CVE-2019-7341

Reflected - Cross Site Scripting XSS exists in ZoneMinder through 1.32.3, allowing an attacker to execute HTML or JavaScript code via a vulnerable 'newMonitorLinkedMonitors' parameter value in the view monitor monitor.php because proper filtration is omitted...

PT-2019-18554

Name of the Vulnerable Software and Affected Versions ZoneMinder versions prior to 1.33 Description A Reflected Cross Site Scripting issue exists, allowing an attacker to execute HTML or JavaScript code via a vulnerable newMonitorV4LCapturesPerFrame parameter value in the "view monitor" page,...

CVE-2019-7347: Time-of-check Time-of-use (TOCTOU) Race Condition

A Time-of-check Time-of-use TOCTOU Race Condition exists in ZoneMinder through 1.32.3 as a session remains active for an authenticated user even after deletion from the users table. This allows a nonexistent user to access and modify records add/delete Monitors, Users, etc...

PT-2019-18539

Name of the Vulnerable Software and Affected Versions ZoneMinder versions prior to 1.32.4 Description A Reflected Cross Site Scripting issue exists, allowing an attacker to execute HTML or JavaScript code via a vulnerable Exportfile parameter value in the "view export" functionality, specifically...

PT-2019-18556

Name of the Vulnerable Software and Affected Versions ZoneMinder versions prior to 1.32.4 Description The issue allows an attacker to inject custom log messages into the system by enticing a victim to visit a specially crafted link. This is demonstrated through the message variable, where an...

PT-2019-18555

Name of the Vulnerable Software and Affected Versions ZoneMinder versions prior to 1.32.3 Description The issue allows an attacker to fixate their own session cookies to the next logged-in user, resulting in the hijacking of the victim's account. This happens because multiple cookies are generate...

PT-2019-18551

Name of the Vulnerable Software and Affected Versions ZoneMinder versions prior to 1.32.4 Description A CSRF check issue exists, allowing a CSRF attack to be successful. Whenever a CSRF check fails, a callback function is called, displaying a "Try again" button. This button allows resending the...

PT-2019-18548

Name of the Vulnerable Software and Affected Versions ZoneMinder versions prior to 1.32.4 Description A Reflected Cross Site Scripting XSS issue exists, allowing an attacker to execute HTML or JavaScript code via a vulnerable newMonitorMethod parameter value in the "view monitor" page, specifical...

PT-2019-18552

Name of the Vulnerable Software and Affected Versions ZoneMinder versions prior to 1.32.4 Description A Time-of-check Time-of-use TOCTOU Race Condition issue exists, allowing a nonexistent user to access and modify records, such as adding or deleting Monitors and Users, because a session remains...

PT-2019-18549

Name of the Vulnerable Software and Affected Versions ZoneMinder versions prior to 1.32.4 Description A reflected XSS issue exists, allowing an attacker to execute HTML or JavaScript code in the 'filter' view. This occurs because the filterName value is insecurely printed on the web page without...

PT-2019-18543

Name of the Vulnerable Software and Affected Versions ZoneMinder versions prior to 1.32.4 Description A Self-Stored XSS issue exists, allowing an attacker to execute HTML or JavaScript code in the 'group' view. This occurs because the 'Group Name' value is printed on the web page without proper...

PT-2019-18547

Name of the Vulnerable Software and Affected Versions ZoneMinder versions prior to 1.32.4 Description A Cross Site Scripting XSS issue exists, allowing an attacker to execute HTML or JavaScript code via a vulnerable filterAutoExecuteCmd parameter value in the view filter filter.php because proper...

PT-2019-18541

Name of the Vulnerable Software and Affected Versions ZoneMinder versions prior to 1.32.4 Description A Self-Stored Cross Site Scripting XSS issue exists, where user input is saved into the session and retrieved later without proper output filtration. Specifically, the values of the MonitorName a...

PT-2019-18540

Name of the Vulnerable Software and Affected Versions ZoneMinder versions prior to 1.32.4 Description A Self-Stored XSS issue exists, allowing an attacker to execute HTML or JavaScript code in the 'log' view. This occurs because the 'Log Message' value is insecurely printed on the web page withou...

PT-2019-18550

Name of the Vulnerable Software and Affected Versions ZoneMinder versions prior to 1.33 Description A Self-Stored Cross Site Scripting XSS issue exists due to the lack of input validation for the WEB TITLE, HOME URL, HOME CONTENT, or WEB CONSOLE BANNER values in the 'options' view options.php,...

PT-2019-18538

Name of the Vulnerable Software and Affected Versions ZoneMinder versions prior to 1.32.4 Description A Reflected Cross Site Scripting issue exists, allowing an attacker to execute HTML or JavaScript code via a vulnerable Exportfile parameter value in the "view download" download.php due to omitt...

PT-2019-18557

Name of the Vulnerable Software and Affected Versions ZoneMinder versions prior to 1.32.4 Description A Self-Stored Cross Site Scripting XSS issue exists due to the lack of input validation in the 'New State' field, allowing an attacker to execute HTML or JavaScript code. Recommendations For...

PT-2019-18545

Name of the Vulnerable Software and Affected Versions ZoneMinder versions prior to 1.32.4 Description A Cross Site Scripting XSS issue exists, allowing an attacker to execute HTML or JavaScript code via a vulnerable filterQueryterms0val parameter value in the "view filter" filter.php because prop...

PT-2019-18542

Name of the Vulnerable Software and Affected Versions ZoneMinder versions prior to 1.32.4 Description A Reflected Cross Site Scripting XSS issue exists due to the insecure display of the limit parameter value in the 'events' view events.php without proper output filtration. This is caused by the...

CVE-2019-7342: Improper Neutralization of Input During Web Page Generation

POST - Cross Site Scripting XSS exists in ZoneMinder through 1.32.3, allowing an attacker to execute HTML or JavaScript code via a vulnerable 'filterAutoExecuteCmd' parameter value in the view filter filter.php because proper filtration is omitted...