CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 2CVE-2016-10206
https://notcve.org/view.php?id=CVE-2016-10206
03 Mar 2017 — Cross-site request forgery (CSRF) vulnerability in Zoneminder 1.30 and earlier allows remote attackers to hijack the authentication of users for requests that change passwords and possibly have unspecified other impact as demonstrated by a crafted user action request to index.php. Vulnerabilidad de CSRF en Zoneminder 1.30 y versiones anteriores permite a atacantes remotos secuestrar la autenticación de usuarios para solicitudes que cambian contraseñas y posiblemente tener otro impacto no especificado como s... • http://www.openwall.com/lists/oss-security/2017/02/05/1 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 2CVE-2016-10202
https://notcve.org/view.php?id=CVE-2016-10202
03 Mar 2017 — Cross-site scripting (XSS) vulnerability in Zoneminder 1.30 and earlier allows remote attackers to inject arbitrary web script or HTML via the path info to index.php. Vulnerabilidad de XSS en Zoneminder 1.30 y versiones anteriores permite a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a través de la ruta info a index.php. • http://www.openwall.com/lists/oss-security/2017/02/05/1 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 2CVE-2016-10201
https://notcve.org/view.php?id=CVE-2016-10201
03 Mar 2017 — Cross-site scripting (XSS) vulnerability in Zoneminder 1.30 and earlier allows remote attackers to inject arbitrary web script or HTML via the format parameter in a download log request to index.php. Vulnerabilidad de XSS en Zoneminder 1.30 y versiones anteriores permite a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a través del parámetro de formato en una solicitud de registro de descarga a index.php. • http://www.openwall.com/lists/oss-security/2017/02/05/1 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 2CVE-2016-10205
https://notcve.org/view.php?id=CVE-2016-10205
03 Mar 2017 — Session fixation vulnerability in Zoneminder 1.30 and earlier allows remote attackers to hijack web sessions via the ZMSESSID cookie. Vulnerabilidad de reparación de sesión en Zoneminder 1.30 y versiones anteriores permite a atacantes remotos secuestrar sesiones web a través de la cookie ZMSESSID. • http://www.openwall.com/lists/oss-security/2017/02/05/1 • CWE-384: Session Fixation •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 2CVE-2016-10203
https://notcve.org/view.php?id=CVE-2016-10203
03 Mar 2017 — Cross-site scripting (XSS) vulnerability in Zoneminder 1.30 and earlier allows remote attackers to inject arbitrary web script or HTML via the name when creating a new monitor. Vulnerabilidad de XSS en Zoneminder 1.30 y versiones anteriores permite a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a través del nombre al crear un nuevo monitor. • http://www.openwall.com/lists/oss-security/2017/02/05/1 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 1CVE-2017-5595 – ZoneMinder XSS / CSRF / File Disclosure / Authentication Bypass
https://notcve.org/view.php?id=CVE-2017-5595
06 Feb 2017 — A file disclosure and inclusion vulnerability exists in web/views/file.php in ZoneMinder 1.x through v1.30.0 because of unfiltered user-input being passed to readfile(), which allows an authenticated attacker to read local system files (e.g., /etc/passwd) in the context of the web server user (www-data). The attack vector is a .. (dot dot) in the path parameter within a zm/index.php?view=file&path= request. Existe una vulnerabilidad de divulgación e inclusión de archivos en web/views/file.php en ZoneMinder ... • https://packetstorm.news/files/id/140927 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 9.8EPSS: 0%CPEs: 37EXPL: 0CVE-2008-3880
https://notcve.org/view.php?id=CVE-2008-3880
02 Sep 2008 — SQL injection vulnerability in zm_html_view_event.php in ZoneMinder 1.23.3 and earlier allows remote attackers to execute arbitrary SQL commands via the filter array parameter. Vulnerabilidad de inyección SQL en zm_html_view_event.php de ZoneMinder 1.23.3 y anteriores, permite a atacantes remotos ejecutar comandos SQL de su elección a través del parámetro filter del array. • http://secunia.com/advisories/31636 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 6.1EPSS: 0%CPEs: 37EXPL: 0CVE-2008-3881
https://notcve.org/view.php?id=CVE-2008-3881
02 Sep 2008 — Multiple cross-site scripting (XSS) vulnerabilities in ZoneMinder 1.23.3 and earlier allow remote attackers to inject arbitrary web script or HTML via unspecified "zm_html_view_*.php" files. Múltiples vulnerabilidades de tipo cross-site scripting (XSS) en ZoneMinder versión 1.23.3 y anteriores, permiten a atacantes remotos inyectar script web o HTML arbitrario por medio de archivos "zm_html_view_*.php" no especificados. • http://secunia.com/advisories/31636 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 10.0EPSS: 4%CPEs: 37EXPL: 0CVE-2008-3882
https://notcve.org/view.php?id=CVE-2008-3882
02 Sep 2008 — Unspecified "Command Injection" vulnerability in ZoneMinder 1.23.3 and earlier allows remote attackers to execute arbitrary commands via (1) the executeFilter function in zm_html_view_events.php and (2) the run_state parameter to zm_html_view_state.php. Una vulnerabilidad de "Command Injection" no especificada en ZoneMinder versión 1.23.3 y anteriores, permite a atacantes remotos ejecutar comandos arbitrarios por medio de (1) la función executeFilter en el archivo zm_html_view_events.php y (2) el parámetro ... • http://secunia.com/advisories/31636 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 9.8EPSS: 1%CPEs: 36EXPL: 0CVE-2008-1381
https://notcve.org/view.php?id=CVE-2008-1381
01 May 2008 — ZoneMinder before 1.23.3 allows remote authenticated users, and possibly unauthenticated attackers in some installations, to execute arbitrary commands via shell metacharacters in a crafted URL. ZoneMinder anterior a la 1.23.3 permite a usuarios remotos autenticados, y posiblemente sin autenticar, ataques en algunas instalaciones, ejecutar comandos arbitrarios a través de metacaracteres shell en una URL manipulada. • http://secunia.com/advisories/29995 • CWE-94: Improper Control of Generation of Code ('Code Injection') •