CVE-2022-30515

ZKTeco BioTime 8.5.4 is missing authentication on folders containing employee photos, allowing an attacker to view them through filename enumeration...

PT-2022-20152 · Zkteco · Zkteco Biotime

Name of the Vulnerable Software and Affected Versions: ZKTeco BioTime version 8.5.4 Description: The issue is related to missing authentication on folders containing employee photos. This allows an attacker to view the photos through filename enumeration. Recommendations: For ZKTeco BioTime versi...

ZKTeco ZKBio Time 访问控制错误漏洞

ZKTeco ZKBio Time is a powerful web-based time and attendance management software from the Chinese company ZKTeco. A security vulnerability exists in ZKTeco ZKBio Time version 8.5.4, which stems from a lack of authentication of folders containing employee photos...

CVE-2022-30515

ZKTeco BioTime 8.5.4 is missing authentication on folders containing employee photos, allowing an attacker to view them through filename enumeration...

CVE-2022-30515

ZKTeco BioTime 8.5.4 is affected by an authentication bypass issue where folders containing employee photos are not required to authenticate, enabling an attacker to view photos via filename enumeration. This vulnerability is corroborated by multiple sources in the connected set (including NVD an...

ZKTeco ZEM/ZMM Web Interface 安全漏洞

The ZKTeco ZEM/ZMM Web Interface is a web interface for time and attendance devices from the Chinese company ZKTeco. A security vulnerability exists in the ZKTeco ZEM/ZMM Web Interface that stems from a missing authentication issue...

ZKTeco ZEM500-510-560-760 / ZEM600-800 / ZEM720 / ZMM Missing Authentication

Advisory: Missing Authentication in ZKTeco ZEM/ZMM Web Interface The ZKTeco time attendance device does not require authentication to use the web interface, exposing the database of employees and their credentials. Details ======= Product: ZKTeco ZEM500-510-560-760, ZEM600-800, ZEM720, ZMM Affect...

ZKTeco ZEM500-510-560-760 / ZEM600-800 / ZEM720 / ZMM Missing Authentication Vulnerability

ZKTeco ZEM500-510-560-760, ZEM600-800, ZEM720, and ZMM suffer from a missing authentication vulnerability. Versions below 8.88 ZEM500-510-560-760, ZEM600-800, ZEM720 and 15.00 ZMM200-220-210 are potentially affected. The ZKTeco time attendance device does not require authentication to use the web...

ZKTeco ZKBioSecurity Access Control Error Vulnerability

ZKTeco ZKBioSecurity is a web-based all-in-one platform from ZKTeco China.An access control error vulnerability exists in ZKTeco ZKBioSecurity V5000 version 3.0.5r. The vulnerability stems from the presence of improper access control in the application, which can be exploited by an attacker to...

ZKTeco ZKBioSecurity SQL Injection Vulnerability

ZKTeco ZKBioSecurity is a web-based all-in-one platform from ZKTeco China.A SQL injection vulnerability exists in ZKteco ZKBioSecurity V5000 version 4.1.3, which stems from a lack of validation of external input SQL statements in component/baseOpLog.do. An attacker could exploit the vulnerability...

ZKTeco ZKBio Time Cross-Site Scripting Vulnerability

A cross-site scripting vulnerability exists in ZKTeco ZKBio Time version 8.0.7, which originates from the "Content" text field of the "Add New Message" module. Content" text field of the "Add New Message" module lacks effective filtering and escaping of user-supplied data, which can be exploited ...

CVE-2022-36635

ZKteco ZKBioSecurity V5000 4.1.3 was discovered to contain a SQL injection vulnerability via the component /baseOpLog.do...

CVE-2022-36634

An access control issue in ZKTeco ZKBioSecurity V5000 3.0.5r allows attackers to arbitrarily create admin users via a crafted HTTP request...

CVE-2022-36634

An access control issue in ZKTeco ZKBioSecurity V5000 3.0.5r allows attackers to arbitrarily create admin users via a crafted HTTP request...

Cross site request forgery (csrf)

An access control issue in ZKTeco ZKBioSecurity V5000 3.0.5r allows attackers to arbitrarily create admin users via a crafted HTTP request...

CVE-2022-36635

ZKteco ZKBioSecurity V5000 4.1.3 was discovered to contain a SQL injection vulnerability via the component /baseOpLog.do...

CVE-2022-36635

CVE-2022-36635 affects ZKTeco ZKBioSecurity V5000 (version 4.1.3) with a SQL injection in the /baseOpLog.do component. The root cause is a lack of input validation for external SQL statements, enabling attackers to obtain sensitive DB information. The CVSSv3.1 metrics indicate Network access, Low...

CVE-2022-36634

CVE-2022-36634 affects ZKTeco ZKBioSecurity V5000, specifically version 3.0.5_r, where an access control flaw allows an attacker to arbitrarily create administrator users via a crafted HTTP request. The vulnerability is described as improper access control in the web-based ZKBioSecurity platform,...

CVE-2022-36634

An access control issue in ZKTeco ZKBioSecurity V5000 3.0.5r allows attackers to arbitrarily create admin users via a crafted HTTP request...

ZKSecurity BIO 4.1.2 SQL Injection / Code Execution

ADVISORY INFORMATION Product: ZKSecurity BIO Vendor: ZKTeco https://www.zkteco.com/en/ZKBiosecurity/ZKBioSecurityV50004.1.2 Version Affected: 4.1.2 CVE: CVE-2022-36635 Vulnerability: SQL Injection with a plus: RCE CREDIT This vulnerability was discovered and researched by Caio Burgardt and Silton...