Biotime Security Vulnerabilities and Issues — Biotime CVE List

Lucene search

ZktecoBiotime

11 matches found

CVE•added 2023/08/03 11:15 p.m.•2572 views

CVE-2023-38950

A path traversal vulnerability in the iclock API of ZKTeco BioTime v8.5.5 allows unauthenticated attackers to read arbitrary files via supplying a crafted payload.

7.5CVSS7.8AI score0.82484EPSS

CVE•added 2023/08/03 11:15 p.m.•2520 views

CVE-2023-38949

An issue in a hidden API in ZKTeco BioTime v8.5.5 allows unauthenticated attackers to arbitrarily reset the Administrator password via a crafted web request.

7.5CVSS7.5AI score0.00143EPSS

CVE•added 2023/08/03 11:15 p.m.•94 views

CVE-2023-38951

ZKTeco BioTime 8.5.5 through 9.x before 9.0.1 (20240617.19506) allows authenticated attackers to create or overwrite arbitrary files on the server via crafted requests to /base/sftpsetting/ endpoints that abuse a path traversal issue in the Username field and a lack of input sanitization on the SSH...

9.8CVSS9.6AI score0.00522EPSS

CVE•added 2023/08/03 11:15 p.m.•65 views

CVE-2023-38952

Insecure access control in ZKTeco BioTime through 9.0.1 allows authenticated attackers to escalate their privileges due to the fact that session ids are not validated for the type of user accessing the application by default. Privilege restrictions between non-admin and admin users are not enforced...

7.5CVSS8.2AI score0.001EPSS

CVE•added 2022/11/30 2:15 p.m.•56 views

CVE-2022-38801

In Zkteco BioTime

5.4CVSS5.2AI score0.00084EPSS

CVE•added 2022/11/08 11:15 p.m.•53 views

CVE-2022-30515

ZKTeco BioTime 8.5.4 is missing authentication on folders containing employee photos, allowing an attacker to view them through filename enumeration.

5.3CVSS5.4AI score0.00198EPSS

CVE•added 2022/11/30 2:15 p.m.•52 views

CVE-2022-38802

Zkteco BioTime

6.2CVSS5.8AI score0.00115EPSS

CVE•added 2022/11/30 2:15 p.m.•50 views

CVE-2022-38803

Zkteco BioTime

6.8CVSS6AI score0.00086EPSS

CVE•added 2024/07/05 11:15 a.m.•44 views

CVE-2024-6523

A vulnerability was found in ZKTeco BioTime up to 9.5.2. It has been classified as problematic. Affected is an unknown function of the component system-group-add Handler. The manipulation of the argument user with the input leads to cross site scripting. It is possible to launch the attack remotel...

5.4CVSS3.9AI score0.00026EPSS

CVE•added 2024/04/11 1:22 a.m.•37 views

CVE-2023-51142

An issue in ZKTeco BioTime v.8.5.4 and before allows a remote attacker to obtain sensitive information.

7.5CVSS6.6AI score0.00248EPSS

CVE•added 2024/04/11 1:22 a.m.•21 views

CVE-2023-51141

An issue in ZKTeko BioTime v.8.5.4 and before allows a remote attacker to obtain sensitive information via the Authentication & Authorization component

6.5CVSS6.4AI score0.00168EPSS