577 matches found
CVE-2017-13129
Cross-site request forgery CSRF vulnerability in ZKTeco ZKTime Web 2.0.1.12280 allows remote authenticated users to hijack the authentication of administrators for requests that add administrators by leveraging lack of anti-CSRF tokens...
CVE-2017-13129
Cross-site request forgery CSRF vulnerability in ZKTeco ZKTime Web 2.0.1.12280 allows remote authenticated users to hijack the authentication of administrators for requests that add administrators by leveraging lack of anti-CSRF tokens...
CVE-2017-13129
CVE-2017-13129 affects ZKTime Web 2.0.1.12280 (ZKTeco) and is due to a CSRF vulnerability allowing remote authenticated users to hijack administrator actions to add admins, caused by lack of anti-CSRF tokens. Exploitation and in-the-wild details are present in connected sources; no official patch...
ZKTeco ZKTime Web Information Disclosure Vulnerability
ZKTeco ZKTime Web is a time and attendance management system from ZKTeco, Inc. A security vulnerability exists in ZKTeco ZKTime Web version 2.0.1.12280. A remote attacker can exploit this vulnerability by sending a direct request to a PDF document to obtain sensitive user metadata...
Design/Logic Flaw
ZKTeco ZKTime Web 2.0.1.12280 allows remote attackers to obtain sensitive employee metadata via a direct request for a PDF document...
CVE-2017-14680
ZKTeco ZKTime Web 2.0.1.12280 allows remote attackers to obtain sensitive employee metadata via a direct request for a PDF document...
CVE-2017-14680
CVE-2017-14680 affects ZKTeco’s ZKTime Web 2.0.1.12280. The Red Hat/NVD/CNVD entries describe a vulnerability where remote attackers can obtain sensitive employee metadata by issuing a direct request for a PDF document. This indicates an improper access control/information disclosure flaw in the ...
CVE-2017-14680
ZKTeco ZKTime Web 2.0.1.12280 allows remote attackers to obtain sensitive employee metadata via a direct request for a PDF document...
ZKTeco ZKTime Web 2.0.1.12280 Information Disclosure
Vulnerability Type: Broken Authentication Vendor of Product: ZKTeco Affected Product Code Base: ZKTime Web - 2.0.1.12280 Affected Component: ZK Time Web Interface Management. Attack Type: Local - Unauthenticated Impact: Information Disclosure ------------------------------------------ Product...
ZKTeco ZKTime Web 2.0.1.12280 Cross Site Request Forgery
Vulnerability Type: Cross Site Request Forgery CSRF Vendor of Product: ZKTeco Affected Product Code Base: ZKTime Web - 2.0.1.12280 Affected Component: ZK Time Web Interface Management. Attack Type: Local - Authenticated Impact: Escalation of Privileges ------------------------------------------...
ZKTime Web Software 2.0 - Cross-Site Request Forgery
ZKTime Web Software 2.0 - Cross-Site Request Forgery Exploit Title: ZKTime Web Software 2.0 - Cross Site Request Forgery CVE-ID: CVE-2017-13129 Vendor Homepage: https://www.zkteco.com/product/ZKTimeWeb2.0435.html Vendor of Product: ZKTeco Affected Product Code: ZKTime Web - 2.0.1.12280 Category:...
ZKTime Web Software 2.0 - Improper Access Restrictions
Exploit Title: ZKTime Web Software 2.0 - Broken Authentication CVE-ID: CVE-2017-14680 Vendor Homepage: https://www.zkteco.com/product/ZKTimeWeb2.0435.html Vendor of Product: ZKTeco Affected Product Code: ZKTime Web - 2.0.1.12280 Category: WebApps Author: Arvind V. Author Social: @FindArvind...
ZKTeco ZKBioSecurity Multiple Vulnerabilities (Jul 2016)
ZKTeco ZKBioSecurity is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:zkteco:zkbiosecurity";...
ZKTeco ZKBioSecurity Detection (HTTP)
HTTP based detection of ZKTeco ZKBioSecurity. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
ZKTeco ZKAccess Security System 5.3.1 - stored XSS
Application description ZKAccess systems are built on flexible, open technology to provide management, real-time monitoring and control of your access control changes, access via a browser,without the need to install additional software. Security infrastructure devices centralized management,...
ZKTeco ZKBioSecurity 3.0 hard-coded login credentials and remote system command execution
No description provided by source...
ZKTeco ZKAccess Security System 5.3.1 Persistent Cross-Site Scripting Vulnerability
ZKBioSecurity is a comprehensive management platform for biometric security. ZKTeco ZKAccess Security System 5.3.1 persistent cross-site scripting vulnerability, which occurs due to failure to properly validate the "HOLIDAYNAME" and POST submit "memo" parameters when passing them to the user. The...
ZKTeco ZKBioSecurity 3.0 Directory Traversal Vulnerability
ZKBioSecurity is a comprehensive management platform for biometric security. A directory traversal vulnerability exists in ZKTeco ZKBioSecurity 3.0, which can be exploited by an attacker to obtain sensitive information by modifying a file path...
ZKTeco ZKAccess Professional 3.5.3 Insecure File Permissions
i? ZKTeco ZKAccess Professional 3.5.3 Insecure File Permissions Vendor: ZKTeco Inc. | Xiamen ZKTeco Biometric Identification Technology Co.,ltd Product web page: http://www.zkteco.com Affected version: 3.5.3 Build 0005 Summary: ZKAccess 3.5 is a desktop software which is suitable for small and...