CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 1CVE-2019-8423
https://notcve.org/view.php?id=CVE-2019-8423
ZoneMinder through 1.32.3 has SQL Injection via the skins/classic/views/events.php filter[Query][terms][0][cnj] parameter. ZoneMinder, hasta la versión 1.32.3, tiene una inyección SQL mediante el parámetro filter[Query][terms][0][cnj] en skins/classic/views/events.php. • https://github.com/LoRexxar/CVE_Request/tree/master/zoneminder%20vul%20before%20v1.32.3#skinsclassicviewseventsphp-line-44-sql-injection https://www.seebug.org/vuldb/ssvid-97761 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2019-8425
https://notcve.org/view.php?id=CVE-2019-8425
includes/database.php in ZoneMinder before 1.32.3 has XSS in the construction of SQL-ERR messages. includes/database.php en ZoneMinder, en versiones anteriores a la 1.32.3, tiene Cross-Site Scripting (XSS) en la construcción de mensajes SQL-ERR. • https://github.com/LoRexxar/CVE_Request/tree/master/zoneminder%20vul%20before%20v1.32.3#sql-query-error-reflected-xss https://www.seebug.org/vuldb/ssvid-97764 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2019-7336
https://notcve.org/view.php?id=CVE-2019-7336
Self - Stored Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3, as the view _monitor_filters.php contains takes in input from the user and saves it into the session, and retrieves it later (insecurely). The values of the MonitorName and Source parameters are being displayed without any output filtration being applied. This relates to the view=cycle value. Existe autocross-Site Scripting (XSS) persistente en ZoneMinder, hasta la versión 1.32.3, ya que view _monitor_filters.php contiene entradas del usuario y lo guarda en la sesión, recuperándola más adelante de forma insegura. Los valores de los parámetros MonitorName y Source se muestran sin que se les aplique ningún filtrado de salidas. • https://github.com/ZoneMinder/zoneminder/issues/2457 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.8EPSS: 0%CPEs: 1EXPL: 1CVE-2019-7345
https://notcve.org/view.php?id=CVE-2019-7345
Self - Stored Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3, as the view 'options' (options.php) does no input validation for the WEB_TITLE, HOME_URL, HOME_CONTENT, or WEB_CONSOLE_BANNER value, allowing an attacker to execute HTML or JavaScript code. This relates to functions.php. Existe autocross-Site Scripting (XSS) persistente en ZoneMinder, hasta la versión 1.32.3, ya que la vista "options" (options.php) no introduce validación para los valores WEB_TITLE, HOME_URL, HOME_CONTENT o WEB_CONSOLE_BANNER, lo que permite que un atacante ejecute código HTML o JavaScript. Esto está relacionado con functions.php. • https://github.com/ZoneMinder/zoneminder/issues/2468 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 1CVE-2019-7346
https://notcve.org/view.php?id=CVE-2019-7346
A CSRF check issue exists in ZoneMinder through 1.32.3 as whenever a CSRF check fails, a callback function is called displaying a "Try again" button, which allows resending the failed request, making the CSRF attack successful. Existe un problema de validación Cross-Site Request Forgery (CSRF) en ZoneMinder, hasta la versión 1.32.3, ya que cuando una comprobación CSRF fracasa, se llama a una función de rellamada que muestra un botón "Try again", que permite reenviar la petición fallida. Esto hace que el ataque CSRF tenga éxito. • https://github.com/ZoneMinder/zoneminder/issues/2469 • CWE-352: Cross-Site Request Forgery (CSRF) •