CVE-2019-7350

Session fixation exists in ZoneMinder through 1.32.3, as an attacker can fixate his own session cookies to the next logged-in user, thereby hijacking the victim's account. This occurs because a set of multiple cookies between 3 and 5 is being generated when a user successfully logs in, and these...

CVE-2019-7351

Log Injection exists in ZoneMinder through 1.32.3, as an attacker can entice the victim to visit a specially crafted link, which in turn will inject a custom Log message provided by the attacker in the 'log' view page, as demonstrated by the message=User%20'admin'%20Logged%20in value...

CVE-2019-7352

Self - Stored Cross Site Scripting XSS exists in ZoneMinder through 1.32.3, as the view 'state' aka Run State state.php does no input validation to the value supplied to the 'New State' aka newState field, allowing an attacker to execute HTML or JavaScript code...

CVE-2019-7347

A Time-of-check Time-of-use TOCTOU Race Condition exists in ZoneMinder through 1.32.3 as a session remains active for an authenticated user even after deletion from the users table. This allows a nonexistent user to access and modify records add/delete Monitors, Users, etc...

CVE-2019-7325

CVE-2019-7325 describes a Reflected XSS in ZoneMinder up to version 1.32.3, caused by insecure handling of $_REQUEST['PHP_SELF'] in multiple web/skins/classic/views. The issue allows an attacker to inject scripts via crafted URLs and affects web interfaces that do not filter input. Connected docu...

CVE-2019-7345

Self - Stored Cross Site Scripting XSS exists in ZoneMinder through 1.32.3, as the view 'options' options.php does no input validation for the WEBTITLE, HOMEURL, HOMECONTENT, or WEBCONSOLEBANNER value, allowing an attacker to execute HTML or JavaScript code. This relates to functions.php...

CVE-2019-7332

Reflected Cross Site Scripting XSS exists in ZoneMinder through 1.32.3, allowing an attacker to execute HTML or JavaScript code via a vulnerable 'eid' aka Event ID parameter value in the view download download.php because proper filtration is omitted...

CVE-2019-7341

Reflected - Cross Site Scripting XSS exists in ZoneMinder through 1.32.3, allowing an attacker to execute HTML or JavaScript code via a vulnerable 'newMonitorLinkedMonitors' parameter value in the view monitor monitor.php because proper filtration is omitted...

CVE-2019-7343

CVE-2019-7343 affects ZoneMinder up to version 1.32.3. The vulnerability is a reflected XSS where an attacker can inject HTML/JavaScript via the vulnerable parameter newMonitor[Method] in the view monitor page (monitor.php) due to improper input filtration. Impact is execution of script in a vict...

CVE-2019-7336

This CVE refers to ZoneMinder (up to v1.32.3). The vulnerability is a Self‑Stored Cross‑Site Scripting (XSS) in the view_monitor_filters.php flow, where user input is stored in the session and later displayed without output filtration. The affected parameters include MonitorName and Source, relat...

CVE-2019-7339

CVE-2019-7339 is a ZoneMinder XSS vulnerability: ZoneMinder versions up to 1.32.3 allow remote execution of HTML/JavaScript via the vulnerable level parameter in log.php due to incomplete input filtration. The connected documents confirm the affected product (ZoneMinder), the vulnerable component...

CVE-2019-7326

CVE-2019-7326 is a stored XSS vulnerability in ZoneMinder up to version 1.32.3. An attacker can inject HTML/JavaScript via the Host parameter value in the monitor view’s console (console.php) due to insufficient input filtration in the index.php?view=monitor Host Name field. Public sources connec...

CVE-2019-7349

CVE-2019-7349 affects ZoneMinder (up to and including 1.32.3). The vulnerability is a reflected Cross-Site Scripting (XSS) in the view_monitor code path, exploitable via the vulnerable parameter newMonitor[V4LCapturesPerFrame] in monitor.php due to insufficient input filtration. Successful exploi...

CVE-2019-7348

ZoneMinder

CVE-2019-7334

ZoneMinder up to version 1.32.3 is affected by a Reflected XSS vulnerability in the view export (export.php) via the vulnerable Exportfile parameter, caused by insufficient input filtration. This allows an attacker to inject and execute HTML/JavaScript in the victim’s browser. The available docum...

CVE-2019-7351

CVE-2019-7351 affects ZoneMinder up to version 1.32.3. A crafted link can trigger log injection in the web interface by injecting a custom log message through the attacker-controlled input (e.g., log view page and a value like message=User 'admin' Logged in). The vulnerability description does no...

CVE-2019-7335

ZoneMinder CVE-2019-7335 is a Self-Stored XSS vulnerability affecting ZoneMinder up to version 1.32.3. The issue arises from insecurely printing the Log Message value in the logs view (view=logs), enabling HTML/JavaScript execution in the page. Connected sources corroborate the vulnerability in Z...

CVE-2019-7329

CVE-2019-7329 is a reflected XSS in ZoneMinder up to version 1.32.3. The vulnerability arises because several form actions use $_SERVER['PHP_SELF'] without proper input filtration, allowing arbitrary input appended to the webroot URL to be reflected in the page. The connected OpenVAS and OSV entr...

CVE-2019-7339

POST - Cross Site Scripting XSS exists in ZoneMinder through 1.32.3, allowing an attacker to execute HTML or JavaScript code via a vulnerable 'level' parameter value in the view log log.php because proper filtration is omitted...

CVE-2019-7350

Session fixation exists in ZoneMinder through 1.32.3, as an attacker can fixate his own session cookies to the next logged-in user, thereby hijacking the victim's account. This occurs because a set of multiple cookies between 3 and 5 is being generated when a user successfully logs in, and these...