There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - ZoneMinder is a free, open source Closed-circuit television software application The file parameter is
    vulnerable to a cross site scripting vulnerability (XSS) by backing out of the current "tr" "td" brackets.
    This then allows a malicious user to provide code that will execute when a user views the specific log on
    the "view=log" page. This vulnerability allows an attacker to store code within the logs that will be
    executed when loaded by a legitimate user. These actions will be performed with the permission of the
    victim. This could lead to data loss and/or further exploitation including account takeover. This issue
    has been addressed in versions `1.36.27` and `1.37.24`. Users are advised to upgrade. Users unable to
    upgrade should disable database logging. (CVE-2022-39285)

  - ZoneMinder is a free, open source Closed-circuit television software application. In affected versions the
    ZoneMinder API Exposes Database Log contents to user without privileges, allows insertion, modification,
    deletion of logs without System Privileges. Users are advised yo upgrade as soon as possible. Users unable
    to upgrade should disable database logging. (CVE-2022-39289)

  - ZoneMinder is a free, open source Closed-circuit television software application. In affected versions
    authenticated users can bypass CSRF keys by modifying the request supplied to the Zoneminder web
    application. These modifications include replacing HTTP POST with an HTTP GET and removing the CSRF key
    from the request. An attacker can take advantage of this by using an HTTP GET request to perform actions
    with no CSRF protection. This could allow an attacker to cause an authenticated user to perform unexpected
    actions on the web application. Users are advised to upgrade as soon as possible. There are no known
    workarounds for this issue. (CVE-2022-39290)

  - ZoneMinder is a free, open source Closed-circuit television software application. Affected versions of
    zoneminder are subject to a vulnerability which allows users with "View" system permissions to inject new
    data into the logs stored by Zoneminder. This was observed through an HTTP POST request containing log
    information to the "/zm/index.php" endpoint. Submission is not rate controlled and could affect database
    performance and/or consume all storage resources. Users are advised to upgrade. There are no known
    workarounds for this issue. (CVE-2022-39291)

Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且供應商未提供可用的修補程式。

  - ZoneMinder 是一款免費的開源閉路電視軟件應用程序。在受影響的版本中，ZoneMinder API 會向沒有權限的使用者公開資料庫日誌內容，允許在沒有系統權限的情況下插入、修改、刪除日誌。建議用戶盡快升級。無法升級的使用者應停用資料庫記錄。（CVE-2022-39289）

請注意，Nessus 的判定取決於廠商所報告的套件是否存在。

Linux/Unix 主机中安装的一个或多个程序包受到一个漏洞影响，而供应商没有提供补丁程序。

  - ZoneMinder 是一款免费的开源闭路电视软件应用程序。在受影响的版本中，ZoneMinder API 会在没有权限的情况下将数据库日志内容暴露给用户，允许在没有系统权限的情况下插入、修改和删除日志。建议用户尽快升级。无法升级的用户应禁用数据库记录。（CVE-2022-39289）

请注意，Nessus 依赖供应商报告的程序包是否存在进行判断。

Linux/Unix ホストには、ベンダーが提供するパッチが利用できない脆弱性の影響を受ける複数のパッケージがインストールされています。

  - ZoneMinder は、無料のオープンソースの閉回路テレビソフトウェアアプリケーションです。影響を受けるバージョンでは、ZoneMinder APIがデータベースログのコンテンツを権限のないユーザーに漏えいし、システム権限なしでログの挿入、変更、削除を許可します。ユーザーは、至急アップグレードすることが推奨されます。アップグレードできないユーザーは、データベースロギングを無効にする必要があります。(CVE-2022-39289)

Nessus は、ベンダーによって報告されたパッケージの存在に依存していることに注意してください。

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - ZoneMinder is a free, open source Closed-circuit television software application. In affected versions the     ZoneMinder API Exposes Database Log contents to user without privileges, allows insertion, modification,     deletion of logs without System Privileges. Users are advised yo upgrade as soon as possible. Users unable     to upgrade should disable database logging. (CVE-2022-39289)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Published	Updated	Severity
427034	Alpine: multiple zoneminder packages: security update to 1.36.31-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	5/16/2025	8/7/2026	high
427034	Alpine: multiple zoneminder packages: security update to 1.36.31-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	5/16/2025	8/7/2026	high
224914	Linux Distros 未修補的弱點：CVE-2022-39289	Nessus	Misc.	3/5/2025	7/13/2026	high
224914	Linux Distros 未修补的漏洞：CVE-2022-39289	Nessus	Misc.	3/5/2025	7/13/2026	high
224914	Linux Distros のパッチ未適用の脆弱性: CVE-2022-39289	Nessus	Misc.	3/5/2025	7/13/2026	high
224914	Linux Distros Unpatched Vulnerability : CVE-2022-39289	Nessus	Misc.	3/5/2025	7/13/2026	high

Detections

Analytics

Plugins Search

high

high

high

high

high

high