CVE-2024-35428

ZKTeco ZKBio CVSecurity 6.1.1 is vulnerable to Directory Traversal via BaseMediaFile. An authenticated user can delete local files from the server which can lead to DoS...

CVE-2024-35433

ZKTeco ZKBio CVSecurity 6.1.1 is vulnerable to Incorrect Access Control. An authenticated user, without the permissions of managing users, can create a new admin user...

CVE-2024-35433

ZKTeco ZKBio CVSecurity 6.1.1 is vulnerable to Incorrect Access Control. An authenticated user, without the permissions of managing users, can create a new admin user...

CVE-2024-35433

The CVE-2024-35433 issue affects ZKTeco ZKBio CVSecurity 6.1.1 and is described as an Incorrect Access Control flaw: an authenticated user with no admin rights can create a new administrator account. Root cause is missing/incorrect permission checks on user-creation paths, enabling privilege esca...

CVE-2024-35428

CVE-2024-35428 affects ZKTeco ZKBio CVSecurity 6.1.1. The issue is a Directory Traversal via BaseMediaFile, allowing an authenticated user to delete local server files, leading to a Denial of Service. Documents consistently identify the vulnerable component as BaseMediaFile handling and do not pr...

CVE-2024-35428

ZKTeco ZKBio CVSecurity 6.1.1 is vulnerable to Directory Traversal via BaseMediaFile. An authenticated user can delete local files from the server which can lead to DoS...

CVE-2024-35428

ZKTeco ZKBio CVSecurity 6.1.1 is vulnerable to Directory Traversal via BaseMediaFile. An authenticated user can delete local files from the server which can lead to DoS...

CVE-2024-35429

CVE-2024-35429 affects ZKTeco ZKBio CVSecurity 6.1.1. The issue is a Directory Traversal vulnerability in the eventRecord component that can lead to unauthorized disclosure of data (CVE details show Confidentiality impact High; no explicit exploit details in provided docs). No patch/version fix i...

CVE-2024-35429

ZKTeco ZKBio CVSecurity 6.1.1 is vulnerable to Directory Traversal via eventRecord...

CVE-2024-35429

ZKTeco ZKBio CVSecurity 6.1.1 is vulnerable to Directory Traversal via eventRecord...

CVE-2024-35430

In ZKTeco ZKBio CVSecurity v6.1.1R and earlier fixed in 6.1.3R an authenticated user can bypass password checks while exporting data from the application...

CVE-2024-35430

In ZKTeco ZKBio CVSecurity v6.1.1R and earlier fixed in 6.1.3R an authenticated user can bypass password checks while exporting data from the application...

CVE-2024-35432

ZKTeco ZKBio CVSecurity 6.1.1 is vulnerable to Cross Site Scripting XSS via an Audio File. An authenticated user can injection malicious JavaScript code to trigger a Cross Site Scripting...

CVE-2024-35431

CVE-2024-35431 affects ZKTeco ZKBio CVSecurity (versions around 6.1.1, with reports up to 6.4.1) via the photoBase64 parameter. Root cause: directory traversal allows an unauthenticated attacker to download local server files. Impact: confidentiality of server data is HIGH; no integrity/availabil...

CVE-2024-35431

ZKTeco ZKBio CVSecurity 6.1.1 is vulnerable to Directory Traversal via photoBase64. An unauthenticated user can download local files from the server. NOTE: Third parties have indicated other versions are also vulnerable including up to 6.4.1...

CVE-2024-35431

ZKTeco ZKBio CVSecurity 6.1.1 is vulnerable to Directory Traversal via photoBase64. An unauthenticated user can download local files from the server. NOTE: Third parties have indicated other versions are also vulnerable including up to 6.4.1...

CVE-2024-35432

ZKTeco ZKBio CVSecurity 6.1.1 is vulnerable to Cross Site Scripting XSS via an Audio File. An authenticated user can injection malicious JavaScript code to trigger a Cross Site Scripting...

CVE-2024-35432

ZKTeco ZKBio CVSecurity 6.1.1 is vulnerable to Cross Site Scripting XSS via an Audio File. An authenticated user can injection malicious JavaScript code to trigger a Cross Site Scripting...

CVE-2024-35430

In ZKTeco ZKBio CVSecurity v6.1.1R and earlier fixed in 6.1.3R an authenticated user can bypass password checks while exporting data from the application...

CVE-2024-35430

In ZKTeco ZKBio CVSecurity v6.1.1R and earlier fixed in 6.1.3R an authenticated user can bypass password checks while exporting data from the application...