CVE-2013-0232

includes/functions.php in ZoneMinder Video Server 1.24.0, 1.25.0, and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the 1 runState parameter in the packageControl function; or 2 key or 3 command parameter in the setDeviceStatusX10 function...

PT-2013-2175

Name of the Vulnerable Software and Affected Versions ZoneMinder Video Server versions 1.24.0 and earlier ZoneMinder Video Server version 1.25.0 Description The issue allows remote attackers to execute arbitrary commands. This can be achieved via shell metacharacters in the runState parameter in...

CVE-2013-0232: Undefined Security Weakness

includes/functions.php in ZoneMinder Video Server 1.24.0, 1.25.0, and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the 1 runState parameter in the packageControl function; or 2 key or 3 command parameter in the setDeviceStatusX10 function...

PT-2013-2243

Name of the Vulnerable Software and Affected Versions ZoneMinder versions 1.24.x before 1.24.4 Description The issue allows remote attackers to read arbitrary files via a .. dot dot in the view, request, or action parameter. This can be exploited by including the .. dot dot sequence in the...

CVE-2013-0332: Improper Limitation of a Pathname to a Restricted Directory

Multiple directory traversal vulnerabilities in ZoneMinder 1.24.x before 1.24.4 allow remote attackers to read arbitrary files via a .. dot dot in the 1 view, 2 request, or 3 action parameter...

Debian DSA-2640-1 : zoneminder - several issues

Multiple vulnerabilities were discovered in zoneminder, a Linux video camera security and surveillance solution. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2013-0232 Brendan Coles discovered that zoneminder is prone to an arbitrary command execution...

[SECURITY] [DSA 2640-1] zoneminder security update

------------------------------------------------------------------------- Debian Security Advisory DSA-2640-1 [email protected] http://www.debian.org/security/ Salvatore Bonaccorso March 14, 2013 http://www.debian.org/security/faq -...

DSA-2640-1 zoneminder - several issues

Bulletin has no description...

Debian Security Advisory DSA 2640-1 (zoneminder - several issues)

Multiple vulnerabilities were discovered in zoneminder, a Linux video camera security and surveillance solution. The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2013-0232 Brendan Coles discovered that zoneminder is prone to an arbitrary command execution...

Debian: Security Advisory (DSA-2640-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

ZoneMinder Video Server packageControl Command Execution

This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/ require 'msf/core' class Metasploit3 'ZoneMinder Video...

ZoneMinder Video Server - packageControl Command Execution (Metasploit)

This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/ require 'msf/core' class Metasploit3 'ZoneMinder Video...

ZoneMinder Video Server packageControl Command Execution

Exploit for unix platform in category remote exploits This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/...

ZoneMinder Video Server packageControl Command Execution

This module exploits a command execution vulnerability in ZoneMinder Video Server version 1.24.0 to 1.25.0 which could be abused to allow authenticated users to execute arbitrary commands under the context of the web server user. The 'packageControl' function in the 'includes/actions.php' file...

airVisionNVR 1.1.13 - readfile() Disclosure SQL Injection

airVisionNVR 1.1.13 - readfile Disclosure SQL Injection Exploit Title: airVisionNVR readfile disclosure and sql injection Google Dork: Date: Oct 13, 2012 Exploit Author: pennyGrit Vendor Homepage: http://www.ubnt.com/ Software Link:...

ZoneMinder 1.24.3 Remote File Inclusion

Exploit Title: Zoneminder 1.24.3 Remote File Inclusion Vulnerability Date: 2011-07-22 Author: Iye iyedotcba-at-gmaildotcom Software Link: http://www.zoneminder.com/ Version: 1.24.3 Tested. 1.24.4 probably too, not tested Tested on: Ubuntu 10.04 You must be authenticated as a user in the Web App t...

ZoneMinder 1.24.3 - Remote File Inclusion

ZoneMinder 1.24.3 - Remote File Inclusion Exploit Title: Zoneminder 1.24.3 Remote File Inclusion Vulnerability Date: 2011-07-22 Author: Iye iyedotcba-at-gmaildotcom Software Link: http://www.zoneminder.com/ Version: 1.24.3 Tested. 1.24.4 probably too, not tested Tested on: Ubuntu 10.04 You must b...

Zoneminder 1.24.3 Remote File Inclusion Vulnerability

Exploit for php platform in category web applications Exploit Title: Zoneminder 1.24.3 Remote File Inclusion Vulnerability Author: Iye iyedotcba-at-gmaildotcom Software Link: http://www.zoneminder.com/ Version: 1.24.3 Tested. 1.24.4 probably too, not tested Tested on: Ubuntu 10.04 You must be...

ZoneMinder 1.24.3 - Remote File Inclusion

Exploit Title: Zoneminder 1.24.3 Remote File Inclusion Vulnerability Date: 2011-07-22 Author: Iye iyedotcba-at-gmaildotcom Software Link: http://www.zoneminder.com/ Version: 1.24.3 Tested. 1.24.4 probably too, not tested Tested on: Ubuntu 10.04 You must be authenticated as a user in the Web App t...

CVE-2008-6755

ZoneMinder 1.23.3 on Fedora 10 sets the ownership of /etc/zm.conf to the apache user account, and sets the permissions to 0600, which makes it easier for remote attackers to modify this file by accessing it through a 1 PHP or 2 CGI script...