CVE-2020-3921

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

UltraLog Express device management software stores user’s information in cleartext. Any user can obtain accounts information through a specific page.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-312

Affected software

VendorProductVersions
UnisoonUltraLog Express1.4.0
unisoonultralog_express_firmware1.4.0

References

Timeline

Published
Mar 27, 2020
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2020

CVE-2020-39229.8LisoMail, by ArmorX, allows SQL Injections, attackers can access the database without authentication via a URL parameter manipulation.CVE-2020-39239.8DVR firmware in TAT-76 and TAT-77 series of products, provided by TONNET, contain misconfigured authentication mechanism. Attackers can cracCVE-2020-39249.8DVR firmware in TAT-76 and TAT-77 series of products, provided by TONNET do not properly verify patch files. Attackers can inject a specificCVE-2020-39258.8A Remote Code Execution(RCE) vulnerability exists in some designated applications in ServiSign security plugin, as long as the interface is CVE-2020-39267.5An arbitrary-file-access vulnerability exists in ServiSign security plugin, as long as the attackers learn the specific API function, they mCVE-2020-39277.5An arbitrary-file-access vulnerability exists in ServiSign security plugin, as long as the attackers learn the specific API function, they mCVE-2020-39289.8GeoVision Door Access Control device family is hardcoded with a root password, which adopting an identical password in all devices.CVE-2020-39295.9GeoVision Door Access Control device family employs shared cryptographic private keys for SSH and HTTPS. Attackers may conduct MITM attack wCVE-2020-39303.3GeoVision Door Access Control device family improperly stores and controls access to system logs, any users can read these logs.CVE-2020-39319.8Buffer overflow exists in Geovision Door Access Control device family, an unauthenticated remote attacker can execute arbitrary command.CVE-2020-39327.5A vulnerable SNMP in Draytek VigorAP910C cannot be disabled, which may cause information leakage.CVE-2020-39335.3TAIWAN SECOM CO., LTD., a Door Access Control and Personnel Attendance Management system, allows attackers to enumerate and exam user accoun
CVE-2020-3921: High severity, CVSS 7.5 | Vulnix