CVE-2025-56224

CVE-2025-56224（OTP）验证绕过 描述 攻击者可以冒充其他用户的手机号码，并利用此漏洞在不知道 OTP 验证码的情况下验证该号码。 CVSS 评分：8.1（高危） 攻击类型 远程（已认证） 受影响版本 8.6.8 及之前的版本 产品供应商 Ascertia 受影响产品代码库 SigningHub 受影响组件 手机号码验证功能。 缓解措施 如果尝试次数超过一定值，则撤销 OTP 验证码。 漏洞详情 该应用程序未对一次性密码（OTP）验证端点实施适当的速率限制。这允许攻击者在不受限制的情况下自动化并暴力破解 OTP 验证码。通过快速连续发送大量 OTP...

CVE-2025-56219

CVE-2025-56219 レート制限の欠如 – ユーザー追加API 説明 攻撃者は、短期間で大量のユーザーを作成する操作を自動化し、DoS（サービス拒否）を引き起こす可能性があります。 CVSSスコア: 7.1（高） 攻撃タイプ リモート（認証済み） 影響を受けるバージョン 8.6.8以前のバージョン（ 8.6.8） 発見者: Yazan Abu-Nadi...

CVE-2025-56223

CVE-2025-56223 Denial of Service – Upload Document API Description An attacker can rapidly upload a large volume of files to cause denial of service. CVSS Score: 7.1 High Attack Type Remote Authenticated Affected Versions Versions before 8.6.8 Discovered By: Yazan Abu-Nadi...

CVE-2025-56221

CVE-2025-56221 過剰な認証試行の不適切な制限 説明 攻撃者は無制限に認証試行を行うことができ、パスワード推測による対象ユーザーアカウントの侵害リスクが高まります。 CVSSスコア: 7.5（高） 攻撃タイプ リモート（認証済み） 影響を受けるバージョン 8.6.8以前のバージョン（ 8.6.8） 発見者: Yazan Abu-Nadi...

CVE-2025-56218

CVE-2025-56218 無制限ファイルアップロード 説明 攻撃者は、悪意のあるスクリプトやフィッシングURLを含むExcelファイルをアップロードする可能性があります。アプリケーションはファイルをPDFに変換し、デジタル署名のために意図した受信者に転送します。生成されたPDF内のハイパーリンクは攻撃者が制御したテキストで表示され、警告が表示されないため、受信者はリンクをクリックするよう騙され、それによって悪意のあるコマンドの実行を引き起こす可能性があります。 CVSSスコア: 5.5 中 攻撃タイプ リモート 認証済み 影響を受けるバージョン 8.6.8以前のバージョン 8.6.8...

CVE-2025-54321

CVE-2025-54321 비밀번호 재설정 이메일 폭탄 공격 설명 비밀번호 재설정 기능은 대상 이메일 주소에 대한 비율 제한을 구현하지 않습니다. 이로 인해 이메일 폭탄 공격Email Bombing이 가능합니다. CVSS 점수: 7.1 높음 공격 유형 원격 인증됨 영향을 받는 버전 8.6.8 이하 버전 제품 공급업체 Ascertia 영향을 받는 제품 코드 베이스 SigningHub 영향을 받는 구성 요소 비밀번호 재설정 기능. 완화 조치 비밀번호 재설정 API에 비율 제한을 구현합니다. 취약점 세부 정보 비밀번호 재설정 기능에...

CVE-2025-54320

CVE-2025-54320 Invite User 이메일 폭탄 설명 초대 API는 대상 이메일 주소에 대한 속도 제한rate limiting을 구현하지 않습니다. 이로 인해 이메일 폭탄Email Bombing 공격이 가능합니다. CVSS 점수: 7.1 높음 공격 유형 원격 인증됨 영향을 받는 버전 8.6.8 이후 버전 발견자: Yazan Abu-Nadi...

CVE-2025-61166

An open redirect in Ascertia SigningHub User v10.0 allows attackers to redirect users to a malicious site via a crafted URL...

EUVD-2025-209233

An open redirect in Ascertia SigningHub User v10.0 allows attackers to redirect users to a malicious site via a crafted URL...

CVE-2025-61166

An open redirect in Ascertia SigningHub User v10.0 allows attackers to redirect users to a malicious site via a crafted URL...

PT-2026-30683

An open redirect in Ascertia SigningHub User v10.0 allows attackers to redirect users to a malicious site via a crafted URL...

Ascertia SigningHub 安全漏洞

Ascertia SigningHub is an electronic signature software developed by the British company Ascertia. Version 10.0 of Ascertia SigningHub contains a security vulnerability. This vulnerability stems from open redirection, allowing attackers to redirect users to malicious websites through a specially...

CVE-2025-61166

An open redirect in Ascertia SigningHub User v10.0 allows attackers to redirect users to a malicious site via a crafted URL...

CVE-2025-61166

The CVE-2025-61166 entry describes an open redirect in Ascertia SigningHub User v10.0 that lets an attacker redirect authenticated users to a malicious site via a crafted URL. Affected product: Ascertia SigningHub User 10.0 (component: open redirect functionality). Root cause: misimplementation o...

CVE-2025-61166

An open redirect in Ascertia SigningHub User v10.0 allows attackers to redirect users to a malicious site via a crafted URL...

CVE-2025-54321

In Ascertia SigningHub through 8.6.8, there is a lack of rate limiting on the reset password function, leading to an email bombing vulnerability. An authenticated attacker can exploit this by automating reset password requests...

CVE-2025-54320

In Ascertia SigningHub through 8.6.8, there is a lack of rate limiting on the invite user function, leading to an email bombing vulnerability. An authenticated attacker can exploit this by automating invite requests...

EUVD-2025-198073

In Ascertia SigningHub through 8.6.8, there is a lack of rate limiting on the reset password function, leading to an email bombing vulnerability. An authenticated attacker can exploit this by automating reset password requests...

EUVD-2025-198072

In Ascertia SigningHub through 8.6.8, there is a lack of rate limiting on the invite user function, leading to an email bombing vulnerability. An authenticated attacker can exploit this by automating invite requests...

CVE-2025-54321

In Ascertia SigningHub through 8.6.8, there is a lack of rate limiting on the reset password function, leading to an email bombing vulnerability. An authenticated attacker can exploit this by automating reset password requests...