UBUNTU-CVE-2016-10204

SQL injection vulnerability in Zoneminder 1.30 and earlier allows remote attackers to execute arbitrary SQL commands via the limit parameter in a log query request to index.php...

UBUNTU-CVE-2016-10201

Cross-site scripting XSS vulnerability in Zoneminder 1.30 and earlier allows remote attackers to inject arbitrary web script or HTML via the format parameter in a download log request to index.php...

CVE-2016-10205

Session fixation vulnerability in Zoneminder 1.30 and earlier allows remote attackers to hijack web sessions via the ZMSESSID cookie...

DEBIAN-CVE-2016-10205

Session fixation vulnerability in Zoneminder 1.30 and earlier allows remote attackers to hijack web sessions via the ZMSESSID cookie...

CVE-2016-10201

Cross-site scripting XSS vulnerability in Zoneminder 1.30 and earlier allows remote attackers to inject arbitrary web script or HTML via the format parameter in a download log request to index.php...

CVE-2016-10202

Cross-site scripting XSS vulnerability in Zoneminder 1.30 and earlier allows remote attackers to inject arbitrary web script or HTML via the path info to index.php...

CVE-2016-10201

Cross-site scripting XSS vulnerability in Zoneminder 1.30 and earlier allows remote attackers to inject arbitrary web script or HTML via the format parameter in a download log request to index.php...

CVE-2016-10205

Session fixation vulnerability in Zoneminder 1.30 and earlier allows remote attackers to hijack web sessions via the ZMSESSID cookie...

CVE-2016-10203

CVE-2016-10203 is an XSS in Zoneminder 1.30 and earlier. The vulnerability lets an attacker inject arbitrary web script or HTML via the name when creating a new monitor, potentially affecting users interacting with the web UI. Public entries repeatedly reference Zoneminder 1.30 and earlier as aff...

CVE-2016-10204

SQL injection vulnerability in Zoneminder 1.30 and earlier allows remote attackers to execute arbitrary SQL commands via the limit parameter in a log query request to index.php...

CVE-2016-10203

Cross-site scripting XSS vulnerability in Zoneminder 1.30 and earlier allows remote attackers to inject arbitrary web script or HTML via the name when creating a new monitor...

CVE-2016-10202

Cross-site scripting XSS vulnerability in Zoneminder 1.30 and earlier allows remote attackers to inject arbitrary web script or HTML via the path info to index.php...

CVE-2016-10205

CVE-2016-10205 affects ZoneMinder 1.30 and earlier, enabling session fixation via the ZMSESSID cookie and allowing remote attackers to hijack web sessions. Multiple connected advisories confirm ZoneMinder 1.30.x and earlier are vulnerable, with CCSS/impact noted as high. Remediation is through ve...

CVE-2016-10203

Cross-site scripting XSS vulnerability in Zoneminder 1.30 and earlier allows remote attackers to inject arbitrary web script or HTML via the name when creating a new monitor...

CVE-2016-10206

Cross-site request forgery CSRF vulnerability in Zoneminder 1.30 and earlier allows remote attackers to hijack the authentication of users for requests that change passwords and possibly have unspecified other impact as demonstrated by a crafted user action request to index.php...

CVE-2016-10205

Session fixation vulnerability in Zoneminder 1.30 and earlier allows remote attackers to hijack web sessions via the ZMSESSID cookie...

CVE-2016-10202

CVE-2016-10202 is a cross-site scripting (XSS) vulnerability in ZoneMinder 1.30 and earlier, exploitable by remote attackers via the path info parameter to index.php. Connected sources confirm ZoneMinder versions affected and describe the underlying issue as unfiltered or injectable input leading...

CVE-2016-10206

CVE-2016-10206 is a CSRF vulnerability in ZoneMinder v1.30 and earlier that allows remote attackers to hijack user authentication via crafted requests to index.php (e.g., changing passwords). The Mageia advisory notes mitigations (ENABLE_CSRF_MAGIC) and updated configurations; no explicit exploit...

CVE-2016-10204

CVE-2016-10204 is a SQL injection vulnerability in ZoneMinder 1.30 and earlier, allowing remote attackers to execute arbitrary SQL commands via the limit parameter in a log query request to index.php. A concrete PoC exploit exists (CVE-2016-10204_Webshell) demonstrating manual exploitation and PH...

CVE-2016-10206

Cross-site request forgery CSRF vulnerability in Zoneminder 1.30 and earlier allows remote attackers to hijack the authentication of users for requests that change passwords and possibly have unspecified other impact as demonstrated by a crafted user action request to index.php...