Vulnerabilities > Zoneminder

DATE CVE VULNERABILITY TITLE RISK
2017-03-03 CVE-2016-10205 Session Fixation vulnerability in Zoneminder
Session fixation vulnerability in Zoneminder 1.30 and earlier allows remote attackers to hijack web sessions via the ZMSESSID cookie.
network
low complexity
zoneminder CWE-384
7.5
2017-03-03 CVE-2016-10204 SQL Injection vulnerability in Zoneminder
SQL injection vulnerability in Zoneminder 1.30 and earlier allows remote attackers to execute arbitrary SQL commands via the limit parameter in a log query request to index.php.
network
low complexity
zoneminder CWE-89
7.5
2017-03-03 CVE-2016-10203 Cross-site Scripting vulnerability in Zoneminder
Cross-site scripting (XSS) vulnerability in Zoneminder 1.30 and earlier allows remote attackers to inject arbitrary web script or HTML via the name when creating a new monitor.
network
zoneminder CWE-79
4.3
2017-03-03 CVE-2016-10202 Cross-site Scripting vulnerability in Zoneminder
Cross-site scripting (XSS) vulnerability in Zoneminder 1.30 and earlier allows remote attackers to inject arbitrary web script or HTML via the path info to index.php.
network
zoneminder CWE-79
4.3
2017-03-03 CVE-2016-10201 Cross-site Scripting vulnerability in Zoneminder
Cross-site scripting (XSS) vulnerability in Zoneminder 1.30 and earlier allows remote attackers to inject arbitrary web script or HTML via the format parameter in a download log request to index.php.
network
zoneminder CWE-79
4.3
2017-02-06 CVE-2017-5595 Information Exposure vulnerability in Zoneminder
A file disclosure and inclusion vulnerability exists in web/views/file.php in ZoneMinder 1.x through v1.30.0 because of unfiltered user-input being passed to readfile(), which allows an authenticated attacker to read local system files (e.g., /etc/passwd) in the context of the web server user (www-data).
local
low complexity
zoneminder CWE-200
2.1
2017-02-06 CVE-2017-5368 Cross-Site Request Forgery (CSRF) vulnerability in Zoneminder 1.29.0/1.30.0
ZoneMinder v1.30 and v1.29, an open-source CCTV server web application, is vulnerable to CSRF (Cross Site Request Forgery) which allows a remote attack to make changes to the web application as the current logged in victim.
6.8
2017-02-06 CVE-2017-5367 Cross-site Scripting vulnerability in Zoneminder 1.29.0/1.30.0
Multiple reflected XSS vulnerabilities exist within form and link input parameters of ZoneMinder v1.30 and v1.29, an open-source CCTV server web application, which allows a remote attacker to execute malicious scripts within an authenticated client's browser.
network
zoneminder CWE-79
4.3
2017-01-13 CVE-2016-10140 Information Exposure vulnerability in Zoneminder 1.30.0
Information disclosure and authentication bypass vulnerability exists in the Apache HTTP Server configuration bundled with ZoneMinder v1.30 and v1.29, which allows a remote unauthenticated attacker to browse all directories in the web root, e.g., a remote unauthenticated attacker can view all CCTV images on the server via the /events URI.
network
low complexity
zoneminder CWE-200
5.0
2013-03-20 CVE-2013-0332 Path Traversal vulnerability in Zoneminder
Multiple directory traversal vulnerabilities in ZoneMinder 1.24.x before 1.24.4 allow remote attackers to read arbitrary files via a ..
network
low complexity
zoneminder CWE-22
5.0