Zkteco Zktime Web
4 CVEs affecting Zkteco Zktime Web. Latest disclosed: 2017-12-04. Critical: 0, High: 3.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2017-17056 | High | 8.8 | 2017-12-04 | The ZKTime Web Software 2.0.1.12280 allows the Administrator to elevate the privileges of the application user using a 'password_change()' function of the Modi… |
CVE-2017-13129 | High | 8.0 | 2017-09-26 | Cross-site request forgery (CSRF) vulnerability in ZKTeco ZKTime Web 2.0.1.12280 allows remote authenticated users to hijack the authentication of administrato… |
CVE-2017-14680 | High | 7.5 | 2017-09-21 | ZKTeco ZKTime Web 2.0.1.12280 allows remote attackers to obtain sensitive employee metadata via a direct request for a PDF document. |
CVE-2017-17057 | Medium | 6.1 | 2017-12-04 | There is a reflected XSS vulnerability in ZKTime Web 2.0.1.12280. The vulnerability exists due to insufficient filtration of user-supplied data in the 'Range'… |