Vulmon
Recent Vulnerabilities
Research Posts
Trends
Blog
About
Contact
Vulmon Alerts
By Relevance
By Risk Score
By Publish Date
zoneminder vulnerabilities and exploits
(subscribe to this query)
4.3
CVSSv2
CVE-2019-7341
Reflected - Cross Site Scripting (XSS) exists in ZoneMinder up to and including 1.32.3, allowing an malicious user to execute HTML or JavaScript code via a vulnerable 'newMonitor[LinkedMonitors]' parameter value in the view monitor (monitor.php) because proper filtratio...
Zoneminder Zoneminder
4.3
CVSSv2
CVE-2019-7342
POST - Cross Site Scripting (XSS) exists in ZoneMinder up to and including 1.32.3, allowing an malicious user to execute HTML or JavaScript code via a vulnerable 'filter[AutoExecuteCmd]' parameter value in the view filter (filter.php) because proper filtration is omitte...
Zoneminder Zoneminder
6
CVSSv2
CVE-2019-7347
A Time-of-check Time-of-use (TOCTOU) Race Condition exists in ZoneMinder up to and including 1.32.3 as a session remains active for an authenticated user even after deletion from the users table. This allows a nonexistent user to access and modify records (add/delete Monitors, Us...
Zoneminder Zoneminder
4.3
CVSSv2
CVE-2019-7348
Self - Stored Cross Site Scripting (XSS) exists in ZoneMinder up to and including 1.32.3, allowing an malicious user to execute HTML or JavaScript code via a vulnerable 'username' parameter value in the view user (user.php) because proper filtration is omitted.
Zoneminder Zoneminder
4.9
CVSSv2
CVE-2019-7350
Session fixation exists in ZoneMinder up to and including 1.32.3, as an attacker can fixate his own session cookies to the next logged-in user, thereby hijacking the victim's account. This occurs because a set of multiple cookies (between 3 and 5) is being generated when a u...
Zoneminder Zoneminder
4.3
CVSSv2
CVE-2019-7349
Reflected Cross Site Scripting (XSS) exists in ZoneMinder up to and including 1.32.3, allowing an malicious user to execute HTML or JavaScript code via a vulnerable 'newMonitor[V4LCapturesPerFrame]' parameter value in the view monitor (monitor.php) because proper filtra...
Zoneminder Zoneminder
4.3
CVSSv2
CVE-2019-7352
Self - Stored Cross Site Scripting (XSS) exists in ZoneMinder up to and including 1.32.3, as the view 'state' (aka Run State) (state.php) does no input validation to the value supplied to the 'New State' (aka newState) field, allowing an malicious user to exec...
Zoneminder Zoneminder
7.5
CVSSv2
CVE-2019-6991
A classic Stack-based buffer overflow exists in the zmLoadUser() function in zm_user.cpp of the zmu binary in ZoneMinder up to and including 1.32.3, allowing an unauthenticated malicious user to execute code via a long username.
Zoneminder Zoneminder
1 Github repository
2.1
CVSSv2
CVE-2017-5595
A file disclosure and inclusion vulnerability exists in web/views/file.php in ZoneMinder 1.x through v1.30.0 because of unfiltered user-input being passed to readfile(), which allows an authenticated malicious user to read local system files (e.g., /etc/passwd) in the context of ...
Zoneminder Zoneminder
4.3
CVSSv2
CVE-2016-10201
Cross-site scripting (XSS) vulnerability in Zoneminder 1.30 and previous versions allows remote malicious users to inject arbitrary web script or HTML via the format parameter in a download log request to index.php.
Zoneminder Zoneminder
CVSSv2
CVSSv2
CVSSv3
VMScore
Recommendations:
SSTI
CVE-2024-35863
CVE-2024-35910
man-in-the-middle
CVE-2024-35912
CVE-2024-25742
LFI
CVE-2024-32002
CVE-2024-22120
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started
« PREV
2
3
4
5
6
7
8
NEXT »