There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - ZoneMinder is a free, open source Closed-circuit television software application The file parameter is
    vulnerable to a cross site scripting vulnerability (XSS) by backing out of the current "tr" "td" brackets.
    This then allows a malicious user to provide code that will execute when a user views the specific log on
    the "view=log" page. This vulnerability allows an attacker to store code within the logs that will be
    executed when loaded by a legitimate user. These actions will be performed with the permission of the
    victim. This could lead to data loss and/or further exploitation including account takeover. This issue
    has been addressed in versions `1.36.27` and `1.37.24`. Users are advised to upgrade. Users unable to
    upgrade should disable database logging. (CVE-2022-39285)

  - ZoneMinder is a free, open source Closed-circuit television software application. In affected versions the
    ZoneMinder API Exposes Database Log contents to user without privileges, allows insertion, modification,
    deletion of logs without System Privileges. Users are advised yo upgrade as soon as possible. Users unable
    to upgrade should disable database logging. (CVE-2022-39289)

  - ZoneMinder is a free, open source Closed-circuit television software application. In affected versions
    authenticated users can bypass CSRF keys by modifying the request supplied to the Zoneminder web
    application. These modifications include replacing HTTP POST with an HTTP GET and removing the CSRF key
    from the request. An attacker can take advantage of this by using an HTTP GET request to perform actions
    with no CSRF protection. This could allow an attacker to cause an authenticated user to perform unexpected
    actions on the web application. Users are advised to upgrade as soon as possible. There are no known
    workarounds for this issue. (CVE-2022-39290)

  - ZoneMinder is a free, open source Closed-circuit television software application. Affected versions of
    zoneminder are subject to a vulnerability which allows users with "View" system permissions to inject new
    data into the logs stored by Zoneminder. This was observed through an HTTP POST request containing log
    information to the "/zm/index.php" endpoint. Submission is not rate controlled and could affect database
    performance and/or consume all storage resources. Users are advised to upgrade. There are no known
    workarounds for this issue. (CVE-2022-39291)

Linux/Unix 主机中安装的一个或多个程序包受到一个漏洞影响，而供应商没有提供补丁程序。

  - ZoneMinder 是一款免费的开源闭路电视应用程序软件。在受影响的版本中经过认证的用户可通过修改提供给 Zoneminder Web 应用程序的请求绕过 CSRF 密钥。这些修改包括将 HTTP POST 替换为 HTTP GET以及从请求中删除 CSRF 密钥。攻击者可通过使用 HTTP GET 请求利用此漏洞在没有 CSRF 保护的情况下执行操作。这可允许攻击者导致经过认证的用户对 Web 应用程序执行非预期的操作。建议用户尽快升级。目前尚无针对此问题的解决方案。(CVE-2022-39290)

请注意，Nessus 依赖供应商报告的程序包是否存在进行判断。

Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且供應商未提供可用的修補程式。

  - ZoneMinder 是免費、開放原始碼的 Closed-circuit 電視軟體應用程式。在受影響的版本中經驗證的使用者可透過修改提供給 Zoneminder Web 應用程式的要求繞過 CSRF 金鑰。這些修改包括以 HTTP GET 取代 HTTP POST以及從要求中移除 CSRF 金鑰。攻擊者可利用此弱點使用 HTTP GET 要求在沒有 CSRF 保護的情況下執行動作。這可允許攻擊者造成經驗證的使用者在 Web 應用程式上執行非預期的動作。建議使用者盡快進行升級。目前沒有任何因應措施可解決此問題。(CVE-2022-39290)

請注意，Nessus 依賴供應商報告的套件存在。

Linux/Unix ホストには、ベンダーが提供するパッチが利用できない脆弱性の影響を受ける複数のパッケージがインストールされています。

  - ZoneMinder は、無料のオープンソースの閉回路TVソフトウェアアプリケーションです。影響を受けるバージョンでは、認証されたユーザーが、Zoneminder Webアプリケーションに提供されるリクエストを変更することにより、CSRFキーをバイパスする可能性があります。これらの変更には、HTTP POST を HTTP GET で置き換えることや、リクエストからの CSRF キーの削除が含まれます。攻撃者はこれを利用し、HTTP GETリクエストを使用してCSRF保護のないアクションを実行する可能性があります。これにより、攻撃者は認証されたユーザーにWebアプリケーションで予期しないアクションを実行させる可能性があります。ユーザーは、至急アップグレードすることが勧められています。この問題についての既知の回避策はありません。(CVE-2022-39290)

Nessus は、ベンダーによって報告されたパッケージの存在に依存していることに注意してください。

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - ZoneMinder is a free, open source Closed-circuit television software application. In affected versions     authenticated users can bypass CSRF keys by modifying the request supplied to the Zoneminder web     application. These modifications include replacing HTTP POST with an HTTP GET and removing the CSRF key     from the request. An attacker can take advantage of this by using an HTTP GET request to perform actions     with no CSRF protection. This could allow an attacker to cause an authenticated user to perform unexpected     actions on the web application. Users are advised to upgrade as soon as possible. There are no known     workarounds for this issue. (CVE-2022-39290)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Published	Updated	Severity
427034	Alpine: multiple zoneminder packages: security update to 1.36.31-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	5/16/2025	8/7/2026	high
427034	Alpine: multiple zoneminder packages: security update to 1.36.31-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	5/16/2025	8/7/2026	high
224939	Linux Distros 未修补的漏洞：CVE-2022-39290	Nessus	Misc.	3/5/2025	7/12/2026	medium
224939	Linux Distros 未修補的弱點：CVE-2022-39290	Nessus	Misc.	3/5/2025	7/12/2026	medium
224939	Linux Distros のパッチ未適用の脆弱性: CVE-2022-39290	Nessus	Misc.	3/5/2025	7/12/2026	medium
224939	Linux Distros Unpatched Vulnerability : CVE-2022-39290	Nessus	Misc.	3/5/2025	7/12/2026	medium

Detections

Analytics

Plugins Search

high

high

medium

medium

medium

medium