c58-a063-c451dbc9daef"
}
]
},
"solution": [
{
"lang": "en",
"value": "Contact HGiga Inc. for corresponding measures."
}
],
"source": {
"advisory": "TVN-202101004",
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"assignerShortName": "twcert",
"cveId": "CVE-2021-22850",
"datePublished": "2021-01-19T10:05:35.059Z",
"dateReserved": "2021-01-06T00:00:00.000Z",
"dateUpdated": "2024-09-17T01:16:31.598Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2020-35851 (GCVE-0-2020-35851)
Vulnerability from nvd – Published: 2020-12-31 07:45 – Updated: 2024-09-17 04:25
VLAI
EPSS
VEX
Title
HGiga MailSherlock - Command Injection
Summary
HGiga MailSherlock does not validate specific parameters properly. Attackers can use the vulnerability to launch Command inject attacks remotely and execute arbitrary commands of the system.
Severity
8.1 (High)
CWE
- CWE-78 - OS Command Injection
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.twcert.org.tw/en/cp-139-4264-f10f4-2.html | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| HGiga | MailSherlock MSR45/SSR45 |
Affected:
unspecified , < 115
(custom)
|
Date Public
2020-12-31 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T17:16:13.138Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.twcert.org.tw/en/cp-139-4264-f10f4-2.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"platforms": [
"iSherlock-user-4.5"
],
"product": "MailSherlock MSR45/SSR45",
"vendor": "HGiga",
"versions": [
{
"lessThan": "115",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Robin Tung, Dio Lin of CHT Security Co., Ltd."
}
],
"datePublic": "2020-12-31T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "HGiga MailSherlock does not validate specific parameters properly. Attackers can use the vulnerability to launch Command inject attacks remotely and execute arbitrary commands of the system."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78 OS Command Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-12-31T07:45:52.000Z",
"orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"shortName": "twcert"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.twcert.org.tw/en/cp-139-4264-f10f4-2.html"
}
],
"solutions": [
{
"lang": "en",
"value": "Update MailSherlock MSR45/SSR45 Module to iSherlock-user-4.5-115.i386.rpm"
}
],
"source": {
"advisory": "TVN-202011002",
"discovery": "EXTERNAL"
},
"title": "HGiga MailSherlock - Command Injection",
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"AKA": "TWCERT/CC",
"ASSIGNER": "cve@cert.org.tw",
"DATE_PUBLIC": "2020-12-31T05:00:00.000Z",
"ID": "CVE-2020-35851",
"STATE": "PUBLIC",
"TITLE": "HGiga MailSherlock - Command Injection"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "MailSherlock MSR45/SSR45",
"version": {
"version_data": [
{
"platform": "iSherlock-user-4.5",
"version_affected": "\u003c",
"version_value": "115"
}
]
}
}
]
},
"vendor_name": "HGiga"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "Robin Tung, Dio Lin of CHT Security Co., Ltd."
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "HGiga MailSherlock does not validate specific parameters properly. Attackers can use the vulnerability to launch Command inject attacks remotely and execute arbitrary commands of the system."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-78 OS Command Injection"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.twcert.org.tw/en/cp-139-4264-f10f4-2.html",
"refsource": "MISC",
"url": "https://www.twcert.org.tw/en/cp-139-4264-f10f4-2.html"
}
]
},
"solution": [
{
"lang": "en",
"value": "Update MailSherlock MSR45/SSR45 Module to iSherlock-user-4.5-115.i386.rpm"
}
],
"source": {
"advisory": "TVN-202011002",
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"assignerShortName": "twcert",
"cveId": "CVE-2020-35851",
"datePublished": "2020-12-31T07:45:52.468Z",
"dateReserved": "2020-12-30T00:00:00.000Z",
"dateUpdated": "2024-09-17T04:25:22.980Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2020-35742 (GCVE-0-2020-35742)
Vulnerability from nvd – Published: 2020-12-31 07:45 – Updated: 2024-09-16 18:03
VLAI
EPSS
VEX
Title
HGiga MailSherlock - SQL Injection -1
Summary
HGiga MailSherlock contains a vulnerability of SQL Injection. Attackers can inject and launch SQL commands in a URL parameter.
Severity
CWE
- CWE-89 - SQL Injection
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.twcert.org.tw/tw/cp-132-4261-d5379-1.html | x_refsource_MISC |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| HGiga | MailSherlock MSR45/SSR45 |
Affected:
unspecified , < 120
(custom)
|
|
| HGiga | MailSherlock MSR45/SSR45 |
Affected:
unspecified , < 133
(custom)
|
Date Public
2020-12-31 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T17:09:15.146Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.twcert.org.tw/tw/cp-132-4261-d5379-1.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"platforms": [
"iSherlock-user-4.5"
],
"product": "MailSherlock MSR45/SSR45",
"vendor": "HGiga",
"versions": [
{
"lessThan": "120",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"platforms": [
"iSherlock-antispam-4.5"
],
"product": "MailSherlock MSR45/SSR45",
"vendor": "HGiga",
"versions": [
{
"lessThan": "133",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Robin Tung, Dio Lin of CHT Security Co., Ltd."
}
],
"datePublic": "2020-12-31T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "HGiga MailSherlock contains a vulnerability of SQL Injection. Attackers can inject and launch SQL commands in a URL parameter."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89 SQL Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-12-31T07:45:51.000Z",
"orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"shortName": "twcert"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.twcert.org.tw/tw/cp-132-4261-d5379-1.html"
}
],
"solutions": [
{
"lang": "en",
"value": "Update MailSherlock MSR45/SSR45 Module to:\niSherlock-user-4.5-120.i386.rpm\niSherlock-antispam-4.5-133.i386.rpm"
}
],
"source": {
"advisory": "TVN-202011006",
"discovery": "EXTERNAL"
},
"title": "HGiga MailSherlock - SQL Injection -1",
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"AKA": "TWCERT/CC",
"ASSIGNER": "cve@cert.org.tw",
"DATE_PUBLIC": "2020-12-31T05:00:00.000Z",
"ID": "CVE-2020-35742",
"STATE": "PUBLIC",
"TITLE": "HGiga MailSherlock - SQL Injection -1"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "MailSherlock MSR45/SSR45",
"version": {
"version_data": [
{
"platform": "iSherlock-user-4.5",
"version_affected": "\u003c",
"version_value": "120"
},
{
"platform": "iSherlock-antispam-4.5",
"version_affected": "\u003c",
"version_value": "133"
}
]
}
}
]
},
"vendor_name": "HGiga"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "Robin Tung, Dio Lin of CHT Security Co., Ltd."
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "HGiga MailSherlock contains a vulnerability of SQL Injection. Attackers can inject and launch SQL commands in a URL parameter."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-89 SQL Injection"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.twcert.org.tw/tw/cp-132-4261-d5379-1.html",
"refsource": "MISC",
"url": "https://www.twcert.org.tw/tw/cp-132-4261-d5379-1.html"
}
]
},
"solution": [
{
"lang": "en",
"value": "Update MailSherlock MSR45/SSR45 Module to:\niSherlock-user-4.5-120.i386.rpm\niSherlock-antispam-4.5-133.i386.rpm"
}
],
"source": {
"advisory": "TVN-202011006",
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"assignerShortName": "twcert",
"cveId": "CVE-2020-35742",
"datePublished": "2020-12-31T07:45:51.201Z",
"dateReserved": "2020-12-28T00:00:00.000Z",
"dateUpdated": "2024-09-16T18:03:00.267Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2020-35743 (GCVE-0-2020-35743)
Vulnerability from nvd – Published: 2020-12-31 07:45 – Updated: 2024-09-17 02:37
VLAI
EPSS
VEX
Title
HGiga MailSherlock - SQL Injection -3
Summary
HGiga MailSherlock contains a SQL injection flaw. Attackers can inject and launch SQL commands in a URL parameter of specific cgi pages.
Severity
CWE
- CWE-89 - SQL Injection
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.twcert.org.tw/tw/cp-132-4262-03785-1.html | x_refsource_MISC |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| HGiga | MailSherlock MSR45/SSR45 |
Affected:
unspecified , < 120
(custom)
|
|
| HGiga | MailSherlock MSR45/SSR45 |
Affected:
unspecified , < 133
(custom)
|
Date Public
2020-12-31 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T17:09:15.204Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.twcert.org.tw/tw/cp-132-4262-03785-1.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"platforms": [
"iSherlock-user-4.5"
],
"product": "MailSherlock MSR45/SSR45",
"vendor": "HGiga",
"versions": [
{
"lessThan": "120",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"platforms": [
"iSherlock-antispam-4.5"
],
"product": "MailSherlock MSR45/SSR45",
"vendor": "HGiga",
"versions": [
{
"lessThan": "133",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Robin Tung, Dio Lin of CHT Security Co., Ltd."
}
],
"datePublic": "2020-12-31T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "HGiga MailSherlock contains a SQL injection flaw. Attackers can inject and launch SQL commands in a URL parameter of specific cgi pages."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89 SQL Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-12-31T07:45:51.000Z",
"orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"shortName": "twcert"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.twcert.org.tw/tw/cp-132-4262-03785-1.html"
}
],
"solutions": [
{
"lang": "en",
"value": "Update MailSherlock MSR45/SSR45 Module to:\niSherlock-user-4.5-120.i386.rpm\niSherlock-antispam-4.5-133.i386.rpm"
}
],
"source": {
"advisory": "TVN-202011008",
"discovery": "EXTERNAL"
},
"title": "HGiga MailSherlock - SQL Injection -3",
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"AKA": "TWCERT/CC",
"ASSIGNER": "cve@cert.org.tw",
"DATE_PUBLIC": "2020-12-31T05:00:00.000Z",
"ID": "CVE-2020-35743",
"STATE": "PUBLIC",
"TITLE": "HGiga MailSherlock - SQL Injection -3"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "MailSherlock MSR45/SSR45",
"version": {
"version_data": [
{
"platform": "iSherlock-user-4.5",
"version_affected": "\u003c",
"version_value": "120"
},
{
"platform": "iSherlock-antispam-4.5",
"version_affected": "\u003c",
"version_value": "133"
}
]
}
}
]
},
"vendor_name": "HGiga"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "Robin Tung, Dio Lin of CHT Security Co., Ltd."
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "HGiga MailSherlock contains a SQL injection flaw. Attackers can inject and launch SQL commands in a URL parameter of specific cgi pages."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-89 SQL Injection"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.twcert.org.tw/tw/cp-132-4262-03785-1.html",
"refsource": "MISC",
"url": "https://www.twcert.org.tw/tw/cp-132-4262-03785-1.html"
}
]
},
"solution": [
{
"lang": "en",
"value": "Update MailSherlock MSR45/SSR45 Module to:\niSherlock-user-4.5-120.i386.rpm\niSherlock-antispam-4.5-133.i386.rpm"
}
],
"source": {
"advisory": "TVN-202011008",
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"assignerShortName": "twcert",
"cveId": "CVE-2020-35743",
"datePublished": "2020-12-31T07:45:51.808Z",
"dateReserved": "2020-12-28T00:00:00.000Z",
"dateUpdated": "2024-09-17T02:37:09.672Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2020-35741 (GCVE-0-2020-35741)
Vulnerability from nvd – Published: 2020-12-31 07:45 – Updated: 2024-09-16 22:55
VLAI
EPSS
VEX
Title
HGiga MailSherlock - XSS -2
Summary
HGiga MailSherlock does not validate user parameters on multiple login pages. Attackers can use the vulnerability to inject JavaScript syntax for XSS attacks.
Severity
CWE
- CWE-79 - Cross-site Scripting (XSS)
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.twcert.org.tw/tw/cp-132-4260-ba376-1.html | x_refsource_MISC |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| HGiga | MailSherlock MSR45/SSR45 |
Affected:
unspecified , < 120
(custom)
|
|
| HGiga | MailSherlock MSR45/SSR45 |
Affected:
unspecified , < 133
(custom)
|
Date Public
2020-12-31 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T17:09:15.252Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.twcert.org.tw/tw/cp-132-4260-ba376-1.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"platforms": [
"iSherlock-user-4.5"
],
"product": "MailSherlock MSR45/SSR45",
"vendor": "HGiga",
"versions": [
{
"lessThan": "120",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"platforms": [
"iSherlock-antispam-4.5"
],
"product": "MailSherlock MSR45/SSR45",
"vendor": "HGiga",
"versions": [
{
"lessThan": "133",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Robin Tung, Dio Lin of CHT Security Co., Ltd."
}
],
"datePublic": "2020-12-31T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "HGiga MailSherlock does not validate user parameters on multiple login pages. Attackers can use the vulnerability to inject JavaScript syntax for XSS attacks."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Cross-site Scripting (XSS)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-12-31T07:45:50.000Z",
"orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"shortName": "twcert"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.twcert.org.tw/tw/cp-132-4260-ba376-1.html"
}
],
"solutions": [
{
"lang": "en",
"value": "Update MailSherlock MSR45/SSR45 Module to:\niSherlock-user-4.5-120.i386.rpm\niSherlock-antispam-4.5-133.i386.rpm"
}
],
"source": {
"advisory": "TVN-202011005",
"discovery": "EXTERNAL"
},
"title": "HGiga MailSherlock - XSS -2",
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"AKA": "TWCERT/CC",
"ASSIGNER": "cve@cert.org.tw",
"DATE_PUBLIC": "2020-12-31T05:00:00.000Z",
"ID": "CVE-2020-35741",
"STATE": "PUBLIC",
"TITLE": "HGiga MailSherlock - XSS -2"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "MailSherlock MSR45/SSR45",
"version": {
"version_data": [
{
"platform": "iSherlock-user-4.5",
"version_affected": "\u003c",
"version_value": "120"
},
{
"platform": "iSherlock-antispam-4.5",
"version_affected": "\u003c",
"version_value": "133"
}
]
}
}
]
},
"vendor_name": "HGiga"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "Robin Tung, Dio Lin of CHT Security Co., Ltd."
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "HGiga MailSherlock does not validate user parameters on multiple login pages. Attackers can use the vulnerability to inject JavaScript syntax for XSS attacks."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-79 Cross-site Scripting (XSS)"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.twcert.org.tw/tw/cp-132-4260-ba376-1.html",
"refsource": "MISC",
"url": "https://www.twcert.org.tw/tw/cp-132-4260-ba376-1.html"
}
]
},
"solution": [
{
"lang": "en",
"value": "Update MailSherlock MSR45/SSR45 Module to:\niSherlock-user-4.5-120.i386.rpm\niSherlock-antispam-4.5-133.i386.rpm"
}
],
"source": {
"advisory": "TVN-202011005",
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"assignerShortName": "twcert",
"cveId": "CVE-2020-35741",
"datePublished": "2020-12-31T07:45:50.593Z",
"dateReserved": "2020-12-28T00:00:00.000Z",
"dateUpdated": "2024-09-16T22:55:57.902Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2020-25850 (GCVE-0-2020-25850)
Vulnerability from nvd – Published: 2020-12-31 07:45 – Updated: 2024-09-16 20:36
VLAI
EPSS
VEX
Title
HGiga MailSherlock - Arbitrary File Download
Summary
The function, view the source code, of HGiga MailSherlock does not validate specific characters. Remote attackers can use this flaw to download arbitrary system files.
Severity
8.1 (High)
CWE
- Arbitrary File Download
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.twcert.org.tw/tw/cp-132-4258-0a8a0-1.html | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| HGiga | MailSherlock MSR45/SSR45 |
Affected:
unspecified , < 117
(custom)
|
Date Public
2020-12-31 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T15:49:05.969Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.twcert.org.tw/tw/cp-132-4258-0a8a0-1.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"platforms": [
"iSherlock-user-4.5"
],
"product": "MailSherlock MSR45/SSR45",
"vendor": "HGiga",
"versions": [
{
"lessThan": "117",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Robin Tung, Dio Lin of CHT Security Co., Ltd."
}
],
"datePublic": "2020-12-31T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "The function, view the source code, of HGiga MailSherlock does not validate specific characters. Remote attackers can use this flaw to download arbitrary system files."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Arbitrary File Download",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-12-31T07:45:49.000Z",
"orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"shortName": "twcert"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.twcert.org.tw/tw/cp-132-4258-0a8a0-1.html"
}
],
"solutions": [
{
"lang": "en",
"value": "Update MailSherlock MSR45/SSR45 Module to iSherlock-user-4.5-117.i386.rpm"
}
],
"source": {
"advisory": "TVN-202011003",
"discovery": "EXTERNAL"
},
"title": "HGiga MailSherlock - Arbitrary File Download",
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"AKA": "TWCERT/CC",
"ASSIGNER": "cve@cert.org.tw",
"DATE_PUBLIC": "2020-12-31T05:00:00.000Z",
"ID": "CVE-2020-25850",
"STATE": "PUBLIC",
"TITLE": "HGiga MailSherlock - Arbitrary File Download"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "MailSherlock MSR45/SSR45",
"version": {
"version_data": [
{
"platform": "iSherlock-user-4.5",
"version_affected": "\u003c",
"version_value": "117"
}
]
}
}
]
},
"vendor_name": "HGiga"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "Robin Tung, Dio Lin of CHT Security Co., Ltd."
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The function, view the source code, of HGiga MailSherlock does not validate specific characters. Remote attackers can use this flaw to download arbitrary system files."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Arbitrary File Download"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.twcert.org.tw/tw/cp-132-4258-0a8a0-1.html",
"refsource": "MISC",
"url": "https://www.twcert.org.tw/tw/cp-132-4258-0a8a0-1.html"
}
]
},
"solution": [
{
"lang": "en",
"value": "Update MailSherlock MSR45/SSR45 Module to iSherlock-user-4.5-117.i386.rpm"
}
],
"source": {
"advisory": "TVN-202011003",
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"assignerShortName": "twcert",
"cveId": "CVE-2020-25850",
"datePublished": "2020-12-31T07:45:49.379Z",
"dateReserved": "2020-09-23T00:00:00.000Z",
"dateUpdated": "2024-09-16T20:36:52.413Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2020-35740 (GCVE-0-2020-35740)
Vulnerability from nvd – Published: 2020-12-31 07:45 – Updated: 2024-09-16 23:36
VLAI
EPSS
VEX
Title
HGiga MailSherlock - XSS -1
Summary
HGiga MailSherlock does not validate specific URL parameters properly that allows attackers to inject JavaScript syntax for XSS attacks.
Severity
CWE
- CWE-79 - Cross-site Scripting (XSS)
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.twcert.org.tw/tw/cp-132-4259-90f23-1.html | x_refsource_MISC |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| HGiga | MailSherlock MSR45/SSR45 |
Affected:
unspecified , < 120
(custom)
|
|
| HGiga | MailSherlock MSR45/SSR45 |
Affected:
unspecified , < 133
(custom)
|
Date Public
2020-12-31 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T17:09:15.246Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.twcert.org.tw/tw/cp-132-4259-90f23-1.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"platforms": [
"iSherlock-user-4.5"
],
"product": "MailSherlock MSR45/SSR45",
"vendor": "HGiga",
"versions": [
{
"lessThan": "120",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"platforms": [
"iSherlock-antispam-4.5"
],
"product": "MailSherlock MSR45/SSR45",
"vendor": "HGiga",
"versions": [
{
"lessThan": "133",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Robin Tung, Dio Lin of CHT Security Co., Ltd."
}
],
"datePublic": "2020-12-31T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "HGiga MailSherlock does not validate specific URL parameters properly that allows attackers to inject JavaScript syntax for XSS attacks."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Cross-site Scripting (XSS)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-12-31T07:45:49.000Z",
"orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"shortName": "twcert"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.twcert.org.tw/tw/cp-132-4259-90f23-1.html"
}
],
"solutions": [
{
"lang": "en",
"value": "Update MailSherlock MSR45/SSR45 Module to:\niSherlock-user-4.5-120.i386.rpm\niSherlock-antispam-4.5-133.i386.rpm"
}
],
"source": {
"advisory": "TVN-202011004",
"discovery": "EXTERNAL"
},
"title": "HGiga MailSherlock - XSS -1",
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"AKA": "TWCERT/CC",
"ASSIGNER": "cve@cert.org.tw",
"DATE_PUBLIC": "2020-12-31T05:00:00.000Z",
"ID": "CVE-2020-35740",
"STATE": "PUBLIC",
"TITLE": "HGiga MailSherlock - XSS -1"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "MailSherlock MSR45/SSR45",
"version": {
"version_data": [
{
"platform": "iSherlock-user-4.5",
"version_affected": "\u003c",
"version_value": "120"
},
{
"platform": "iSherlock-antispam-4.5",
"version_affected": "\u003c",
"version_value": "133"
}
]
}
}
]
},
"vendor_name": "HGiga"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "Robin Tung, Dio Lin of CHT Security Co., Ltd."
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "HGiga MailSherlock does not validate specific URL parameters properly that allows attackers to inject JavaScript syntax for XSS attacks."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-79 Cross-site Scripting (XSS)"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.twcert.org.tw/tw/cp-132-4259-90f23-1.html",
"refsource": "MISC",
"url": "https://www.twcert.org.tw/tw/cp-132-4259-90f23-1.html"
}
]
},
"solution": [
{
"lang": "en",
"value": "Update MailSherlock MSR45/SSR45 Module to:\niSherlock-user-4.5-120.i386.rpm\niSherlock-antispam-4.5-133.i386.rpm"
}
],
"source": {
"advisory": "TVN-202011004",
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"assignerShortName": "twcert",
"cveId": "CVE-2020-35740",
"datePublished": "2020-12-31T07:45:49.988Z",
"dateReserved": "2020-12-28T00:00:00.000Z",
"dateUpdated": "2024-09-16T23:36:40.227Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2020-25848 (GCVE-0-2020-25848)
Vulnerability from nvd – Published: 2020-12-31 07:45 – Updated: 2024-09-17 00:11
VLAI
EPSS
VEX
Title
HGiga MailSherlock - Broken Authentication
Summary
HGiga MailSherlock contains weak authentication flaw that attackers grant privilege remotely with default password generation mechanism.
Severity
9.8 (Critical)
CWE
- Broken Authentication
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.twcert.org.tw/tw/cp-132-4256-cfc5a-1.html | x_refsource_MISC |
Impacted products
5 products
| Vendor | Product | Version | |
|---|---|---|---|
| HGiga | MailSherlock MSR45/SSR45 |
Affected:
unspecified , < 243
(custom)
|
|
| HGiga | MailSherlock MSR45/SSR45 |
Affected:
unspecified , < 114
(custom)
|
|
| HGiga | MailSherlock MSR45/SSR45 |
Affected:
unspecified , < 122
(custom)
|
|
| HGiga | MailSherlock MSR45/SSR45 |
Affected:
unspecified , < 143
(custom)
|
|
| HGiga | MailSherlock MSR45/SSR45 |
Affected:
unspecified , < 130
(custom)
|
Date Public
2020-12-31 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T15:49:05.445Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.twcert.org.tw/tw/cp-132-4256-cfc5a-1.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"platforms": [
"iSherlock-base-4.5"
],
"product": "MailSherlock MSR45/SSR45",
"vendor": "HGiga",
"versions": [
{
"lessThan": "243",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"platforms": [
"iSherlock-user-4.5"
],
"product": "MailSherlock MSR45/SSR45",
"vendor": "HGiga",
"versions": [
{
"lessThan": "114",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"platforms": [
"iSherlock-useradmin-4.5"
],
"product": "MailSherlock MSR45/SSR45",
"vendor": "HGiga",
"versions": [
{
"lessThan": "122",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"platforms": [
"iSherlock-audit-4.5"
],
"product": "MailSherlock MSR45/SSR45",
"vendor": "HGiga",
"versions": [
{
"lessThan": "143",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"platforms": [
"iSherlock-antispam-4.5"
],
"product": "MailSherlock MSR45/SSR45",
"vendor": "HGiga",
"versions": [
{
"lessThan": "130",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Robin Tung, Dio Lin of CHT Security Co., Ltd."
}
],
"datePublic": "2020-12-31T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "HGiga MailSherlock contains weak authentication flaw that attackers grant privilege remotely with default password generation mechanism."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Broken Authentication",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-12-31T07:45:48.000Z",
"orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"shortName": "twcert"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.twcert.org.tw/tw/cp-132-4256-cfc5a-1.html"
}
],
"solutions": [
{
"lang": "en",
"value": "Update MailSherlock MSR45/SSR45 Module to:\niSherlock-base-4.5-243.i386.rpm\t\niSherlock-user-4.5-114.i386.rpm\niSherlock-useradmin-4.5-122.i386.rpm\niSherlock-audit-4.5-143.i386.rpm\niSherlock-antispam-4.5-130.i386.rpm"
}
],
"source": {
"advisory": "TVN-202011001",
"discovery": "EXTERNAL"
},
"title": "HGiga MailSherlock - Broken Authentication",
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"AKA": "TWCERT/CC",
"ASSIGNER": "cve@cert.org.tw",
"DATE_PUBLIC": "2020-12-31T05:00:00.000Z",
"ID": "CVE-2020-25848",
"STATE": "PUBLIC",
"TITLE": "HGiga MailSherlock - Broken Authentication"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "MailSherlock MSR45/SSR45",
"version": {
"version_data": [
{
"platform": "iSherlock-base-4.5",
"version_affected": "\u003c",
"version_value": "243"
},
{
"platform": "iSherlock-user-4.5",
"version_affected": "\u003c",
"version_value": "114"
},
{
"platform": "iSherlock-useradmin-4.5",
"version_affected": "\u003c",
"version_value": "122"
},
{
"platform": "iSherlock-audit-4.5",
"version_affected": "\u003c",
"version_value": "143"
},
{
"platform": "iSherlock-antispam-4.5",
"version_affected": "\u003c",
"version_value": "130"
}
]
}
}
]
},
"vendor_name": "HGiga"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "Robin Tung, Dio Lin of CHT Security Co., Ltd."
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "HGiga MailSherlock contains weak authentication flaw that attackers grant privilege remotely with default password generation mechanism."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Broken Authentication"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.twcert.org.tw/tw/cp-132-4256-cfc5a-1.html",
"refsource": "MISC",
"url": "https://www.twcert.org.tw/tw/cp-132-4256-cfc5a-1.html"
}
]
},
"solution": [
{
"lang": "en",
"value": "Update MailSherlock MSR45/SSR45 Module to:\niSherlock-base-4.5-243.i386.rpm\t\niSherlock-user-4.5-114.i386.rpm\niSherlock-useradmin-4.5-122.i386.rpm\niSherlock-audit-4.5-143.i386.rpm\niSherlock-antispam-4.5-130.i386.rpm"
}
],
"source": {
"advisory": "TVN-202011001",
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"assignerShortName": "twcert",
"cveId": "CVE-2020-25848",
"datePublished": "2020-12-31T07:45:48.728Z",
"dateReserved": "2020-09-23T00:00:00.000Z",
"dateUpdated": "2024-09-17T00:11:14.724Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2020-10512 (GCVE-0-2020-10512)
Vulnerability from nvd – Published: 2020-04-15 06:20 – Updated: 2024-09-16 20:07
VLAI
EPSS
VEX
Title
HGiga C&Cmail - SQL Injection
Summary
HGiga C&Cmail CCMAILQ before olln-calendar-6.0-100.i386.rpm and CCMAILN before olln-calendar-5.0-100.i386.rpm contains a SQL Injection vulnerability which allows attackers to injecting SQL commands in the URL parameter to execute unauthorized commands.
Severity
8.8 (High)
CWE
- CWE-89 - SQL Injection
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://www.twcert.org.tw/tw/cp-132-3536-79545-1.html | x_refsource_MISC |
| https://gist.github.com/tonykuo76/d52014bbe81995e… | x_refsource_CONFIRM |
| https://www.chtsecurity.com/news/545daf88-adb4-44… | x_refsource_CONFIRM |
Impacted products
Date Public
2020-04-15 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T11:06:09.506Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.twcert.org.tw/tw/cp-132-3536-79545-1.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://gist.github.com/tonykuo76/d52014bbe81995eda499201446aec57a"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.chtsecurity.com/news/545daf88-adb4-4417-9870-426490c1429e"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "C\u0026Cmail",
"vendor": "HGiga",
"versions": [
{
"status": "affected",
"version": "CCMAILQ before olln-calendar-6.0-100.i386.rpm"
},
{
"status": "affected",
"version": "CCMAILN before olln-calendar-5.0-100.i386.rpm"
}
]
}
],
"datePublic": "2020-04-15T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "HGiga C\u0026Cmail CCMAILQ before olln-calendar-6.0-100.i386.rpm and CCMAILN before olln-calendar-5.0-100.i386.rpm contains a SQL Injection vulnerability which allows attackers to injecting SQL commands in the URL parameter to execute unauthorized commands."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89 SQL Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-04-30T17:14:37.000Z",
"orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"shortName": "twcert"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.twcert.org.tw/tw/cp-132-3536-79545-1.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://gist.github.com/tonykuo76/d52014bbe81995eda499201446aec57a"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.chtsecurity.com/news/545daf88-adb4-4417-9870-426490c1429e"
}
],
"solutions": [
{
"lang": "en",
"value": "Contact HGiga Inc. for updated version."
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "HGiga C\u0026Cmail - SQL Injection",
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"AKA": "TWCERT/CC",
"ASSIGNER": "cve@cert.org.tw",
"DATE_PUBLIC": "2020-04-15T05:30:00.000Z",
"ID": "CVE-2020-10512",
"STATE": "PUBLIC",
"TITLE": "HGiga C\u0026Cmail - SQL Injection"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "C\u0026Cmail",
"version": {
"version_data": [
{
"version_value": "CCMAILQ before olln-calendar-6.0-100.i386.rpm"
},
{
"version_value": "CCMAILN before olln-calendar-5.0-100.i386.rpm"
}
]
}
}
]
},
"vendor_name": "HGiga"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "HGiga C\u0026Cmail CCMAILQ before olln-calendar-6.0-100.i386.rpm and CCMAILN before olln-calendar-5.0-100.i386.rpm contains a SQL Injection vulnerability which allows attackers to injecting SQL commands in the URL parameter to execute unauthorized commands."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-89 SQL Injection"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.twcert.org.tw/tw/cp-132-3536-79545-1.html",
"refsource": "MISC",
"url": "https://www.twcert.org.tw/tw/cp-132-3536-79545-1.html"
},
{
"name": "https://gist.github.com/tonykuo76/d52014bbe81995eda499201446aec57a",
"refsource": "CONFIRM",
"url": "https://gist.github.com/tonykuo76/d52014bbe81995eda499201446aec57a"
},
{
"name": "https://www.chtsecurity.com/news/545daf88-adb4-4417-9870-426490c1429e",
"refsource": "CONFIRM",
"url": "https://www.chtsecurity.com/news/545daf88-adb4-4417-9870-426490c1429e"
}
]
},
"solution": [
{
"lang": "en",
"value": "Contact HGiga Inc. for updated version."
}
],
"source": {
"discovery": "UNKNOWN"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"assignerShortName": "twcert",
"cveId": "CVE-2020-10512",
"datePublished": "2020-04-15T06:20:23.231Z",
"dateReserved": "2020-03-12T00:00:00.000Z",
"dateUpdated": "2024-09-16T20:07:25.313Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2020-10511 (GCVE-0-2020-10511)
Vulnerability from nvd – Published: 2020-04-15 06:20 – Updated: 2024-09-16 23:06
VLAI
EPSS
VEX
Title
HGiga C&Cmail - Broken Access Control
Summary
HGiga C&Cmail CCMAILQ before olln-base-6.0-418.i386.rpm and CCMAILN before olln-base-5.0-418.i386.rpm contains insecure configurations. Attackers can exploit these flaws to access unauthorized functionality via a crafted URL.
Severity
9.8 (Critical)
CWE
- Broken Access Control
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://www.twcert.org.tw/tw/cp-132-3535-e40ec-1.html | x_refsource_MISC |
| https://gist.github.com/tonykuo76/7d41c414f23ef1e… | x_refsource_CONFIRM |
| https://www.chtsecurity.com/news/19400b04-ea92-4e… | x_refsource_CONFIRM |
Impacted products
Date Public
2020-04-15 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T11:06:09.538Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.twcert.org.tw/tw/cp-132-3535-e40ec-1.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://gist.github.com/tonykuo76/7d41c414f23ef1e47c97f7b97e1b33b0"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.chtsecurity.com/news/19400b04-ea92-4eaa-afa7-2449fd9b2e0b"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "C\u0026Cmail",
"vendor": "HGiga",
"versions": [
{
"status": "affected",
"version": "CCMAILQ before olln-base-6.0-418.i386.rpm"
},
{
"status": "affected",
"version": "CCMAILN before olln-base-5.0-418.i386.rpm"
}
]
}
],
"datePublic": "2020-04-15T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "HGiga C\u0026Cmail CCMAILQ before olln-base-6.0-418.i386.rpm and CCMAILN before olln-base-5.0-418.i386.rpm contains insecure configurations. Attackers can exploit these flaws to access unauthorized functionality via a crafted URL."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Broken Access Control",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-04-30T17:17:11.000Z",
"orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"shortName": "twcert"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.twcert.org.tw/tw/cp-132-3535-e40ec-1.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://gist.github.com/tonykuo76/7d41c414f23ef1e47c97f7b97e1b33b0"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.chtsecurity.com/news/19400b04-ea92-4eaa-afa7-2449fd9b2e0b"
}
],
"solutions": [
{
"lang": "en",
"value": "Contact HGiga Inc. for updated version."
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "HGiga C\u0026Cmail - Broken Access Control",
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"AKA": "TWCERT/CC",
"ASSIGNER": "cve@cert.org.tw",
"DATE_PUBLIC": "2020-04-15T05:30:00.000Z",
"ID": "CVE-2020-10511",
"STATE": "PUBLIC",
"TITLE": "HGiga C\u0026Cmail - Broken Access Control"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "C\u0026Cmail",
"version": {
"version_data": [
{
"version_value": "CCMAILQ before olln-base-6.0-418.i386.rpm"
},
{
"version_value": "CCMAILN before olln-base-5.0-418.i386.rpm"
}
]
}
}
]
},
"vendor_name": "HGiga"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "HGiga C\u0026Cmail CCMAILQ before olln-base-6.0-418.i386.rpm and CCMAILN before olln-base-5.0-418.i386.rpm contains insecure configurations. Attackers can exploit these flaws to access unauthorized functionality via a crafted URL."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Broken Access Control"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.twcert.org.tw/tw/cp-132-3535-e40ec-1.html",
"refsource": "MISC",
"url": "https://www.twcert.org.tw/tw/cp-132-3535-e40ec-1.html"
},
{
"name": "https://gist.github.com/tonykuo76/7d41c414f23ef1e47c97f7b97e1b33b0",
"refsource": "CONFIRM",
"url": "https://gist.github.com/tonykuo76/7d41c414f23ef1e47c97f7b97e1b33b0"
},
{
"name": "https://www.chtsecurity.com/news/19400b04-ea92-4eaa-afa7-2449fd9b2e0b",
"refsource": "CONFIRM",
"url": "https://www.chtsecurity.com/news/19400b04-ea92-4eaa-afa7-2449fd9b2e0b"
}
]
},
"solution": [
{
"lang": "en",
"value": "Contact HGiga Inc. for updated version."
}
],
"source": {
"discovery": "UNKNOWN"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"assignerShortName": "twcert",
"cveId": "CVE-2020-10511",
"datePublished": "2020-04-15T06:20:22.802Z",
"dateReserved": "2020-03-12T00:00:00.000Z",
"dateUpdated": "2024-09-16T23:06:55.203Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2019-9883 (GCVE-0-2019-9883)
Vulnerability from nvd – Published: 2019-06-03 18:03 – Updated: 2024-08-04 22:01
VLAI
EPSS
VEX
Title
Multi modules of MailSherlock MSR35 and MSR45 lead to a CSRF vulnerability. It allows attacker to elevate privilege of specific account.
Summary
Multi modules of MailSherlock MSR35 and MSR45 lead to a CSRF vulnerability. It allows attacker to elevate privilege of specific account via useradmin/cf_new.cgi?chief=&wk_group=full&cf_name=test&cf_account=test&cf_email=&cf_acl=Management&apply_lang=&dn= without any authorizes.
Severity
No CVSS data available.
CWE
- CWE-352 - Cross-Site Request Forgery (CSRF)
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://tvn.twcert.org.tw/taiwanvn/TVN-201904003 | x_refsource_MISC |
| http://surl.twcert.org.tw/mChNi | x_refsource_MISC |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| OAKlouds | MailSherlock MSR35 |
Affected:
iSherlock-base , < 1.5-328
(custom)
Affected: iSherlock-useradmin , < 1.5-239 (custom) Affected: iSherlock-sysinfo , < 1.5-196 (custom) Affected: iSherlock-user , < 1.5-127 (custom) |
|
| OAKlouds | MailSherlock MSR45 |
Affected:
iSherlock-base , < 4.5-206
(custom)
Affected: iSherlock-useradmin , < 4.5-106 (custom) Affected: iSherlock-sysinfo , < 4.5-109 (custom) Affected: iSherlock-user , < 4.5-81 (custom) |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T22:01:54.986Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://tvn.twcert.org.tw/taiwanvn/TVN-201904003"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://surl.twcert.org.tw/mChNi"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "MailSherlock MSR35",
"vendor": "OAKlouds",
"versions": [
{
"lessThan": "1.5-328",
"status": "affected",
"version": "iSherlock-base",
"versionType": "custom"
},
{
"lessThan": "1.5-239",
"status": "affected",
"version": "iSherlock-useradmin",
"versionType": "custom"
},
{
"lessThan": "1.5-196",
"status": "affected",
"version": "iSherlock-sysinfo",
"versionType": "custom"
},
{
"lessThan": "1.5-127",
"status": "affected",
"version": "iSherlock-user",
"versionType": "custom"
}
]
},
{
"product": "MailSherlock MSR45",
"vendor": "OAKlouds",
"versions": [
{
"lessThan": "4.5-206",
"status": "affected",
"version": "iSherlock-base",
"versionType": "custom"
},
{
"lessThan": "4.5-106",
"status": "affected",
"version": "iSherlock-useradmin",
"versionType": "custom"
},
{
"lessThan": "4.5-109",
"status": "affected",
"version": "iSherlock-sysinfo",
"versionType": "custom"
},
{
"lessThan": "4.5-81",
"status": "affected",
"version": "iSherlock-user",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "AurOraD@d"
}
],
"descriptions": [
{
"lang": "en",
"value": "Multi modules of MailSherlock MSR35 and MSR45 lead to a CSRF vulnerability. It allows attacker to elevate privilege of specific account via useradmin/cf_new.cgi?chief=\u0026wk_group=full\u0026cf_name=test\u0026cf_account=test\u0026cf_email=\u0026cf_acl=Management\u0026apply_lang=\u0026dn= without any authorizes."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-352",
"description": "CWE-352 Cross-Site Request Forgery (CSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-06-03T18:03:21.000Z",
"orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"shortName": "twcert"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://tvn.twcert.org.tw/taiwanvn/TVN-201904003"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://surl.twcert.org.tw/mChNi"
}
],
"source": {
"discovery": "USER"
},
"title": "Multi modules of MailSherlock MSR35 and MSR45 lead to a CSRF vulnerability. It allows attacker to elevate privilege of specific account.",
"x_generator": {
"engine": "Vulnogram 0.0.6"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@cert.org.tw",
"ID": "CVE-2019-9883",
"STATE": "PUBLIC",
"TITLE": "Multi modules of MailSherlock MSR35 and MSR45 lead to a CSRF vulnerability. It allows attacker to elevate privilege of specific account."
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "MailSherlock MSR35",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "iSherlock-base",
"version_value": "1.5-328"
},
{
"version_affected": "\u003c",
"version_name": "iSherlock-useradmin",
"version_value": "1.5-239"
},
{
"version_affected": "\u003c",
"version_name": "iSherlock-sysinfo",
"version_value": "1.5-196"
},
{
"version_affected": "\u003c",
"version_name": "iSherlock-user",
"version_value": "1.5-127"
}
]
}
},
{
"product_name": "MailSherlock MSR45",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "iSherlock-base",
"version_value": "4.5-206"
},
{
"version_affected": "\u003c",
"version_name": "iSherlock-useradmin",
"version_value": "4.5-106"
},
{
"version_affected": "\u003c",
"version_name": "iSherlock-sysinfo",
"version_value": "4.5-109"
},
{
"version_affected": "\u003c",
"version_name": "iSherlock-user",
"version_value": "4.5-81"
}
]
}
}
]
},
"vendor_name": "OAKlouds"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "AurOraD@d"
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Multi modules of MailSherlock MSR35 and MSR45 lead to a CSRF vulnerability. It allows attacker to elevate privilege of specific account via useradmin/cf_new.cgi?chief=\u0026wk_group=full\u0026cf_name=test\u0026cf_account=test\u0026cf_email=\u0026cf_acl=Management\u0026apply_lang=\u0026dn= without any authorizes."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.6"
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-352 Cross-Site Request Forgery (CSRF)"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://tvn.twcert.org.tw/taiwanvn/TVN-201904003",
"refsource": "MISC",
"url": "https://tvn.twcert.org.tw/taiwanvn/TVN-201904003"
},
{
"name": "http://surl.twcert.org.tw/mChNi",
"refsource": "MISC",
"url": "http://surl.twcert.org.tw/mChNi"
}
]
},
"source": {
"discovery": "USER"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"assignerShortName": "twcert",
"cveId": "CVE-2019-9883",
"datePublished": "2019-06-03T18:03:21.000Z",
"dateReserved": "2019-03-19T00:00:00.000Z",
"dateUpdated": "2024-08-04T22:01:54.986Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2019-9882 (GCVE-0-2019-9882)
Vulnerability from nvd – Published: 2019-06-03 18:03 – Updated: 2024-08-04 22:01
VLAI
EPSS
VEX
Title
Multi modules of MailSherlock MSR35 and MSR45 lead to a CSRF vulnerability. It allows attacker to add malicious email sources into whitelist.
Summary
Multi modules of MailSherlock MSR35 and MSR45 lead to a CSRF vulnerability. It allows attacker to add malicious email sources into whitelist via user/save_list.php?ACSION=&type=email&category=white&locate=big5&cmd=add&new=hacker@socialengineering.com&new_memo=&add=%E6%96%B0%E5%A2%9E without any authorizes.
Severity
No CVSS data available.
CWE
- CWE-352 - Cross-Site Request Forgery (CSRF)
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://tvn.twcert.org.tw/taiwanvn/TVN-201904002 | x_refsource_MISC |
| http://surl.twcert.org.tw/MtWeJ | x_refsource_MISC |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| OAKlouds | MailSherlock MSR35 |
Affected:
iSherlock-base , < 1.5-328
(custom)
Affected: iSherlock-useradmin , < 1.5-239 (custom) Affected: iSherlock-sysinfo , < 1.5-196 (custom) Affected: iSherlock-user , < 1.5-127 (custom) |
|
| OAKlouds | MailSherlock MSR45 |
Affected:
iSherlock-base , < 4.5-206
(custom)
Affected: iSherlock-useradmin , < 4.5-106 (custom) Affected: iSherlock-sysinfo , < 4.5-109 (custom) Affected: iSherlock-user , < 4.5-81 (custom) |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T22:01:54.950Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://tvn.twcert.org.tw/taiwanvn/TVN-201904002"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://surl.twcert.org.tw/MtWeJ"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "MailSherlock MSR35",
"vendor": "OAKlouds",
"versions": [
{
"lessThan": "1.5-328",
"status": "affected",
"version": "iSherlock-base",
"versionType": "custom"
},
{
"lessThan": "1.5-239",
"status": "affected",
"version": "iSherlock-useradmin",
"versionType": "custom"
},
{
"lessThan": "1.5-196",
"status": "affected",
"version": "iSherlock-sysinfo",
"versionType": "custom"
},
{
"lessThan": "1.5-127",
"status": "affected",
"version": "iSherlock-user",
"versionType": "custom"
}
]
},
{
"product": "MailSherlock MSR45",
"vendor": "OAKlouds",
"versions": [
{
"lessThan": "4.5-206",
"status": "affected",
"version": "iSherlock-base",
"versionType": "custom"
},
{
"lessThan": "4.5-106",
"status": "affected",
"version": "iSherlock-useradmin",
"versionType": "custom"
},
{
"lessThan": "4.5-109",
"status": "affected",
"version": "iSherlock-sysinfo",
"versionType": "custom"
},
{
"lessThan": "4.5-81",
"status": "affected",
"version": "iSherlock-user",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "AurOraD@d"
}
],
"descriptions": [
{
"lang": "en",
"value": "Multi modules of MailSherlock MSR35 and MSR45 lead to a CSRF vulnerability. It allows attacker to add malicious email sources into whitelist via user/save_list.php?ACSION=\u0026type=email\u0026category=white\u0026locate=big5\u0026cmd=add\u0026new=hacker@socialengineering.com\u0026new_memo=\u0026add=%E6%96%B0%E5%A2%9E without any authorizes."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-352",
"description": "CWE-352 Cross-Site Request Forgery (CSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-06-03T18:03:21.000Z",
"orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"shortName": "twcert"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://tvn.twcert.org.tw/taiwanvn/TVN-201904002"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://surl.twcert.org.tw/MtWeJ"
}
],
"source": {
"discovery": "USER"
},
"title": "Multi modules of MailSherlock MSR35 and MSR45 lead to a CSRF vulnerability. It allows attacker to add malicious email sources into whitelist.",
"x_generator": {
"engine": "Vulnogram 0.0.6"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@cert.org.tw",
"ID": "CVE-2019-9882",
"STATE": "PUBLIC",
"TITLE": "Multi modules of MailSherlock MSR35 and MSR45 lead to a CSRF vulnerability. It allows attacker to add malicious email sources into whitelist."
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "MailSherlock MSR35",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "iSherlock-base",
"version_value": "1.5-328"
},
{
"version_affected": "\u003c",
"version_name": "iSherlock-useradmin",
"version_value": "1.5-239"
},
{
"version_affected": "\u003c",
"version_name": "iSherlock-sysinfo",
"version_value": "1.5-196"
},
{
"version_affected": "\u003c",
"version_name": "iSherlock-user",
"version_value": "1.5-127"
}
]
}
},
{
"product_name": "MailSherlock MSR45",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "iSherlock-base",
"version_value": "4.5-206"
},
{
"version_affected": "\u003c",
"version_name": "iSherlock-useradmin",
"version_value": "4.5-106"
},
{
"version_affected": "\u003c",
"version_name": "iSherlock-sysinfo",
"version_value": "4.5-109"
},
{
"version_affected": "\u003c",
"version_name": "iSherlock-user",
"version_value": "4.5-81"
}
]
}
}
]
},
"vendor_name": "OAKlouds"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "AurOraD@d"
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Multi modules of MailSherlock MSR35 and MSR45 lead to a CSRF vulnerability. It allows attacker to add malicious email sources into whitelist via user/save_list.php?ACSION=\u0026type=email\u0026category=white\u0026locate=big5\u0026cmd=add\u0026new=hacker@socialengineering.com\u0026new_memo=\u0026add=%E6%96%B0%E5%A2%9E without any authorizes."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.6"
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-352 Cross-Site Request Forgery (CSRF)"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://tvn.twcert.org.tw/taiwanvn/TVN-201904002",
"refsource": "MISC",
"url": "https://tvn.twcert.org.tw/taiwanvn/TVN-201904002"
},
{
"name": "http://surl.twcert.org.tw/MtWeJ",
"refsource": "MISC",
"url": "http://surl.twcert.org.tw/MtWeJ"
}
]
},
"source": {
"discovery": "USER"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"assignerShortName": "twcert",
"cveId": "CVE-2019-9882",
"datePublished": "2019-06-03T18:03:21.000Z",
"dateReserved": "2019-03-19T00:00:00.000Z",
"dateUpdated": "2024-08-04T22:01:54.950Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2018-17542 (GCVE-0-2018-17542)
Vulnerability from nvd – Published: 2019-02-11 20:00 – Updated: 2024-09-16 18:54
VLAI
EPSS
VEX
Title
SQL Injection exists in MailSherlock before 1.5.235 for OAKlouds
Summary
SQL Injection exists in MailSherlock before 1.5.235 for OAKlouds allows an unauthenticated user to extract the subjects of the emails of other users within the enterprise via the select_mid parameter in an letgo.cgi request.
Severity
4.3 (Medium)
CWE
- SQL Injection
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://twcert.org.tw/subpages/ServeThePublic/pub… | x_refsource_CONFIRM |
| https://twcert.org.tw/subpages/ServeThePublic/pub… | x_refsource_CONFIRM |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| OAKlouds | MailSherlock |
Affected:
unspecified , < 1.5.235
(custom)
|
Date Public
2018-11-23 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T10:54:09.287Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://twcert.org.tw/subpages/ServeThePublic/public_document_details.aspx?id=73"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://twcert.org.tw/subpages/ServeThePublic/public_document_details.aspx?lang=en-US\u0026id=28"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "MailSherlock",
"vendor": "OAKlouds",
"versions": [
{
"lessThan": "1.5.235",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Researcher from a Technology enterprise"
}
],
"datePublic": "2018-11-23T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "SQL Injection exists in MailSherlock before 1.5.235 for OAKlouds allows an unauthenticated user to extract the subjects of the emails of other users within the enterprise via the select_mid parameter in an letgo.cgi request."
}
],
"metrics": [
{
"cvssV3_0": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "SQL Injection",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-02-11T19:57:01.000Z",
"orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"shortName": "twcert"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://twcert.org.tw/subpages/ServeThePublic/public_document_details.aspx?id=73"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://twcert.org.tw/subpages/ServeThePublic/public_document_details.aspx?lang=en-US\u0026id=28"
}
],
"solutions": [
{
"lang": "en",
"value": "Update the software to the latest version."
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "SQL Injection exists in MailSherlock before 1.5.235 for OAKlouds",
"x_legacyV4Record": {
"CVE_data_meta": {
"AKA": "",
"ASSIGNER": "cve@cert.org.tw",
"DATE_PUBLIC": "2018-11-23T16:00:00.000Z",
"ID": "CVE-2018-17542",
"STATE": "PUBLIC",
"TITLE": "SQL Injection exists in MailSherlock before 1.5.235 for OAKlouds"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "MailSherlock",
"version": {
"version_data": [
{
"affected": "\u003c",
"platform": "",
"version_affected": "\u003c",
"version_name": "",
"version_value": "1.5.235"
}
]
}
}
]
},
"vendor_name": "OAKlouds"
}
]
}
},
"configuration": [],
"credit": [
{
"lang": "eng",
"value": "Researcher from a Technology enterprise"
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "SQL Injection exists in MailSherlock before 1.5.235 for OAKlouds allows an unauthenticated user to extract the subjects of the emails of other users within the enterprise via the select_mid parameter in an letgo.cgi request."
}
]
},
"exploit": [],
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
"version": "3.0"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "SQL Injection"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://twcert.org.tw/subpages/ServeThePublic/public_document_details.aspx?id=73",
"refsource": "CONFIRM",
"url": "https://twcert.org.tw/subpages/ServeThePublic/public_document_details.aspx?id=73"
},
{
"name": "https://twcert.org.tw/subpages/ServeThePublic/public_document_details.aspx?lang=en-US\u0026id=28",
"refsource": "CONFIRM",
"url": "https://twcert.org.tw/subpages/ServeThePublic/public_document_details.aspx?lang=en-US\u0026id=28"
}
]
},
"solution": [
{
"lang": "en",
"value": "Update the software to the latest version."
}
],
"source": {
"advisory": "",
"defect": [],
"discovery": "UNKNOWN"
},
"work_around": []
}
}
},
"cveMetadata": {
"assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"assignerShortName": "twcert",
"cveId": "CVE-2018-17542",
"datePublished": "2019-02-11T20:00:00.000Z",
"dateReserved": "2018-09-26T00:00:00.000Z",
"dateUpdated": "2024-09-16T18:54:20.899Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}