CVE-2016-10201

ZoneMinder 1.30 and earlier is affected by CVE-2016-10201, a Cross-site Scripting (XSS) flaw that allows remote attackers to inject arbitrary web script or HTML via the format parameter in a download log request to index.php. The issue is confirmed across multiple vulnerability feeds (OSV/NVD) an...

CVE-2016-10204

SQL injection vulnerability in Zoneminder 1.30 and earlier allows remote attackers to execute arbitrary SQL commands via the limit parameter in a log query request to index.php...

Fedora 24 : zoneminder (2017-d5fb74cd2e)

Security fix for CVE-2017-5595 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. %NASLMINLEVEL 70300...

Fedora 25 : zoneminder (2017-2bb174ae3c)

Security fix for CVE-2017-5595 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. %NASLMINLEVEL 70300...

Fedora Update for zoneminder FEDORA-2017-d5fb74cd2e

The remote host is missing an update for the SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora Update for zoneminder FEDORA-2017-2bb174ae3c

The remote host is missing an update for the SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] Fedora 24 Update: zoneminder-1.28.1-8.fc24

ZoneMinder is a set of applications which is intended to provide a complete solution allowing you to capture, analyse, record and monitor any cameras y ou have attached to a Linux based machine. It is designed to run on kernels wh ich support the Video For Linux V4L interface and has been tested...

[SECURITY] Fedora 25 Update: zoneminder-1.28.1-8.fc25

ZoneMinder is a set of applications which is intended to provide a complete solution allowing you to capture, analyse, record and monitor any cameras y ou have attached to a Linux based machine. It is designed to run on kernels wh ich support the Video For Linux V4L interface and has been tested...

Multiple Cross-Site Scripting Vulnerabilities in ZoneMinder

ZoneMinder is a security monitoring software for cameras. ZoneMinder suffers from multiple cross-site scripting vulnerabilities that allow an attacker to remotely execute malicious scripts in the browser of an authenticated client...

ZoneMinder 'web/views/file.php' local file inclusion vulnerability

Zoneminder is an open source web application on a centralized server that, in versions 1.0-1.30.0, allows authenticated attackers to read the local file system e.g., /etc/passwd...

ZoneMinder Cross-Site Request Forgery Vulnerability

ZoneMinder is a security monitoring software for cameras. ZoneMinder suffers from a cross-site script request forgery vulnerability that stems from a failed CSRF protection. An attacker could use this vulnerability to perform unauthorized operations to access the affected application...

CVE-2017-5595

A file disclosure and inclusion vulnerability exists in web/views/file.php in ZoneMinder 1.x through v1.30.0 because of unfiltered user-input being passed to readfile, which allows an authenticated attacker to read local system files e.g., /etc/passwd in the context of the web server user www-dat...

CVE-2017-5368

ZoneMinder v1.30 and v1.29, an open-source CCTV server web application, is vulnerable to CSRF Cross Site Request Forgery which allows a remote attack to make changes to the web application as the current logged in victim. If the victim visits a malicious web page, the attacker can silently and...

CVE-2017-5595

A file disclosure and inclusion vulnerability exists in web/views/file.php in ZoneMinder 1.x through v1.30.0 because of unfiltered user-input being passed to readfile, which allows an authenticated attacker to read local system files e.g., /etc/passwd in the context of the web server user www-dat...

CVE-2017-5595

A file disclosure and inclusion vulnerability exists in web/views/file.php in ZoneMinder 1.x through v1.30.0 because of unfiltered user-input being passed to readfile, which allows an authenticated attacker to read local system files e.g., /etc/passwd in the context of the web server user www-dat...

CVE-2017-5367

Multiple reflected XSS vulnerabilities exist within form and link input parameters of ZoneMinder v1.30 and v1.29, an open-source CCTV server web application, which allows a remote attacker to execute malicious scripts within an authenticated client's browser. The URL is /zm/index.php and sample...

UBUNTU-CVE-2017-5595

A file disclosure and inclusion vulnerability exists in web/views/file.php in ZoneMinder 1.x through v1.30.0 because of unfiltered user-input being passed to readfile, which allows an authenticated attacker to read local system files e.g., /etc/passwd in the context of the web server user www-dat...

Cross site request forgery (csrf)

ZoneMinder v1.30 and v1.29, an open-source CCTV server web application, is vulnerable to CSRF Cross Site Request Forgery which allows a remote attack to make changes to the web application as the current logged in victim. If the victim visits a malicious web page, the attacker can silently and...

CVE-2017-5367

Multiple reflected XSS vulnerabilities exist within form and link input parameters of ZoneMinder v1.30 and v1.29, an open-source CCTV server web application, which allows a remote attacker to execute malicious scripts within an authenticated client's browser. The URL is /zm/index.php and sample...

Arbitrary file deletion

A file disclosure and inclusion vulnerability exists in web/views/file.php in ZoneMinder 1.x through v1.30.0 because of unfiltered user-input being passed to readfile, which allows an authenticated attacker to read local system files e.g., /etc/passwd in the context of the web server user www-dat...