ZO
Product
zoneminder
96
CVEs
0
On KEV
9.9
Max CVSS
4
New 30D
Severity mix
Critical 17High 17Medium 54Low 0
Watch
Add zoneminder to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2019-7326 | 6.1 | Feb 4 | Self - Stored Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3, allowing an attacker to execute HTML or JavaScript code via a vulnerable 'Host' parameter value in… Affected: through 1.32.3 |
| CVE-2019-7327 | 6.1 | Feb 4 | Reflected Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3, allowing an attacker to execute HTML or JavaScript code via a vulnerable 'scale' parameter value in the… Affected: through 1.32.3 |
| CVE-2019-7328 | 6.1 | Feb 4 | Reflected Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3, allowing an attacker to execute HTML or JavaScript code via a vulnerable 'scale' parameter value in the… Affected: through 1.32.3 |
| CVE-2019-7329 | 6.1 | Feb 4 | Reflected Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3, as the form action on multiple views utilizes $_SERVER['PHP_SELF'] insecurely, mishandling any arbitrary… Affected: through 1.32.3 |
| CVE-2019-7330 | 6.1 | Feb 4 | Reflected Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3, allowing an attacker to execute HTML or JavaScript code via a vulnerable 'show' parameter value in the… Affected: through 1.32.3 |
| CVE-2019-7331 | 6.1 | Feb 4 | Self - Stored Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3 while editing an existing monitor field named "signal check color" (monitor.php) Affected: through 1.32.3 |
| CVE-2019-7332 | 6.1 | Feb 4 | Reflected Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3, allowing an attacker to execute HTML or JavaScript code via a vulnerable 'eid' (aka Event ID) parameter… Affected: through 1.32.3 |
| CVE-2019-7334 | 6.1 | Feb 4 | Reflected Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3, allowing an attacker to execute HTML or JavaScript code via a vulnerable 'Exportfile' parameter value in… Affected: through 1.32.3 |
| CVE-2019-7335 | 6.1 | Feb 4 | Self - Stored XSS exists in ZoneMinder through 1.32.3, allowing an attacker to execute HTML or JavaScript code in the view 'log' as it insecurely prints the 'Log Message' value on… Affected: through 1.32.3 |
| CVE-2019-7336 | 6.1 | Feb 4 | Self - Stored Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3, as the view _monitor_filters.php contains takes in input from the user and saves it into the session,… Affected: through 1.32.3 |
| CVE-2019-7338 | 6.1 | Feb 4 | Self - Stored XSS exists in ZoneMinder through 1.32.3, allowing an attacker to execute HTML or JavaScript code in the view 'group' as it insecurely prints the 'Group Name' value… Affected: through 1.32.3 |
| CVE-2019-7339 | 6.1 | Feb 4 | POST - Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3, allowing an attacker to execute HTML or JavaScript code via a vulnerable 'level' parameter value in the view… Affected: through 1.32.3 |
| CVE-2019-7340 | 6.1 | Feb 4 | POST - Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3, allowing an attacker to execute HTML or JavaScript code via a vulnerable 'filter[Query][terms][0][val]'… Affected: through 1.32.3 |
| CVE-2019-7341 | 6.1 | Feb 4 | Reflected - Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3, allowing an attacker to execute HTML or JavaScript code via a vulnerable 'newMonitor[LinkedMonitors]'… Affected: through 1.32.3 |
| CVE-2019-7342 | 6.1 | Feb 4 | POST - Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3, allowing an attacker to execute HTML or JavaScript code via a vulnerable 'filter[AutoExecuteCmd]' parameter… Affected: through 1.32.3 |
| CVE-2019-7343 | 6.1 | Feb 4 | Reflected - Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3, allowing an attacker to execute HTML or JavaScript code via a vulnerable 'newMonitor[Method]' parameter… Affected: through 1.32.3 |
| CVE-2019-7344 | 6.1 | Feb 4 | Reflected XSS exists in ZoneMinder through 1.32.3, allowing an attacker to execute HTML or JavaScript code in the view 'filter' as it insecurely prints the 'filter[Name]' (aka… Affected: through 1.32.3 |
| CVE-2019-7348 | 6.1 | Feb 4 | Self - Stored Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3, allowing an attacker to execute HTML or JavaScript code via a vulnerable 'username' parameter value… Affected: through 1.32.3 |
| CVE-2019-7349 | 6.1 | Feb 4 | Reflected Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3, allowing an attacker to execute HTML or JavaScript code via a vulnerable… Affected: through 1.32.3 |
| CVE-2019-7352 | 6.1 | Feb 4 | Self - Stored Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3, as the view 'state' (aka Run State) (state.php) does no input validation to the value supplied to the… Affected: through 1.32.3 |
| CVE-2019-6992 | 6.1 | Jan 28 | A stored-self XSS exists in web/skins/classic/views/controlcaps.php of ZoneMinder through 1.32.3, allowing an attacker to execute HTML or JavaScript code in a vulnerable field via… Affected: through 1.32.3 |
| CVE-2019-6777 | 6.1 | Jan 24 | An issue was discovered in ZoneMinder v1.32.3 Affected: 1.32.3 |
| CVE-2017-7203 | 6.1 | Mar 21 | A Cross-Site Scripting (XSS) was discovered in ZoneMinder before 1.30.2 Affected: 1.30.2 |
| CVE-2016-10203 | 6.1 | Mar 3 | Cross-site scripting (XSS) vulnerability in Zoneminder 1.30 and earlier allows remote attackers to inject arbitrary web script or HTML via the name when creating a new monitor Affected: through 1.30.0 |
| CVE-2016-10202 | 6.1 | Mar 3 | Cross-site scripting (XSS) vulnerability in Zoneminder 1.30 and earlier allows remote attackers to inject arbitrary web script or HTML via the path info to index.php Affected: through 1.30.0 |
| CVE-2016-10201 | 6.1 | Mar 3 | Cross-site scripting (XSS) vulnerability in Zoneminder 1.30 and earlier allows remote attackers to inject arbitrary web script or HTML via the format parameter in a download log… Affected: through 1.30.0 |
| CVE-2017-5367 | 6.1 | Feb 6 | Multiple reflected XSS vulnerabilities exist within form and link input parameters of ZoneMinder v1.30 and v1.29, an open-source CCTV server web application, which allows a remote… Affected: 1.29.0; 1.30.0 |
| CVE-2017-5595 | 5.5 | Feb 6 | A file disclosure and inclusion vulnerability exists in web/views/file.php in ZoneMinder 1.x through v1.30.0 because of unfiltered user-input being passed to readfile(), which… Affected: through 1.30.0 |
| CVE-2022-30768 | 5.4 | Nov 15 | A Stored Cross Site Scripting (XSS) issue in ZoneMinder 1.36.12 allows an attacker to execute HTML or JavaScript code via the Username field when an Admin (or non-Admin users that… Affected: 1.36.12 |
| CVE-2022-39291 | 5.4 | Oct 7 | Denial of service through logs in zoneminder Affected: < 1.36.27; >= 1.37.0, <1.37.24 |
| CVE-2022-39285 | 5.4 | Oct 7 | Stored Cross-Site Scripting Vulnerability In File Parameter in zoneminder Affected: < 1.36.27; >= 1.37.0, < 1.37.24 |
| CVE-2019-13072 | 5.4 | Jun 30 | Stored XSS in the Filters page (Name field) in ZoneMinder 1.32.3 allows a malicious user to embed and execute JavaScript code in the browser of any user who navigates to this page Affected: 1.32.3 |
| CVE-2019-6990 | 5.4 | Jan 28 | A stored-self XSS exists in web/skins/classic/views/zones.php of ZoneMinder through 1.32.3, allowing an attacker to execute HTML or JavaScript code in a vulnerable field via a… Affected: through 1.32.3 |
| CVE-2026-104198 | 5.3 | Oct 15 | ZoneMinder failed token handling bypasses web authentication Affected: >= 1.34.0, < 1.36.63 |
| CVE-2019-7345 | 4.8 | Feb 4 | Self - Stored Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3, as the view 'options' (options.php) does no input validation for the WEB_TITLE, HOME_URL,… Affected: through 1.32.3 |
| CVE-2019-7337 | 4.8 | Feb 4 | Reflected Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3 as the view 'events' (events.php) insecurely displays the limit parameter value, without applying any… Affected: through 1.32.3 |
| CVE-2022-30769 | 4.6 | Nov 15 | Session fixation exists in ZoneMinder through 1.36.12 as an attacker can poison a session cookie to the next logged-in user Affected: through 1.36.12 |
| CVE-2026-102297 | 4.3 | Sep 28 | ZoneMinder before 1.38.4 Incorrect Authorization in frames API index Affected: before 1.38.4 |
| CVE-2013-0332 | – | Mar 20 | Multiple directory traversal vulnerabilities in ZoneMinder 1.24.x before 1.24.4 allow remote attackers to read arbitrary files via a Affected: 1.24.0; 1.24.1; 1.24.2; 1.24.3 |
| CVE-2013-0232 | – | Mar 20 | includes/functions.php in ZoneMinder Video Server 1.24.0, 1.25.0, and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) runState… Affected: 1.24.0; 1.24.1; 1.24.2; 1.24.3; 1.24.4; 1.25.0 |
| CVE-2008-6756 | – | Apr 27 | ZoneMinder 1.23.3 on Gentoo Linux uses 0644 permissions for /etc/zm.conf, which allows local users to obtain the database username and password by reading this file Affected: 1.23.3 |
| CVE-2008-6755 | – | Apr 27 | ZoneMinder 1.23.3 on Fedora 10 sets the ownership of /etc/zm.conf to the apache user account, and sets the permissions to 0600, which makes it easier for remote attackers to… Affected: 1.23.3 |
| CVE-2008-3882 | – | Sep 2 | Unspecified "Command Injection" vulnerability in ZoneMinder 1.23.3 and earlier allows remote attackers to execute arbitrary commands via (1) the executeFilter function in… Affected: through 1.23.3; 0.0.1; 0.9.7; 0.9.8; 0.9.9; 0.9.10; +31 more |
| CVE-2008-3881 | – | Sep 2 | Multiple cross-site scripting (XSS) vulnerabilities in ZoneMinder 1.23.3 and earlier allow remote attackers to inject arbitrary web script or HTML via unspecified… Affected: through 1.23.3; 0.0.1; 0.9.7; 0.9.8; 0.9.9; 0.9.10; +31 more |
| CVE-2008-3880 | – | Sep 2 | SQL injection vulnerability in zm_html_view_event.php in ZoneMinder 1.23.3 and earlier allows remote attackers to execute arbitrary SQL commands via the filter array parameter Affected: through 1.23.3; 0.0.1; 0.9.7; 0.9.8; 0.9.9; 0.9.10; +31 more |
| CVE-2008-1381 | – | May 1 | ZoneMinder before 1.23.3 allows remote authenticated users, and possibly unauthenticated attackers in some installations, to execute arbitrary commands via shell metacharacters in… Affected: 0.0.1; 0.9.7; 0.9.8; 0.9.9; 0.9.10; 0.9.11; +30 more |