71 matches found
PT-2024-26503 · Zkteco · Zkbio Cvsecurity
Name of the Vulnerable Software and Affected Versions: ZKTeco ZKBio CVSecurity version 6.1.1 Description: The issue concerns Incorrect Access Control, where an authenticated user without the necessary permissions to manage users can still create a new admin user. Recommendations: For ZKTeco ZKBio...
PT-2024-26500 · Zkteco · Zkbio Cvsecurity
Name of the Vulnerable Software and Affected Versions: ZKTeco ZKBio CVSecurity version 6.1.1 Description: The issue allows an authenticated user to bypass password checks while exporting data from the application. Recommendations: For ZKTeco ZKBio CVSecurity version 6.1.1, at the moment, there is...
CVE-2024-35428: Improper Limitation of a Pathname to a Restricted Directory
ZKTeco ZKBio CVSecurity 6.1.1 is vulnerable to Directory Traversal via BaseMediaFile. An authenticated user can delete local files from the server which can lead to DoS...
PT-2024-26497 · Zkteco · Zkbio Cvsecurity
Name of the Vulnerable Software and Affected Versions: ZKTeco ZKBio CVSecurity version 6.1.1 Description: The issue allows an authenticated user to perform a Directory Traversal attack via BaseMediaFile, enabling the deletion of local files from the server. This can lead to a Denial of Service Do...
CVE-2024-35431: Path Traversal: 'dir\..\..\filename'
ZKTeco ZKBio CVSecurity 6.1.1 is vulnerable to Directory Traversal via photoBase64. An unauthenticated user can download local files from the server. NOTE: Third parties have indicated other versions are also vulnerable including up to 6.4.1...
CVE-2024-35433: Improper Access Control
ZKTeco ZKBio CVSecurity 6.1.1 is vulnerable to Incorrect Access Control. An authenticated user, without the permissions of managing users, can create a new admin user...
PT-2024-26502 · Zkteco · Zkbio Cvsecurity
Name of the Vulnerable Software and Affected Versions: ZKTeco ZKBio CVSecurity version 6.1.1 Description: The issue allows an authenticated user to inject malicious JavaScript code via an audio file, triggering a Cross Site Scripting XSS attack. Recommendations: For ZKTeco ZKBio CVSecurity versio...
CVE-2024-35432: Improper Neutralization of Input During Web Page Generation
ZKTeco ZKBio CVSecurity 6.1.1 is vulnerable to Cross Site Scripting XSS via an Audio File. An authenticated user can injection malicious JavaScript code to trigger a Cross Site Scripting...
PT-2024-26498 · Zkteco · Zkbio Cvsecurity
Name of the Vulnerable Software and Affected Versions: ZKTeco ZKBio CVSecurity version 6.1.1 Description: The issue concerns a Directory Traversal vulnerability via the eventRecord. Recommendations: For ZKTeco ZKBio CVSecurity version 6.1.1, consider restricting access to the eventRecord to...
CVE-2024-35430: Improper Privilege Management
In ZKTeco ZKBio CVSecurity v6.1.1R and earlier fixed in 6.1.3R an authenticated user can bypass password checks while exporting data from the application...