CVE-2022-36634

An access control issue in ZKTeco ZKBioSecurity V5000 3.0.5r allows attackers to arbitrarily create admin users via a crafted HTTP request...

CVE-2022-36634

An access control issue in ZKTeco ZKBioSecurity V5000 3.0.5r allows attackers to arbitrarily create admin users via a crafted HTTP request...

Cross site request forgery (csrf)

An access control issue in ZKTeco ZKBioSecurity V5000 3.0.5r allows attackers to arbitrarily create admin users via a crafted HTTP request...

CVE-2022-36635

CVE-2022-36635 affects ZKTeco ZKBioSecurity V5000 (version 4.1.3) with a SQL injection in the /baseOpLog.do component. The root cause is a lack of input validation for external SQL statements, enabling attackers to obtain sensitive DB information. The CVSSv3.1 metrics indicate Network access, Low...

CVE-2022-36635

ZKteco ZKBioSecurity V5000 4.1.3 was discovered to contain a SQL injection vulnerability via the component /baseOpLog.do...

PT-2022-23518 · Zkteco · Zkbio Cvsecurity V5000

Name of the Vulnerable Software and Affected Versions: ZKTeco ZKBioSecurity V5000 version 3.0.5 r Description: An access control issue allows attackers to arbitrarily create admin users via a crafted HTTP request. Recommendations: For ZKTeco ZKBioSecurity V5000 version 3.0.5 r, consider restricti...

CVE-2022-36634

CVE-2022-36634 affects ZKTeco ZKBioSecurity V5000, specifically version 3.0.5_r, where an access control flaw allows an attacker to arbitrarily create administrator users via a crafted HTTP request. The vulnerability is described as improper access control in the web-based ZKBioSecurity platform,...

ZKSecurity BIO 4.1.2 SQL Injection / Code Execution Vulnerabilities

ADVISORY INFORMATION Product: ZKSecurity BIO Vendor: ZKTeco https://www.zkteco.com/en/ZKBiosecurity/ZKBioSecurityV50004.1.2 Version Affected: 4.1.2 CVE: CVE-2022-36635 Vulnerability: SQL Injection with a plus: RCE CREDIT This vulnerability was discovered and researched by Caio Burgardt and Silton...

ZKSecurity BIO 3.0.5.0_R Privilege Escalation

ADVISORY INFORMATION Product: ZKSecurity BIO Vendor: ZKTeco Version Affected: 3.0.5.0R CVE: CVE-2022-36634 Vulnerability: User privilege escalation CREDIT This vulnerability was discovered and researched by Caio Burgardt and Silton Santos. INTRODUCTION Based on the hybrid biometric technology and...

ZKTeco ZKBioSecurity 安全漏洞

ZKTeco ZKBioSecurity is a web-based all-in-one platform from ZKTeco China.An access control error vulnerability exists in ZKTeco ZKBioSecurity V5000 version 3.0.5r. The vulnerability stems from the presence of improper access control in the application, which can be exploited by an attacker to...

ZKTeco ZKBioSecurity SQL注入漏洞

ZKTeco ZKBioSecurity is a web-based all-in-one platform from ZKTeco China.A SQL injection vulnerability exists in ZKteco ZKBioSecurity V5000 version 4.1.3, which stems from a lack of validation of external input SQL statements in component/baseOpLog.do. An attacker could exploit the vulnerability...

ZKTeco FaceDepot and ZKBiosecurity Server Token Reuse Vulnerability

ZKTeco FaceDepot is a face attendance system. A token reuse vulnerability exists in ZKTeco FaceDepot version 7B 1.0.213 and ZKBiosecurity Server version 1.0.020190723, which can be exploited by a remote attacker to submit a special request to create arbitrary users, elevate privileges, and downlo...

ZKTeco FaceDepot and ZKBiosecurity Server Persistent Token Vulnerability

ZKTeco FaceDepot is a face attendance system. A persistent token vulnerability exists in ZKTeco FaceDepot version 7B 1.0.213 and ZKBiosecurity Server version 1.0.020190723, which stems from a lack of two-way authentication in the program, and can be exploited by an attacker to obtain a long-lived...

CVE-2020-17474

A token-reuse vulnerability in ZKTeco FaceDepot 7B 1.0.213 and ZKBiosecurity Server 1.0.020190723 allows an attacker to create arbitrary new users, elevate users to administrators, delete users, and download user faces from the database...

CVE-2020-17473

Lack of mutual authentication in ZKTeco FaceDepot 7B 1.0.213 and ZKBiosecurity Server 1.0.020190723 allows an attacker to obtain a long-lasting token by impersonating the server...

CVE-2020-17474

A token-reuse vulnerability in ZKTeco FaceDepot 7B 1.0.213 and ZKBiosecurity Server 1.0.020190723 allows an attacker to create arbitrary new users, elevate users to administrators, delete users, and download user faces from the database...

CVE-2020-17473

Lack of mutual authentication in ZKTeco FaceDepot 7B 1.0.213 and ZKBiosecurity Server 1.0.020190723 allows an attacker to obtain a long-lasting token by impersonating the server...

Authentication flaw

Lack of mutual authentication in ZKTeco FaceDepot 7B 1.0.213 and ZKBiosecurity Server 1.0.020190723 allows an attacker to obtain a long-lasting token by impersonating the server...

Code injection

A token-reuse vulnerability in ZKTeco FaceDepot 7B 1.0.213 and ZKBiosecurity Server 1.0.020190723 allows an attacker to create arbitrary new users, elevate users to administrators, delete users, and download user faces from the database...

CVE-2020-17474

CVE-2020-17474 concerns a token-reuse vulnerability affecting ZKTeco FaceDepot 7B 1.0.213 and ZKBiosecurity Server 1.0.0_20190723. The connected documents confirm that a token reuse flaw can enable a remote attacker to submit crafted requests to create arbitrary new users, escalate privileges to ...