CVE-2024-35432: Improper Neutralization of Input During Web Page Generation

ZKTeco ZKBio CVSecurity 6.1.1 is vulnerable to Cross Site Scripting XSS via an Audio File. An authenticated user can injection malicious JavaScript code to trigger a Cross Site Scripting...

PT-2024-26500 · Zkteco · Zkbio Cvsecurity

Name of the Vulnerable Software and Affected Versions: ZKTeco ZKBio CVSecurity version 6.1.1 Description: The issue allows an authenticated user to bypass password checks while exporting data from the application. Recommendations: For ZKTeco ZKBio CVSecurity version 6.1.1, at the moment, there is...

CVE-2024-35430: Improper Privilege Management

In ZKTeco ZKBio CVSecurity v6.1.1R and earlier fixed in 6.1.3R an authenticated user can bypass password checks while exporting data from the application...

CVE-2024-35428: Improper Limitation of a Pathname to a Restricted Directory

ZKTeco ZKBio CVSecurity 6.1.1 is vulnerable to Directory Traversal via BaseMediaFile. An authenticated user can delete local files from the server which can lead to DoS...