128 matches found
CVE-2024-35431
ZKTeco ZKBio CVSecurity 6.1.1 is vulnerable to Directory Traversal via photoBase64. An unauthenticated user can download local files from the server. NOTE: Third parties have indicated other versions are also vulnerable including up to 6.4.1...
CVE-2024-35431
ZKTeco ZKBio CVSecurity 6.1.1 is vulnerable to Directory Traversal via photoBase64. An unauthenticated user can download local files from the server. NOTE: Third parties have indicated other versions are also vulnerable including up to 6.4.1...
CVE-2024-35433
ZKTeco ZKBio CVSecurity version 6.1.1 is vulnerable to Incorrect Access Control . This flaw allows an authenticated user who lacks the necessary permissions to manage users to successfully create a new admin user . The vulnerability results from improper authorization checks within the user manag...
CVE-2024-35433
ZKTeco ZKBio CVSecurity 6.1.1 is vulnerable to Incorrect Access Control. An authenticated user, without the permissions of managing users, can create a new admin user...
CVE-2024-35428
ZKTeco ZKBio CVSecurity 6.1.1 is vulnerable to Directory Traversal via BaseMediaFile. An authenticated user can delete local files from the server which can lead to DoS...
CVE-2024-35429
ZKTeco ZKBio CVSecurity 6.1.1 is vulnerable to Directory Traversal via eventRecord...
CVE-2024-35432
ZKTeco ZKBio CVSecurity 6.1.1 is vulnerable to Cross Site Scripting XSS via an Audio File. An authenticated user can injection malicious JavaScript code to trigger a Cross Site Scripting...
CVE-2024-35432
ZKTeco ZKBio CVSecurity 6.1.1 is vulnerable to Cross Site Scripting XSS via an Audio File. An authenticated user can injection malicious JavaScript code to trigger a Cross Site Scripting...
CVE-2024-35430
In ZKTeco ZKBio CVSecurity v6.1.1R and earlier fixed in 6.1.3R an authenticated user can bypass password checks while exporting data from the application...
CVE-2024-35431
ZKTeco ZKBio CVSecurity (specifically version 6.1.1 , with reports including up to 6.4.1 ) is vulnerable to a Directory Traversal flaw via the photoBase64 parameter. This vulnerability allows an unauthenticated user to perform a path traversal attack (e.g., dir .. ..filename) to download local fi...
CVE-2024-35430
In ZKTeco ZKBio CVSecurity v6.1.1R and earlier fixed in 6.1.3R an authenticated user can bypass password checks while exporting data from the application...
PT-2024-26500 · Zkteco · Zkbio Cvsecurity
Name of the Vulnerable Software and Affected Versions: ZKTeco ZKBio CVSecurity version 6.1.1 Description: The issue allows an authenticated user to bypass password checks while exporting data from the application. Recommendations: For ZKTeco ZKBio CVSecurity version 6.1.1, at the moment, there is...
PT-2024-26503 · Zkteco · Zkbio Cvsecurity
Name of the Vulnerable Software and Affected Versions: ZKTeco ZKBio CVSecurity version 6.1.1 Description: The issue concerns Incorrect Access Control, where an authenticated user without the necessary permissions to manage users can still create a new admin user. Recommendations: For ZKTeco ZKBio...
PT-2024-26497 · Zkteco · Zkbio Cvsecurity
Name of the Vulnerable Software and Affected Versions: ZKTeco ZKBio CVSecurity version 6.1.1 Description: The issue allows an authenticated user to perform a Directory Traversal attack via BaseMediaFile, enabling the deletion of local files from the server. This can lead to a Denial of Service Do...
CVE-2024-35431: Path Traversal: 'dir\..\..\filename'
ZKTeco ZKBio CVSecurity 6.1.1 is vulnerable to Directory Traversal via photoBase64. An unauthenticated user can download local files from the server. NOTE: Third parties have indicated other versions are also vulnerable including up to 6.4.1...
PT-2024-26502 · Zkteco · Zkbio Cvsecurity
Name of the Vulnerable Software and Affected Versions: ZKTeco ZKBio CVSecurity version 6.1.1 Description: The issue allows an authenticated user to inject malicious JavaScript code via an audio file, triggering a Cross Site Scripting XSS attack. Recommendations: For ZKTeco ZKBio CVSecurity versio...
CVE-2024-35428: Improper Limitation of a Pathname to a Restricted Directory
ZKTeco ZKBio CVSecurity 6.1.1 is vulnerable to Directory Traversal via BaseMediaFile. An authenticated user can delete local files from the server which can lead to DoS...
CVE-2024-35432: Improper Neutralization of Input During Web Page Generation
ZKTeco ZKBio CVSecurity 6.1.1 is vulnerable to Cross Site Scripting XSS via an Audio File. An authenticated user can injection malicious JavaScript code to trigger a Cross Site Scripting...
CVE-2024-35430: Improper Privilege Management
In ZKTeco ZKBio CVSecurity v6.1.1R and earlier fixed in 6.1.3R an authenticated user can bypass password checks while exporting data from the application...