CVE catalog
CVE-2019-7336
zoneminder: CVE-2019-7336
- Severity
- Low
- Published
- Source
- [NVD] · [CVE record]
- EPSS
- 0.87% · Oct 27, 2026
Self - Stored Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3, as the view _monitor_filters.php contains takes in input from the user and saves it into the session, and retrieves it later (insecurely). The values of the MonitorName and Source parameters are being displayed without any output filtration being applied. This relates to the view=cycle value.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | zoneminder | sid | 1.36.37+dfsg1-1.1 | fixed |
| Debian | zoneminder | forky | 1.36.37+dfsg1-1.1 | fixed |
| Debian | zoneminder | trixie | 1.36.35+dfsg1-1 | fixed |
| Debian | zoneminder | bookworm | 1.36.33+dfsg1-1 | fixed |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | zoneminder | source | sid | 1.34.6-1 | unimportant | Not reported | [922724] |
| Debian | zoneminder | source | forky | 1.34.6-1 | unimportant | Not reported | [922724] |
| Debian | zoneminder | source | trixie | 1.34.6-1 | unimportant | Not reported | [922724] |
| Debian | zoneminder | source | bookworm | 1.34.6-1 | unimportant | Not reported | [922724] |
OpenFactory catalog packages
[Debian 12 (Bookworm)]
- [zoneminder]Fixed
Details (2)
1.36.33+dfsg1-1· amd64 · bookwormFixed · Fixed:
1.34.6-1dsa · zoneminder · debian · bookworm; dsa · zoneminder · debian · 12
1.36.33+dfsg1-1· arm64 · bookwormFixed · Fixed:
1.34.6-1dsa · zoneminder · debian · bookworm; dsa · zoneminder · debian · 12
- [zoneminder-doc]Fixed
Source package: [zoneminder]
Details (2)
1.36.33+dfsg1-1· all · bookwormFixed · Fixed:
1.34.6-1dsa · zoneminder · debian · bookworm; dsa · zoneminder · debian · 12
1.36.33+dfsg1-1· all · bookwormFixed · Fixed:
1.34.6-1dsa · zoneminder · debian · bookworm; dsa · zoneminder · debian · 12
[Debian 13 (Trixie)]
- [zoneminder]Fixed
Details (2)
1.36.35+dfsg1-1· amd64 · trixieFixed · Fixed:
1.34.6-1dsa · zoneminder · debian · 13
1.36.35+dfsg1-1· arm64 · trixieFixed · Fixed:
1.34.6-1dsa · zoneminder · debian · 13
- [zoneminder-doc]Fixed
Source package: [zoneminder]
Details (2)
1.36.35+dfsg1-1· all · trixieFixed · Fixed:
1.34.6-1dsa · zoneminder · debian · 13
1.36.35+dfsg1-1· all · trixieFixed · Fixed:
1.34.6-1dsa · zoneminder · debian · 13
Observed: