CVE-2022-40472

ZKTeco Xiamen Information Technology ZKBio Time 8.0.7 Build: 20220721.14829 was discovered to contain a CSV injection vulnerability. This vulnerability allows attackers to execute arbitrary code via a crafted payload injected into the Content text field of the Add New Message module...

CVE-2022-40472

CVE-2022-40472 affects ZKBio Time 8.0.7 (Build 20220721.14829). A CSV injection exists in the Content field of the Add New Message module, enabling arbitrary code execution via crafted payloads. Exploitation details are not provided in the available sources; in‑product impact is described as high...

CVE-2022-40472

ZKTeco Xiamen Information Technology ZKBio Time 8.0.7 Build: 20220721.14829 was discovered to contain a CSV injection vulnerability. This vulnerability allows attackers to execute arbitrary code via a crafted payload injected into the Content text field of the Add New Message module...

ZKTeco FaceDepot and ZKBiosecurity Server Persistent Token Vulnerability

ZKTeco FaceDepot is a face attendance system. A persistent token vulnerability exists in ZKTeco FaceDepot version 7B 1.0.213 and ZKBiosecurity Server version 1.0.020190723, which stems from a lack of two-way authentication in the program, and can be exploited by an attacker to obtain a long-lived...

CVE-2020-17473

Lack of mutual authentication in ZKTeco FaceDepot 7B 1.0.213 and ZKBiosecurity Server 1.0.020190723 allows an attacker to obtain a long-lasting token by impersonating the server...

CVE-2020-17473

Lack of mutual authentication in ZKTeco FaceDepot 7B 1.0.213 and ZKBiosecurity Server 1.0.020190723 allows an attacker to obtain a long-lasting token by impersonating the server...

CVE-2020-17474

A token-reuse vulnerability in ZKTeco FaceDepot 7B 1.0.213 and ZKBiosecurity Server 1.0.020190723 allows an attacker to create arbitrary new users, elevate users to administrators, delete users, and download user faces from the database...

CVE-2020-17474

A token-reuse vulnerability in ZKTeco FaceDepot 7B 1.0.213 and ZKBiosecurity Server 1.0.020190723 allows an attacker to create arbitrary new users, elevate users to administrators, delete users, and download user faces from the database...

Code injection

A token-reuse vulnerability in ZKTeco FaceDepot 7B 1.0.213 and ZKBiosecurity Server 1.0.020190723 allows an attacker to create arbitrary new users, elevate users to administrators, delete users, and download user faces from the database...

Authentication flaw

Lack of mutual authentication in ZKTeco FaceDepot 7B 1.0.213 and ZKBiosecurity Server 1.0.020190723 allows an attacker to obtain a long-lasting token by impersonating the server...

CVE-2020-17474

CVE-2020-17474 concerns a token-reuse vulnerability affecting ZKTeco FaceDepot 7B 1.0.213 and ZKBiosecurity Server 1.0.0_20190723. The connected documents confirm that a token reuse flaw can enable a remote attacker to submit crafted requests to create arbitrary new users, escalate privileges to ...

CVE-2020-17474

A token-reuse vulnerability in ZKTeco FaceDepot 7B 1.0.213 and ZKBiosecurity Server 1.0.020190723 allows an attacker to create arbitrary new users, elevate users to administrators, delete users, and download user faces from the database...

CVE-2020-17473

Lack of mutual authentication in ZKTeco FaceDepot 7B 1.0.213 and ZKBiosecurity Server 1.0.020190723 allows an attacker to obtain a long-lasting token by impersonating the server...

CVE-2020-17473

CVE-2020-17473 affects ZKTeco FaceDepot 7B 1.0.213 and ZKBiosecurity Server 1.0.0_20190723. The root cause is lack of mutual (two-way) authentication, allowing an attacker to impersonate the server and obtain a long‑lived token. Public details from NVD indicate CVSS v3.1/base score 5.9 (Network, ...

CVE-2020-17474: Insufficient Session Expiration

A token-reuse vulnerability in ZKTeco FaceDepot 7B 1.0.213 and ZKBiosecurity Server 1.0.020190723 allows an attacker to create arbitrary new users, elevate users to administrators, delete users, and download user faces from the database...

PT-2020-15013

Name of the Vulnerable Software and Affected Versions ZKTeco FaceDepot 7B version 1.0.213 ZKBiosecurity Server version 1.0.0 20190723 Description The issue is related to a lack of mutual authentication, which allows an attacker to impersonate the server and obtain a long-lasting token...

PT-2020-15014

Name of the Vulnerable Software and Affected Versions ZKTeco FaceDepot 7B version 1.0.213 ZKBiosecurity Server version 1.0.0 20190723 Description A token-reuse issue allows an attacker to create new users, elevate existing users to administrators, delete users, and download user faces from the...

CVE-2020-17473: Insufficient Session Expiration

Lack of mutual authentication in ZKTeco FaceDepot 7B 1.0.213 and ZKBiosecurity Server 1.0.020190723 allows an attacker to obtain a long-lasting token by impersonating the server...

ZKTeco ZKBioSecurity 3.0 CSRF Add Superadmin Exploit

Summary ZKBioSecurity3.0 is the ultimate "All in One" web based security platform developed by ZKTeco. It contains four integrated modules: access control, video linkage, elevator control and visitor management. With an optimized system architecture designed for high level biometric identificatio...

ZKTeco ZKBioSecurity 3.0 Multiple XSS Vulnerabilities

Summary ZKBioSecurity3.0 is the ultimate "All in One" web based security platform developed by ZKTeco. It contains four integrated modules: access control, video linkage, elevator control and visitor management. With an optimized system architecture designed for high level biometric identificatio...