PT-2024-26498 · Zkteco · Zkbio Cvsecurity

Name of the Vulnerable Software and Affected Versions: ZKTeco ZKBio CVSecurity version 6.1.1 Description: The issue concerns a Directory Traversal vulnerability via the eventRecord. Recommendations: For ZKTeco ZKBio CVSecurity version 6.1.1, consider restricting access to the eventRecord to...

PT-2024-26502 · Zkteco · Zkbio Cvsecurity

Name of the Vulnerable Software and Affected Versions: ZKTeco ZKBio CVSecurity version 6.1.1 Description: The issue allows an authenticated user to inject malicious JavaScript code via an audio file, triggering a Cross Site Scripting XSS attack. Recommendations: For ZKTeco ZKBio CVSecurity versio...

CVE-2024-35432: Improper Neutralization of Input During Web Page Generation

ZKTeco ZKBio CVSecurity 6.1.1 is vulnerable to Cross Site Scripting XSS via an Audio File. An authenticated user can injection malicious JavaScript code to trigger a Cross Site Scripting...

CVE-2024-35430: Improper Privilege Management

In ZKTeco ZKBio CVSecurity v6.1.1R and earlier fixed in 6.1.3R an authenticated user can bypass password checks while exporting data from the application...