CVE-2020-3939

SysJust Syuan-Gu-Da-Shih -Cross-Site Scripting(XSS)

SysJust Syuan-Gu-Da-Shih, versions before 20191223, contain vulnerability of Cross-Site Scripting(XSS), personal information may be leaked to attackers via the vulnerability.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Sysjust

Products

Syuan-gu-da-shin

CVE-2020-3938

SysJust Syuan-Gu-Da-Shih -Request-Forgery

SysJust Syuan-Gu-Da-Shih, versions before 20191223, contain vulnerability of Request Forgery, allowing attackers to launch inquiries into network architecture or system files of the server via forged inquests.

CVSS 3.1 · 9.8 Critical EPSS 1.5% KEV · Not listed

Vendors

Sysjust

Products

Syuan-gu-da-shin

CVE-2020-3937

SysJust Syuan-Gu-Da-Shih-SQL injection

SQL Injection in SysJust Syuan-Gu-Da-Shih, versions before 20191223, allowing attackers to perform unwanted SQL queries and access arbitrary file in the database.

CVSS 3.1 · 8.1 High EPSS 1.4% KEV · Not listed

Vendors

Sysjust

Products

Syuan-gu-da-shin

CVE-2020-3936

Unisoon UltraLog Express - SQL Injection

UltraLog Express device management interface does not properly filter user inputted string in some specific parameters, attackers can inject arbitrary SQL command.

CVSS 3.1 · 10 Critical EPSS 1.2% KEV · Not listed

Vendors

Unisoon

Products

Ultralog Express Ultralog Express Firmware

CVE-2020-3935

TAIWAN SECOM CO., LTD. – Sensitivity Information Exposure

TAIWAN SECOM CO., LTD., a Door Access Control and Personnel Attendance Management system, stores users’ information by cleartext in the cookie, which divulges password to attackers.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Secom

Products

Dr.id Access Control Dr.id Attendance System

CVE-2020-3934

TAIWAN SECOM CO., LTD. - Pre-auth SQL Injection

TAIWAN SECOM CO., LTD., a Door Access Control and Personnel Attendance Management system, contains a vulnerability of Pre-auth SQL Injection, allowing attackers to inject a specific SQL command.

CVSS 3.1 · 9.8 Critical EPSS 1.4% KEV · Not listed

Vendors

Secom

Products

Dr.id Access Control Dr.id Attendance System

CVE-2020-3933

TAIWAN SECOM CO., LTD. - User Account Enumeration

TAIWAN SECOM CO., LTD., a Door Access Control and Personnel Attendance Management system, allows attackers to enumerate and exam user account in the system.

CVSS 3.1 · 5.3 Medium EPSS 1.2% KEV · Not listed

Vendors

Secom

Products

Dr.id Access Control Dr.id Attendance System

CVE-2020-3932

Draytek VigorAP910C - Information Leakage

A vulnerable SNMP in Draytek VigorAP910C cannot be disabled, which may cause information leakage.

CVSS 3.1 · 7.5 High EPSS 1.1% KEV · Not listed

Vendors

Draytek

Products

Vigorap 910c Vigorap 910c Firmware

CVE-2020-3931

GeoVision Door Access Control Device - Buffer overflow vulnerability

Buffer overflow exists in Geovision Door Access Control device family, an unauthenticated remote attacker can execute arbitrary command.

CVSS 3.1 · 9.8 Critical EPSS 1.8% KEV · Not listed

Vendors

Geovision

Products

Gv-as1010 Gv-as1010 Firmware Gv-as210 and 9 more

CVE-2020-3930

GeoVision Door Access Control Device - Information disclosure vulnerability

GeoVision Door Access Control device family improperly stores and controls access to system logs, any users can read these logs.

CVSS 3.1 · 4 Medium EPSS < 1% KEV · Not listed

Vendors

Geovision

Products

Gv-gf192x Gv-gf192x Firmware

CVE-2020-3929

GeoVision Door Access Control Device - Shared cryptographic keys

GeoVision Door Access Control device family employs shared cryptographic private keys for SSH and HTTPS. Attackers may conduct MITM attack with the derived keys and plaintext recover of encrypted messages.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Usavisionsys

Products

Geovision Gv-as1010 Geovision Gv-as1010 Firmware Geovision Gv-as210 and 7 more

CVE-2020-3928

GeoVision Door Access Control Device - Hardcoded privileged password

GeoVision Door Access Control device family is hardcoded with a root password, which adopting an identical password in all devices.

CVSS 3.1 · 6.2 Medium EPSS < 1% KEV · Not listed

Vendors

Usavisionsys

Products

Geovision Gv-as1010 Geovision Gv-as1010 Firmware Geovision Gv-as210 and 7 more

CVE-2020-3927

ServiSign Windows Versions- Arbitrary File Deletion

An arbitrary-file-access vulnerability exists in ServiSign security plugin, as long as the attackers learn the specific API function, they may access arbitrary files on target system via crafted API parameter.

CVSS 3.1 · 8.3 High EPSS 1.2% KEV · Not listed

Vendors

Changingtec Microsoft

Products

Servisign Windows

CVE-2020-3926

ServiSign Windows Versions- Arbitrary File Access

An arbitrary-file-access vulnerability exists in ServiSign security plugin, as long as the attackers learn the specific API function, they may access arbitrary files on target system via crafted API parameter.

CVSS 3.1 · 6.1 Medium EPSS 1.5% KEV · Not listed

Vendors

Changingtec Microsoft

Products

Servisign Windows

CVE-2020-3925

ServiSign Windows Versions- Remote Code Execution via LoadLibrary

A Remote Code Execution(RCE) vulnerability exists in some designated applications in ServiSign security plugin, as long as the interface is captured, attackers are able to launch RCE and executes arbitrary command on target system via malicious crafted scripts.

CVSS 3.1 · 8.3 High EPSS 2.8% KEV · Not listed

Vendors

Changingtec Microsoft

Products

Servisign Windows

CVE-2020-3924

TONNET DVR – Firmware Injection

DVR firmware in TAT-76 and TAT-77 series of products, provided by TONNET do not properly verify patch files. Attackers can inject a specific command into a patch file and gain access to the system.

CVSS 3.1 · 6.4 Medium EPSS 1.3% KEV · Not listed

Vendors

Tonnet

Products

Tat-70432n Tat-70432n Firmware Tat-71416g1 and 13 more

CVE-2020-3923

TONNET DVR – Broken Access Control

DVR firmware in TAT-76 and TAT-77 series of products, provided by TONNET, contain misconfigured authentication mechanism. Attackers can crack the default password and gain access to the system.

CVSS 3.1 · 8.1 High EPSS 1.7% KEV · Not listed

Vendors

Tonnet

Products

Tat-70432n Tat-70432n Firmware Tat-71416g1 and 13 more

CVE-2020-3922

ArmorX LisoMail - SQL Injection

LisoMail, by ArmorX, allows SQL Injections, attackers can access the database without authentication via a URL parameter manipulation.

CVSS 3.1 · 9.8 Critical EPSS 1.5% KEV · Not listed

Vendors

Armorx

Products

Lisomail

CVE-2020-3921

Unisoon UltraLog Express - Sensitive Data Exposure

UltraLog Express device management software stores user’s information in cleartext. Any user can obtain accounts information through a specific page.

CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Unisoon

Products

Ultralog Express Ultralog Express Firmware

CVE-2020-3920

Unisoon UltraLog Express - Broken Authentication

UltraLog Express device management interface does not properly perform access authentication in some specific pages/functions. Any user can access the privileged page to manage accounts through specific system directory.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Unisoon

Products

Ultralog Express Ultralog Express Firmware