111 matches found
CVE-2024-35430
In ZKTeco ZKBio CVSecurity v6.1.1R and earlier fixed in 6.1.3R an authenticated user can bypass password checks while exporting data from the application...
CVE-2024-35432
ZKTeco ZKBio CVSecurity 6.1.1 is vulnerable to Cross Site Scripting XSS via an Audio File. An authenticated user can injection malicious JavaScript code to trigger a Cross Site Scripting...
CVE-2024-35432
ZKTeco ZKBio CVSecurity 6.1.1 is vulnerable to Cross Site Scripting XSS via an Audio File. An authenticated user can injection malicious JavaScript code to trigger a Cross Site Scripting...
CVE-2024-35431
CVE-2024-35431 affects ZKTeco ZKBio CVSecurity (versions around 6.1.1, with reports up to 6.4.1) via the photoBase64 parameter. Root cause: directory traversal allows an unauthenticated attacker to download local server files. Impact: confidentiality of server data is HIGH; no integrity/availabil...
CVE-2024-35430
In ZKTeco ZKBio CVSecurity v6.1.1R and earlier fixed in 6.1.3R an authenticated user can bypass password checks while exporting data from the application...
PT-2024-26500 · Zkteco · Zkbio Cvsecurity
Name of the Vulnerable Software and Affected Versions: ZKTeco ZKBio CVSecurity version 6.1.1 Description: The issue allows an authenticated user to bypass password checks while exporting data from the application. Recommendations: For ZKTeco ZKBio CVSecurity version 6.1.1, at the moment, there is...
PT-2024-26497 · Zkteco · Zkbio Cvsecurity
Name of the Vulnerable Software and Affected Versions: ZKTeco ZKBio CVSecurity version 6.1.1 Description: The issue allows an authenticated user to perform a Directory Traversal attack via BaseMediaFile, enabling the deletion of local files from the server. This can lead to a Denial of Service Do...
PT-2024-26501 · Zkteco · Zkbio Cvsecurity
Name of the Vulnerable Software and Affected Versions: ZKTeco ZKBio CVSecurity version 6.1.1 Description: The issue allows an unauthenticated user to perform a Directory Traversal attack via the photoBase64 parameter, enabling them to download local files from the server. Recommendations: For...
PT-2024-26498 · Zkteco · Zkbio Cvsecurity
Name of the Vulnerable Software and Affected Versions: ZKTeco ZKBio CVSecurity version 6.1.1 Description: The issue concerns a Directory Traversal vulnerability via the eventRecord. Recommendations: For ZKTeco ZKBio CVSecurity version 6.1.1, consider restricting access to the eventRecord to...
PT-2024-26503 · Zkteco · Zkbio Cvsecurity
Name of the Vulnerable Software and Affected Versions: ZKTeco ZKBio CVSecurity version 6.1.1 Description: The issue concerns Incorrect Access Control, where an authenticated user without the necessary permissions to manage users can still create a new admin user. Recommendations: For ZKTeco ZKBio...
PT-2024-26502 · Zkteco · Zkbio Cvsecurity
Name of the Vulnerable Software and Affected Versions: ZKTeco ZKBio CVSecurity version 6.1.1 Description: The issue allows an authenticated user to inject malicious JavaScript code via an audio file, triggering a Cross Site Scripting XSS attack. Recommendations: For ZKTeco ZKBio CVSecurity versio...
CVE-2024-2318
A vulnerability was found in ZKTeco ZKBio Media 2.0.0x642024-01-29-1028. It has been classified as problematic. Affected is an unknown function of the file /pro/common/download of the component Service Port 9999. The manipulation of the argument fileName with the input ../../../../zkbiomedia.sql...
CVE-2024-2318
A vulnerability was found in ZKTeco ZKBio Media 2.0.0x642024-01-29-1028. It has been classified as problematic. Affected is an unknown function of the file /pro/common/download of the component Service Port 9999. The manipulation of the argument fileName with the input ../../../../zkbiomedia.sql...
Path traversal
A vulnerability was found in ZKTeco ZKBio Media 2.0.0x642024-01-29-1028. It has been classified as problematic. Affected is an unknown function of the file /pro/common/download of the component Service Port 9999. The manipulation of the argument fileName with the input ../../../../zkbiomedia.sql...
CVE-2024-2318 ZKTeco ZKBio Media Service Port 9999 download path traversal
A vulnerability was found in ZKTeco ZKBio Media 2.0.0x642024-01-29-1028. It has been classified as problematic. Affected is an unknown function of the file /pro/common/download of the component Service Port 9999. The manipulation of the argument fileName with the input ../../../../zkbiomedia.sql...
CVE-2024-2318
CVE-2024-2318 affects ZKTeco ZKBio Media 2.0.0_x64_2024-01-29-1028. Affected is an unknown function in the /pro/common/download path on Service Port 9999. Manipulating the fileName parameter with ../../../../zkbio_media.sql results in a path traversal: '../filedir', enabling remote exploitation. ...
CVE-2024-2318 ZKTeco ZKBio Media Service Port 9999 download path traversal
A vulnerability was found in ZKTeco ZKBio Media 2.0.0x642024-01-29-1028. It has been classified as problematic. Affected is an unknown function of the file /pro/common/download of the component Service Port 9999. The manipulation of the argument fileName with the input ../../../../zkbiomedia.sql...
PT-2024-19697 · Zkteco · Zkbio Media
Name of the Vulnerable Software and Affected Versions: ZKTeco ZKBio Media version 2.0.0 x64 2024-01-29-1028 Description: A problematic issue has been identified, affecting an unknown function of the file /pro/common/download of the component Service Port 9999. The manipulation of the argument...
ZKTeco ZKBio Media Security Breach
ZKTeco ZKBio Media is a digital signage platform that integrates video playback, pictures, audio and other multimedia information from ZKTeco China, providing information distribution solutions based on "visual presentation". A security vulnerability exists in ZKTeco ZKBio Media version...