Filtered by vendor Zkteco Subscriptions
Total 31 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2024-11049 1 Zkteco 1 Zkbio Time 2024-11-23 3.7 Low
A vulnerability classified as problematic has been found in ZKTeco ZKBio Time 9.0.1. Affected is an unknown function of the file /auth_files/photo/ of the component Image File Handler. The manipulation leads to direct request. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2024-6523 1 Zkteco 1 Biotime 2024-11-21 3.5 Low
A vulnerability was found in ZKTeco BioTime up to 9.5.2. It has been classified as problematic. Affected is an unknown function of the component system-group-add Handler. The manipulation of the argument user with the input <script>alert('XSS')</script> leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-270366 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2024-6005 1 Zkteco 1 Zkbio Cvsecurity V5000 2024-11-21 3.5 Low
A vulnerability was found in ZKTeco ZKBio CVSecurity V5000 4.1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the component Department Section. The manipulation of the argument Department Name leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-268693 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2024-36526 1 Zkteco 1 Zkbio Cvsecurity 2024-11-21 9.8 Critical
ZKTeco ZKBio CVSecurity v6.1.1 was discovered to contain a hardcoded cryptographic key.
CVE-2024-35429 1 Zkteco 1 Zkbio Cvsecurity 2024-11-21 6.5 Medium
ZKTeco ZKBio CVSecurity 6.1.1 is vulnerable to Directory Traversal via eventRecord.
CVE-2024-35428 1 Zkteco 1 Zkbio Cvsecurity 2024-11-21 7.1 High
ZKTeco ZKBio CVSecurity 6.1.1 is vulnerable to Directory Traversal via BaseMediaFile. An authenticated user can delete local files from the server which can lead to DoS.
CVE-2023-4587 1 Zkteco 2 Zem800, Zem800 Firmware 2024-11-21 8.3 High
An IDOR vulnerability has been found in ZKTeco ZEM800 product affecting version 6.60. This vulnerability allows a local attacker to obtain registered user backup files or device configuration files over a local network or through a VPN server.
CVE-2023-38958 1 Zkteco 1 Bioaccess Ivs 2024-11-21 5.3 Medium
An access control issue in ZKTeco BioAccess IVS v3.3.1 allows unauthenticated attackers to arbitrarily close and open the doors managed by the platform remotely via sending a crafted web request.
CVE-2023-38956 1 Zkteco 1 Bioaccess Ivs 2024-11-21 7.5 High
A path traversal vulnerability in ZKTeco BioAccess IVS v3.3.1 allows unauthenticated attackers to read arbitrary files via supplying a crafted payload.
CVE-2023-38955 1 Zkteco 1 Bioaccess Ivs 2024-11-21 7.5 High
ZKTeco BioAccess IVS v3.3.1 allows unauthenticated attackers to obtain sensitive information about all managed devices, including their IP addresses and device names.
CVE-2023-38954 1 Zkteco 1 Bioaccess Ivs 2024-11-21 9.8 Critical
ZKTeco BioAccess IVS v3.3.1 was discovered to contain a SQL injection vulnerability.
CVE-2023-38952 1 Zkteco 1 Biotime 2024-11-21 7.5 High
Insecure access control in ZKTeco BioTime v8.5.5 allows unauthenticated attackers to read sensitive backup files and access sensitive information such as user credentials via sending a crafted HTTP request to the static files resources of the system.
CVE-2023-38951 1 Zkteco 1 Biotime 2024-11-21 9.8 Critical
A path traversal vulnerability in ZKTeco BioTime v8.5.5 allows attackers to write arbitrary files via using a malicious SFTP configuration.
CVE-2023-38950 1 Zkteco 1 Biotime 2024-11-21 7.5 High
A path traversal vulnerability in the iclock API of ZKTeco BioTime v8.5.5 allows unauthenticated attackers to read arbitrary files via supplying a crafted payload.
CVE-2023-38949 1 Zkteco 1 Biotime 2024-11-21 7.5 High
An issue in a hidden API in ZKTeco BioTime v8.5.5 allows unauthenticated attackers to arbitrarily reset the Administrator password via a crafted web request.
CVE-2022-44213 1 Zkteco 1 Automatic Data Master Server 2024-11-21 4.8 Medium
ZKTeco Xiamen Information Technology ZKBio ECO ADMS <=3.1-164 is vulnerable to Cross Site Scripting (XSS).
CVE-2022-42953 1 Zkteco 20 Zem500, Zem500 Firmware, Zem510 and 17 more 2024-11-21 7.5 High
Certain ZKTeco products (ZEM500-510-560-760, ZEM600-800, ZEM720, ZMM) allow access to sensitive information via direct requests for the form/DataApp?style=1 and form/DataApp?style=0 URLs. The affected versions may be before 8.88 (ZEM500-510-560-760, ZEM600-800, ZEM720) and 15.00 (ZMM200-220-210). The fixed versions are firmware version 8.88 (ZEM500-510-560-760, ZEM600-800, ZEM720) and firmware version 15.00 (ZMM200-220-210).
CVE-2022-38803 1 Zkteco 1 Biotime 2024-11-21 6.8 Medium
Zkteco BioTime < 8.5.3 Build:20200816.447 is vulnerable to Incorrect Access Control via Leave, overtime, Manual log. An authenticated employee can read local files by exploiting XSS into a pdf generator when exporting data as a PDF
CVE-2022-38802 1 Zkteco 1 Biotime 2024-11-21 6.2 Medium
Zkteco BioTime < 8.5.3 Build:20200816.447 is vulnerable to Incorrect Access Control via resign, private message, manual log, time interval, attshift, and holiday. An authenticated administrator can read local files by exploiting XSS into a pdf generator when exporting data as a PDF
CVE-2022-38801 1 Zkteco 1 Biotime 2024-11-21 5.4 Medium
In Zkteco BioTime < 8.5.3 Build:20200816.447, an employee can hijack an administrator session and cookies using blind cross-site scripting.