ZKTeco

Related CVEsby mentions

• CVE-2024-280009.868%
  Incorrect Privilege Assignment vulnerability in LiteSpeed Technologies LiteSpeed Cache litespeed-cache.This issue affects LiteSpeed Cache:
  Incorrect Privilege Assignment vulnerability in LiteSpeed Technologies LiteSpeed Cache litespeed-cache.This issue affects LiteSpeed Cache: from n/a through <= 6.3.0.1.
  · litespeedtech litespeed cache—
• CVE-2023-491059.843%
  Improper Authentication in ownCloud Server Allows Unauthenticated File Access
  ownCloud Server versions from 10.6.0 up to (but not including) 10.13.1 accept WebDAV pre-signed URLs even when no signing key is configured for the file owner, an improper authentication flaw (CWE-287). A remote attacker who knows a victim's username can therefore access, modify, or delete that user's files without any credentials, with no privileges or user interaction required (CVSS 9.8). Any organization running a self-hosted ownCloud Server instance in the affected version range is exposed, especially internet-facing deployments. CISA added the flaw to its Known Exploited Vulnerabilities catalog on 2026-08-27, confirming exploitation in the wild, and EPSS assigns a 43.2% probability of exploitation within 30 days (99th percentile). No public proof-of-concept code is known, but recent press reports of attacks against ownCloud (including theft of records at a Philippine research body) indicate active targeting of ownCloud flaws.
  · ownCloud Server (owncloud/core) 10.6.0 through all versions before 10.13.1; fixed in 10.13.1 KEVlarge
• CVE-2026-533627.8<1%
  Out-of-Bounds Write in Linux Kernel IPv6 Stack via UDPv6 MSG_SPLICE_PAGES
  CVE-2026-53362 is an out-of-bounds write (CWE-787) in the Linux kernel's IPv6 output path: __ip6_append_data() mis-accounts fraggap bytes on the paged-allocation branch, leaving the new skb's linear area undersized so the copy of carried-over fragment-gap data spills past skb->end into the trailing skb_shared_info. An unprivileged local user can trigger the corruption by sending over a UDPv6 socket using MSG_MORE combined with MSG_SPLICE_PAGES; the bad accounting was introduced by commit 773ba4fe9104 ('ipv6: avoid partial copy for zc') and became triggerable when commit ce650a166335 allowed the MSG_SPLICE_PAGES case to proceed instead of returning -EINVAL. Successful triggering causes kernel memory corruption that, per the high confidentiality/integrity/availability scores, can lead to loss of data confidentiality, integrity and availability — potentially local privilege escalation or a system crash. Any Linux system running a kernel with the affected code is exposed; the source data provides no specific affected version numbers, only the introducing and trigger commits. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2026-08-27, indicating known in-the-wild exploitation (ransomware use unknown), with EPSS at 0.5% and no public PoC known.
  · Linux kernel KEVmass
• CVE-2023-491037.578%
  Unauthenticated phpinfo credential leak in ownCloud graphapi
  CVE-2023-49103 is an unauthenticated information disclosure flaw in ownCloud's graphapi app (0.2.x before 0.2.1 and 0.3.x before 0.3.1), which ships a third-party GetPhpInfo.php page that returns the full PHP phpinfo output when its URL is requested. An attacker with no credentials or user interaction simply accesses that URL over the network, and the phpinfo output reveals all of the webserver's environment variables plus other potentially sensitive configuration details. In containerized deployments these environment variables frequently include the ownCloud admin password, mail server credentials, and license key, giving attackers direct credentials for the server; notably, disabling the graphapi app does not remove the exposed file. Affected deployments are ownCloud installations running the vulnerable graphapi versions, especially ownCloud Docker images built after February 2023, while containers built before February 2023 are not vulnerable to the credential disclosure. Exploitation is confirmed in the wild: CISA added it to the Known Exploited Vulnerabilities catalog on 2023-11-30, the EPSS score is 78.4% (top percentile), and public reporting says threat actors have begun exploiting the flaw, though no public PoC is known.
  · ownCloud graphapi (graphapi app) 0.2.x before 0.2.1; 0.3.x before 0.3.1 KEVlarge
• CVE-2026-663845.3<1%
  Authenticated Path Traversal Write in JFrog Artifactory Exploited in the Wild
  CVE-2026-66384 is a directory/path-restriction bypass (CWE-22) in JFrog Artifactory in which an authenticated user can write data outside the intended Docker cache path when specific remote-repository conditions are met. The attack is carried out over the network using valid low-privilege credentials and requires no user interaction, but the triggering conditions are specific enough that the CVSS vector rates exploit complexity as high. A successful attacker gains unauthorized modification of files outside the cache directory (integrity impact only per the CVSS vector, with no confidentiality or availability impact scored), potentially tampering with stored content or system files depending on the deployment. Any organization running JFrog Artifactory with Docker remote repositories is potentially affected. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2026-08-27, confirming exploitation in the wild; no public proof-of-concept is known and ransomware use is not confirmed.
  · JFrog Artifactory KEVlarge

Appears with