1626 matches found
CVE-2019-8428
CVE-2019-8428 affects ZoneMinder before 1.32.3. The vulnerability is a SQL Injection in the skins/classic/views/control.php file via the groupSql parameter (demonstrated by a newGroup[MonitorIds][] value). Impact is partial to data confidentiality, integrity, and availability with a network attac...
CVE-2019-8425
includes/database.php in ZoneMinder before 1.32.3 has XSS in the construction of SQL-ERR messages...
CVE-2019-8426
skins/classic/views/controlcap.php in ZoneMinder before 1.32.3 has XSS via the newControl array, as demonstrated by the newControlMinTiltRange parameter...
CVE-2019-8429
ZoneMinder before 1.32.3 has SQL Injection via the ajax/status.php filterQueryterms0cnj parameter...
CVE-2019-8423
ZoneMinder through 1.32.3 has SQL Injection via the skins/classic/views/events.php filterQueryterms0cnj parameter...
CVE-2019-8423
ZoneMinder through 1.32.3 has SQL Injection via the skins/classic/views/events.php filterQueryterms0cnj parameter...
CVE-2019-8424
CVE-2019-8424 affects ZoneMinder before 1.32.3. It is a SQL Injection via the ajax/status.php sort parameter, potentially enabling unauthenticated remote attackers to manipulate queries. CVSS v3 base score 9.8 (CRITICAL) / NETWORK, LOW complexity, no user interaction. Remediation: upgrade ZoneMin...
CVE-2019-8423
ZoneMinder through 1.32.3 has SQL Injection via the skins/classic/views/events.php filterQueryterms0cnj parameter...
CVE-2019-8425
includes/database.php in ZoneMinder before 1.32.3 has XSS in the construction of SQL-ERR messages...
CVE-2019-8426
skins/classic/views/controlcap.php in ZoneMinder before 1.32.3 has XSS via the newControl array, as demonstrated by the newControlMinTiltRange parameter...
CVE-2019-8427
daemonControl in includes/functions.php in ZoneMinder before 1.32.3 allows command injection via shell metacharacters...
CVE-2019-8428
ZoneMinder before 1.32.3 has SQL Injection via the skins/classic/views/control.php groupSql parameter, as demonstrated by a newGroupMonitorIds value...
CVE-2019-8429
ZoneMinder before 1.32.3 has SQL Injection via the ajax/status.php filterQueryterms0cnj parameter...
CVE-2019-8423
ZoneMinder through 1.32.3 has SQL Injection via the skins/classic/views/events.php filterQueryterms0cnj parameter...
CVE-2019-8424
ZoneMinder before 1.32.3 has SQL Injection via the ajax/status.php sort parameter...
CVE-2019-8424
ZoneMinder before 1.32.3 has SQL Injection via the ajax/status.php sort parameter...
CVE-2019-8429: Improper Neutralization of Special Elements used in an SQL Command
ZoneMinder before 1.32.3 has SQL Injection via the ajax/status.php filterQueryterms0cnj parameter...
CVE-2019-8428: Improper Neutralization of Special Elements used in an SQL Command
ZoneMinder before 1.32.3 has SQL Injection via the skins/classic/views/control.php groupSql parameter, as demonstrated by a newGroupMonitorIds value...
CVE-2019-8424: Improper Neutralization of Special Elements used in an SQL Command
ZoneMinder before 1.32.3 has SQL Injection via the ajax/status.php sort parameter...
CVE-2019-8427: Improper Neutralization of Special Elements used in an OS Command
daemonControl in includes/functions.php in ZoneMinder before 1.32.3 allows command injection via shell metacharacters...