NVD disclosure day
CVE-2023-38951
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
ZKTeco BioTime software, used for workforce management, contains a vulnerability that allows authenticated attackers to create or overwrite arbitrary server files via crafted requests. This could lead to the execution of malicious code with system privileges. Organizations using this software should confirm its presenc
CVE-2023-38950
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A path traversal vulnerability in ZKTeco BioTime's iclock API allows unauthenticated attackers to read arbitrary files. This impacts organizations using the affected software by potentially exposing sensitive data. The business risk involves unauthorized access to system files.
CVE-2023-35081
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
An authenticated administrator can write arbitrary files to the Ivanti EPMM appliance via a path traversal vulnerability. This could impact system integrity and data confidentiality for affected organizations.
CVE-2023-37679
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A critical remote command execution vulnerability in NextGen Mirth Connect allows attackers to run arbitrary commands on the hosting server. This could potentially impact the integrity and availability of the server and connected systems if reachable via the network.
CVE-2023-38954
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A SQL injection vulnerability exists in ZKTeco BioAccess IVS, a system for access control and time attendance. Attackers could exploit this flaw via the network to gain unauthorized access to sensitive information or compromise the system. This could impact security operations.
CVE-2023-36082
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A vulnerability in GatesAir Flexiva FM transmitter equipment allows unauthenticated remote attackers to gain elevated privileges by exploiting exposed LDAP and SMTP credentials. This could impact the confidentiality, integrity, and availability of the affected system, posing a risk to broadcast infrastructure.