CVE-2019-8427

daemonControl in includes/functions.php in ZoneMinder before 1.32.3 allows command injection via shell metacharacters...

CVE-2019-8428

ZoneMinder before 1.32.3 has SQL Injection via the skins/classic/views/control.php groupSql parameter, as demonstrated by a newGroupMonitorIds value...

CVE-2019-8429

ZoneMinder before 1.32.3 has SQL Injection via the ajax/status.php filterQueryterms0cnj parameter...

DEBIAN-CVE-2019-8424

ZoneMinder before 1.32.3 has SQL Injection via the ajax/status.php sort parameter...

Sql injection

ZoneMinder before 1.32.3 has SQL Injection via the ajax/status.php filterQueryterms0cnj parameter...

CVE-2019-8426

skins/classic/views/controlcap.php in ZoneMinder before 1.32.3 has XSS via the newControl array, as demonstrated by the newControlMinTiltRange parameter...

CVE-2019-8429

ZoneMinder before 1.32.3 has SQL Injection via the ajax/status.php filterQueryterms0cnj parameter...

UBUNTU-CVE-2019-8424

ZoneMinder before 1.32.3 has SQL Injection via the ajax/status.php sort parameter...

CVE-2019-8428

ZoneMinder before 1.32.3 has SQL Injection via the skins/classic/views/control.php groupSql parameter, as demonstrated by a newGroupMonitorIds value...

CVE-2019-8428

ZoneMinder before 1.32.3 has SQL Injection via the skins/classic/views/control.php groupSql parameter, as demonstrated by a newGroupMonitorIds value...

CVE-2019-8429

ZoneMinder before 1.32.3 has SQL Injection via the ajax/status.php filterQueryterms0cnj parameter...

CVE-2019-8426

ZoneMinder before 1.32.3 is affected by a cross-site scripting (XSS) vulnerability in skins/classic/views/controlcap.php via the newControl array, demonstrated by newControl[MinTiltRange]. Exploitation would occur in the browser of a user who visits a page that processes this parameter. The issue...

CVE-2019-8427

ZoneMinder contains a command-injection flaw in daemonControl (includes/functions.php) exploitable via shell metacharacters. Affected versions are prior to 1.32.3. The CVE entry (CVE-2019-8427) is supported by multiple sources indicating the vulnerability resides in ZoneMinder before 1.32.3, enab...

CVE-2019-8429

Vulnerability summary (CVE-2019-8429) ZoneMinder pre-1.32.3 is affected by an SQL Injection in ajax/status.php via the filter[Query][terms][0][cnj] parameter. The issue, documented across multiple sources, allows database commands to be injected and isSeverity-mapping indicates high risk (NVD CVS...

CVE-2019-8425

ZoneMinder contains a cross-site scripting (XSS) vulnerability in the SQL-ERR message construction within includes/database.php for versions prior to 1.32.3. The issue arises from how error messages are generated, allowing injected script in the browser of an affected user. Affected product: Zone...

PT-2019-19025

Name of the Vulnerable Software and Affected Versions ZoneMinder versions prior to 1.32.4 Description The issue allows for SQL Injection via the skins/classic/views/events.php endpoint, specifically through the filterQueryterms0cnj parameter. Recommendations For ZoneMinder versions prior to 1.32....

CVE-2019-8424

CVE-2019-8424 affects ZoneMinder before 1.32.3. It is a SQL Injection via the ajax/status.php sort parameter, potentially enabling unauthenticated remote attackers to manipulate queries. CVSS v3 base score 9.8 (CRITICAL) / NETWORK, LOW complexity, no user interaction. Remediation: upgrade ZoneMin...

CVE-2019-8423

ZoneMinder through 1.32.3 has SQL Injection via the skins/classic/views/events.php filterQueryterms0cnj parameter...

CVE-2019-8424

ZoneMinder before 1.32.3 has SQL Injection via the ajax/status.php sort parameter...

CVE-2019-8429: Improper Neutralization of Special Elements used in an SQL Command

ZoneMinder before 1.32.3 has SQL Injection via the ajax/status.php filterQueryterms0cnj parameter...