Browse CVEs

MEDIUM 5.3 CVE-2022-30515 ZKTeco BioTime 8.5.4 is missing authentication on folders containing employee photos, allowing an attacker to view them through filename enumeration. Biotime No fix yet Fix from $1,6002022-11-08 HIGH 8.8 CVE-2022-36635EPSS 17% ZKteco ZKBioSecurity V5000 4.1.3 was discovered to contain a SQL injection vulnerability via the component /baseOpLog.do. Zkbiosecurity V5000 Mitigation only Fix from $1,9502022-10-07 HIGH 8.8 CVE-2022-36634 An access control issue in ZKTeco ZKBioSecurity V5000 3.0.5_r allows attackers to arbitrarily create admin users via a crafted HTTP request. Zkbiosecurity V5000 Mitigation only Fix from $1,9502022-10-07 CRITICAL 9.8 CVE-2020-17474 A token-reuse vulnerability in ZKTeco FaceDepot 7B 1.0.213 and ZKBiosecurity Server 1.0.0_20190723 allows an attacker to create arbitrary new users, … Zkbiosecurity Server No fix yet Fix from $2,3002020-08-14 MEDIUM 5.9 CVE-2020-17473 Lack of mutual authentication in ZKTeco FaceDepot 7B 1.0.213 and ZKBiosecurity Server 1.0.0_20190723 allows an attacker to obtain a long-lasting toke… Zkbiosecurity Server Mitigation only Fix from $1,6002020-08-14 HIGH 8.8 CVE-2017-17056 The ZKTime Web Software 2.0.1.12280 allows the Administrator to elevate the privileges of the application user using a 'password_change()' function o… Zktime Web No fix yet Fix from $1,9502017-12-04 MEDIUM 6.1 CVE-2017-17057 There is a reflected XSS vulnerability in ZKTime Web 2.0.1.12280. The vulnerability exists due to insufficient filtration of user-supplied data in th… Zktime Web No fix yet Fix from $1,6002017-12-04 HIGH 8.0 CVE-2017-13129 Cross-site request forgery (CSRF) vulnerability in ZKTeco ZKTime Web 2.0.1.12280 allows remote authenticated users to hijack the authentication of ad… Zktime Web Mitigation only Fix from $1,9502017-09-26 HIGH 7.5 CVE-2017-14680 ZKTeco ZKTime Web 2.0.1.12280 allows remote attackers to obtain sensitive employee metadata via a direct request for a PDF document. Zktime Web No fix yet Fix from $1,9502017-09-21