EUVD-2017-8223

Malware in sbrugna...

Unauthorized Access Vulnerability in ZKTime Web Software

ZKTime Web Software is a web-based service management system for ZKTime. An unauthorized access vulnerability exists in ZKTime Web Software, which can be exploited by an attacker to unauthorizedly download a dat backup file containing sensitive database information...

CVE-2017-17056

The ZKTime Web Software 2.0.1.12280 allows the Administrator to elevate the privileges of the application user using a 'passwordchange' function of the Modify Password component, reachable via the oldpassword, newpassword1, and newpassword2 parameters to the /accounts/passwordchange/ URI. An...

Design/Logic Flaw

The ZKTime Web Software 2.0.1.12280 allows the Administrator to elevate the privileges of the application user using a 'passwordchange' function of the Modify Password component, reachable via the oldpassword, newpassword1, and newpassword2 parameters to the /accounts/passwordchange/ URI. An...

CVE-2017-17056

The CVE-2017-17056 entry concerns ZKTime Web Software 2.0.1.12280. The vulnerability is a Cross-Site Request Forgery (CSRF) in the Modify Password component’s password_change() function, reachable via old_password/new_password1/new_password2 to /accounts/password_change/. An attacker can craft a ...

CVE-2017-17056

The ZKTime Web Software 2.0.1.12280 allows the Administrator to elevate the privileges of the application user using a 'passwordchange' function of the Modify Password component, reachable via the oldpassword, newpassword1, and newpassword2 parameters to the /accounts/passwordchange/ URI. An...

CVE-2017-17056: Cross-Site Request Forgery (CSRF)

The ZKTime Web Software 2.0.1.12280 allows the Administrator to elevate the privileges of the application user using a 'passwordchange' function of the Modify Password component, reachable via the oldpassword, newpassword1, and newpassword2 parameters to the /accounts/passwordchange/ URI. An...

PT-2017-14689

Name of the Vulnerable Software and Affected Versions ZKTime Web Software version 2.0.1.12280 Description The issue allows an attacker to elevate privileges using the password change function of the Modify Password component, accessible via the old password, new password1, and new password2...

ZKTime Web Software Cross-Site Scripting Vulnerability

ZKTeco ZKTime Web Software is a time and attendance management system from ZKTeco, Inc. A cross-site scripting vulnerability exists in ZKTeco ZKTime Web Software version 2.0.1.12280. An attacker could exploit this vulnerability to elevate privileges to administrator privileges...

ZKTime Web Software 2.0 - Improper Access Restrictions

Exploit Title: ZKTime Web Software 2.0 - Broken Authentication CVE-ID: CVE-2017-14680 Vendor Homepage: https://www.zkteco.com/product/ZKTimeWeb2.0435.html Vendor of Product: ZKTeco Affected Product Code: ZKTime Web - 2.0.1.12280 Category: WebApps Author: Arvind V. Author Social: @FindArvind...