Vulnerabilities > Zoneminder > Medium
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2019-01-28 | CVE-2019-6990 | Cross-site Scripting vulnerability in Zoneminder A stored-self XSS exists in web/skins/classic/views/zones.php of ZoneMinder through 1.32.3, allowing an attacker to execute HTML or JavaScript code in a vulnerable field via a crafted Zone NAME to the index.php?view=zones&action=zoneImage&mid=1 URI. | 5.4 |
| 2019-01-24 | CVE-2019-6777 | Cross-site Scripting vulnerability in Zoneminder 1.32.3 An issue was discovered in ZoneMinder v1.32.3. | 6.1 |
| 2017-03-21 | CVE-2017-7203 | Cross-site Scripting vulnerability in Zoneminder 1.30.2 A Cross-Site Scripting (XSS) was discovered in ZoneMinder before 1.30.2. | 6.1 |
| 2017-03-03 | CVE-2016-10203 | Cross-site Scripting vulnerability in Zoneminder Cross-site scripting (XSS) vulnerability in Zoneminder 1.30 and earlier allows remote attackers to inject arbitrary web script or HTML via the name when creating a new monitor. | 6.1 |
| 2017-03-03 | CVE-2016-10202 | Cross-site Scripting vulnerability in Zoneminder Cross-site scripting (XSS) vulnerability in Zoneminder 1.30 and earlier allows remote attackers to inject arbitrary web script or HTML via the path info to index.php. | 6.1 |
| 2017-03-03 | CVE-2016-10201 | Cross-site Scripting vulnerability in Zoneminder Cross-site scripting (XSS) vulnerability in Zoneminder 1.30 and earlier allows remote attackers to inject arbitrary web script or HTML via the format parameter in a download log request to index.php. | 6.1 |
| 2017-02-06 | CVE-2017-5595 | Information Exposure vulnerability in Zoneminder A file disclosure and inclusion vulnerability exists in web/views/file.php in ZoneMinder 1.x through v1.30.0 because of unfiltered user-input being passed to readfile(), which allows an authenticated attacker to read local system files (e.g., /etc/passwd) in the context of the web server user (www-data). | 5.5 |
| 2017-02-06 | CVE-2017-5367 | Cross-site Scripting vulnerability in Zoneminder 1.29.0/1.30.0 Multiple reflected XSS vulnerabilities exist within form and link input parameters of ZoneMinder v1.30 and v1.29, an open-source CCTV server web application, which allows a remote attacker to execute malicious scripts within an authenticated client's browser. | 6.1 |