CVE-2023-38958

An access control issue in ZKTeco BioAccess IVS v3.3.1 allows unauthenticated attackers to arbitrarily close and open the doors managed by the platform remotely via sending a crafted web request...

CVE-2023-38955

ZKTeco BioAccess IVS v3.3.1 allows unauthenticated attackers to obtain sensitive information about all managed devices, including their IP addresses and device names...

CVE-2023-38954

ZKTeco BioAccess IVS v3.3.1 was discovered to contain a SQL injection vulnerability...

PT-2023-4125 · Zkteco · Zkteco Bioaccess Ivs

Name of the Vulnerable Software and Affected Versions: ZKTeco BioAccess IVS version 3.3.1 Description: The issue is related to a lack of protection for the SQL query structure, which can be exploited to execute arbitrary SQL code. This can be done remotely. Recommendations: For ZKTeco BioAccess I...

PT-2023-4129 · Zkteco · Zkteco Bioaccess Ivs

Name of the Vulnerable Software and Affected Versions: ZKTeco BioAccess IVS version 3.3.1 Description: The issue is related to a path traversal vulnerability, which can be exploited by a remote attacker to read arbitrary files. This is achieved by supplying a crafted payload, allowing unauthorize...

PT-2023-4126 · Zkteco · Zkteco Bioaccess Ivs

Name of the Vulnerable Software and Affected Versions: ZKTeco BioAccess IVS version 3.3.1 Description: The issue is related to insufficient protection of service data in the ZKTeco BioAccess IVS web platform, which can be exploited by remote attackers to gain unauthorized access to sensitive...