twcert@cert.org.tw
organization01
roles
Roles this identity holds.
02
references
Other names and identifiers for this entity.
nvdUS twcert@cert.org.tw
03
assessed vulnerabilities (924)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-114223US | medium5.5OT elevated | — | ||
NT OneAPP developed by NewType Infortech has an Exposure of Sensitive Information vulnerability. Unauthenticated local attackers can extract plaintext usernames and passwords from… | ||||
| CVE-2026-114222US | medium6.2 | — | ||
NT OneAPP developed by NewType Infortech has an Authentication Bypass vulnerability. Unauthenticated local attackers can bypass the App PIN lock mechanism via a Deep Link, thereby… | ||||
| CVE-2026-114221US | high7.4 | — | ||
NT OneAPP developed by NewType Infortech has a Credential Disclosure vulnerability. Unauthenticated remote attackers can trigger an HTTP Basic Authentication challenge from an unva… | ||||
| CVE-2026-114220US | critical9.1 | — | ||
NT OneAPP developed by NewType Infortech has an Improper Certificate Validation vulnerability. Unauthenticated network-adjacent attackers can perform a man-in-the-middle attack by… | ||||
| CVE-2026-114219US | high7.4OT elevated | — | ||
NT OneAPP developed by NewType Infortech has a Hard-coded Credentials vulnerability. Unauthenticated remote attackers can obtain the hard-coded cryptographic key and decrypt login… | ||||
| CVE-2026-113407US | high8.8 | — | ||
BA-Workflow developed by YS-infoware has a SQL Injection vulnerability. Authenticated remote attackers can inject arbitrary SQL statements to read, modify, and delete database cont… | ||||
| CVE-2026-113406US | high8.8 | — | ||
BA-Workflow developed by YS-infoware has a SQL Injection vulnerability. Authenticated remote attackers can inject arbitrary SQL statements to read, modify, and delete database cont… | ||||
| CVE-2026-113405US | high8.8 | — | ||
BA-Workflow developed by YS-infoware has a SQL Injection vulnerability. Authenticated remote attackers can inject arbitrary SQL statements to read, modify, and delete database cont… | ||||
| CVE-2026-113404US | high8.8 | — | ||
WebITR developed by Uniong has a Insecure Deserialization vulnerability. Authenticated remote attackers can use the hard-coded cryptographic key to craft and submit malicious seria… | ||||
| CVE-2026-113403US | medium6.5 | — | ||
ArmorX Spam developed by ArmorX Global Technology has a Command Injection vulnerability. Authenticated remote attackers can inject crafted commands into a specific parameter, there… | ||||
| CVE-2026-113402US | medium6.5 | — | ||
ArmorX Spam developed by ArmorX Global Technology has a Local File Inclusion vulnerability. Authenticated remote attackers can exploit path traversal to cause the application to in… | ||||
| CVE-2026-110467US | medium4.3 | — | ||
Tronclass developed by WisdomGarden has a Insecure Direct Object Reference vulnerability. Authenticated remote attackers can modify a specific parameter to view the peer review sco… | ||||
| CVE-2026-110466US | medium4.3 | — | ||
Tronclass developed by WisdomGarden has a Sensitive Data Exposure vulnerability. Authenticated remote attackers can bypass anonymous grading restrictions and obtain anonymous stude… | ||||
| CVE-2026-110465US | medium4.3 | — | ||
Tronclass developed by WisdomGarden has a Insecure Direct Object Reference vulnerability. Authenticated remote attackers can modify a specific parameter to alter the peer review sc… | ||||
| CVE-2026-110445US | high8.8 | — | ||
TeamPlus Messenger developed by Teamplus Technology has a Code Injection vulnerability. Unauthenticated remote attackers can trick users into interacting with crafted content to in… | ||||
| CVE-2026-110444US | high8.8 | — | ||
TeamPlus Messenger developed by Teamplus Technology has a Code Injection vulnerability. Unauthenticated remote attackers can trick users into opening a crafted link to inject and e… | ||||
| CVE-2026-107459US | critical9.8 | — | ||
The SecuShare Pro developed by Openfind has an OS Command Injection vulnerability. Unauthenticated remote attackers can inject arbitrary OS commands and execute them on the server. | ||||
| CVE-2026-102459US | medium6.1 | — | ||
EasyFlow .NET developed by Digiwin has a Reflected Cross-site Scripting vulnerability. Unauthenticated remote attackers can execute arbitrary JavaScript codes in user's browser thr… | ||||
| CVE-2026-102458US | critical9.8OT elevated | — | ||
EasyFlow .NET developed by Digiwin has a Missing Authentication vulnerability. Unauthenticated remote attackers can obtain other users' plaintext passwords through a specific API. | ||||
| CVE-2026-102457US | medium6.5 | — | ||
EasyFlow .NET developed by Digiwin has an Arbitrary File Read vulnerability. Authenticated remote attackers can exploit this vulnerability to download arbitrary system files. | ||||