Page 2 of 9 results (0.010 seconds)

CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 0

CVE-2022-38801

https://notcve.org/view.php?id=CVE-2022-38801

In Zkteco BioTime < 8.5.3 Build:20200816.447, an employee can hijack an administrator session and cookies using blind cross-site scripting. En Zkteco BioTime &lt; 8.5.3 Build:20200816.447, un empleado puede secuestrar una sesión de administrador y cookies mediante blind cross-site scripting. • https://gist.github.com/hamoshwani/5ac860dd6757440174f446c62b24653f https://www.zkteco.com • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 6.2EPSS: 0%CPEs: 1EXPL: 1

CVE-2022-38802

https://notcve.org/view.php?id=CVE-2022-38802

Zkteco BioTime < 8.5.3 Build:20200816.447 is vulnerable to Incorrect Access Control via resign, private message, manual log, time interval, attshift, and holiday. An authenticated administrator can read local files by exploiting XSS into a pdf generator when exporting data as a PDF Zkteco BioTime &lt; 8.5.3 Build:20200816.447 es vulnerable a un control de acceso incorrecto mediante renuncia, mensaje privado, registro manual, intervalo de tiempo, attshift y vacaciones. Un administrador autenticado puede leer archivos locales explotando XSS en un generador de PDF al exportar datos como PDF. • https://gist.github.com/hamoshwani/fd7e3d9d9ff8896f1ccf8426dccaf97e https://www.zkteco.com • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 6.8EPSS: 0%CPEs: 1EXPL: 1

CVE-2022-38803

https://notcve.org/view.php?id=CVE-2022-38803

Zkteco BioTime < 8.5.3 Build:20200816.447 is vulnerable to Incorrect Access Control via Leave, overtime, Manual log. An authenticated employee can read local files by exploiting XSS into a pdf generator when exporting data as a PDF Zkteco BioTime &lt; 8.5.3 Build:20200816.447 es vulnerable a un control de acceso incorrecto mediante permisos, horas extras y registro manual. Un empleado autenticado puede leer archivos locales explotando XSS en un generador de PDF al exportar datos como PDF. • https://gist.github.com/hamoshwani/44653bfe7b8cc461692a2f074b1ef475 https://www.zkteco.com • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 5.3EPSS: 0%CPEs: 2EXPL: 1

CVE-2022-30515

https://notcve.org/view.php?id=CVE-2022-30515

ZKTeco BioTime 8.5.4 is missing authentication on folders containing employee photos, allowing an attacker to view them through filename enumeration. ZKTeco BioTime 8.5.4 le falta autenticación en las carpetas que contienen fotografías de empleados, lo que permite a un atacante verlas mediante la enumeración de nombres de archivos. • https://codingkoala.eu/posts/CVE202230515 https://www.zkteco.me/software-5 • CWE-306: Missing Authentication for Critical Function •