CVE-2024-6006: Improper Neutralization of Input During Web Page Generation

A vulnerability was found in ZKTeco ZKBio CVSecurity V5000 4.1.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the component Summer Schedule Handler. The manipulation of the argument Schedule Name leads to cross site scripting. The attack may be launch...

CVE-2024-6005: Improper Neutralization of Input During Web Page Generation

A vulnerability was found in ZKTeco ZKBio CVSecurity V5000 4.1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the component Department Section. The manipulation of the argument Department Name leads to cross site scripting. The attack can be...

CVE-2024-35433

ZKTeco ZKBio CVSecurity 6.1.1 is vulnerable to Incorrect Access Control. An authenticated user, without the permissions of managing users, can create a new admin user...

CVE-2024-35433

ZKTeco ZKBio CVSecurity 6.1.1 is vulnerable to Incorrect Access Control. An authenticated user, without the permissions of managing users, can create a new admin user...

CVE-2024-35428

ZKTeco ZKBio CVSecurity 6.1.1 is vulnerable to Directory Traversal via BaseMediaFile. An authenticated user can delete local files from the server which can lead to DoS...

CVE-2024-35429

ZKTeco ZKBio CVSecurity 6.1.1 is vulnerable to Directory Traversal via eventRecord...

CVE-2024-35428

ZKTeco ZKBio CVSecurity 6.1.1 is vulnerable to Directory Traversal via BaseMediaFile. An authenticated user can delete local files from the server which can lead to DoS...

CVE-2024-35431

ZKTeco ZKBio CVSecurity 6.1.1 is vulnerable to Directory Traversal via photoBase64. An unauthenticated user can download local files from the server. NOTE: Third parties have indicated other versions are also vulnerable including up to 6.4.1...

CVE-2024-35431

ZKTeco ZKBio CVSecurity 6.1.1 is vulnerable to Directory Traversal via photoBase64. An unauthenticated user can download local files from the server. NOTE: Third parties have indicated other versions are also vulnerable including up to 6.4.1...

CVE-2024-35429

ZKTeco ZKBio CVSecurity 6.1.1 is vulnerable to Directory Traversal via eventRecord...

CVE-2024-35433

ZKTeco ZKBio CVSecurity version 6.1.1 is vulnerable to Incorrect Access Control . This flaw allows an authenticated user who lacks the necessary permissions to manage users to successfully create a new admin user . The vulnerability results from improper authorization checks within the user manag...

CVE-2024-35428

CVE-2024-35428 affects ZKTeco ZKBio CVSecurity 6.1.1. The issue is a Directory Traversal via BaseMediaFile, allowing an authenticated user to delete local server files, leading to a Denial of Service. Documents consistently identify the vulnerable component as BaseMediaFile handling and do not pr...

CVE-2024-35429

CVE-2024-35429 affects ZKTeco ZKBio CVSecurity 6.1.1. The issue is a Directory Traversal vulnerability in the eventRecord component that can lead to unauthorized disclosure of data (CVE details show Confidentiality impact High; no explicit exploit details in provided docs). No patch/version fix i...

CVE-2024-35432

ZKTeco ZKBio CVSecurity 6.1.1 is vulnerable to Cross Site Scripting XSS via an Audio File. An authenticated user can injection malicious JavaScript code to trigger a Cross Site Scripting...

CVE-2024-35430

In ZKTeco ZKBio CVSecurity v6.1.1R and earlier fixed in 6.1.3R an authenticated user can bypass password checks while exporting data from the application...

CVE-2024-35432

ZKTeco ZKBio CVSecurity 6.1.1 is vulnerable to Cross Site Scripting XSS via an Audio File. An authenticated user can injection malicious JavaScript code to trigger a Cross Site Scripting...

CVE-2024-35431

ZKTeco ZKBio CVSecurity 6.1.1 is vulnerable to Directory Traversal via photoBase64. An unauthenticated user can download local files from the server. NOTE: Third parties have indicated other versions are also vulnerable including up to 6.4.1...

CVE-2024-35431

ZKTeco ZKBio CVSecurity (specifically version 6.1.1 , with reports including up to 6.4.1 ) is vulnerable to a Directory Traversal flaw via the photoBase64 parameter. This vulnerability allows an unauthenticated user to perform a path traversal attack (e.g., dir .. ..filename) to download local fi...

CVE-2024-35430

In ZKTeco ZKBio CVSecurity v6.1.1R and earlier fixed in 6.1.3R an authenticated user can bypass password checks while exporting data from the application...

PT-2024-26501 · Zkteco · Zkbio Cvsecurity

Name of the Vulnerable Software and Affected Versions: ZKTeco ZKBio CVSecurity version 6.1.1 Description: The issue allows an unauthenticated user to perform a Directory Traversal attack via the photoBase64 parameter, enabling them to download local files from the server. Recommendations: For...