CVE-2023-26038

MEDIUM Year: 2023
CVSS v3 Score
6.5
Medium
Weakness Type
CWE-426
View all →

Vulnerability Description

ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras. Versions prior to 1.36.33 and 1.37.33 contain a Local File Inclusion (Untrusted Search Path) vulnerability via web/ajax/modal.php, where an arbitrary php file path can be passed in the request and loaded. This issue is patched in versions 1.36.33 and 1.37.33.

Related Vulnerabilities

CVE-2019-17100

MEDIUM
CVSS:6.5(Medium)

An Untrusted Search Path vulnerability in bdserviceshost.exe as used in Bitdefender Total Security 2020 allows an attacker to execute arbitrary code. This issue does not affect: Bitdefender Total Secu...

CWE-4262019

CVE-2019-3587

MEDIUM
CVSS:6.5(Medium)

DLL Search Order Hijacking vulnerability in Microsoft Windows client in McAfee Total Protection (MTP) Prior to 16.0.18 allows local users to execute arbitrary code via execution from a compromised fol...

CWE-4262019

CVE-2019-6173

MEDIUM
CVSS:6.5(Medium)

A DLL search path vulnerability could allow privilege escalation in some Lenovo installation packages, prior to version 1.2.9.3, during installation if an attacker already has administrative privilege...

CWE-4262019

CVE-2021-21078

MEDIUM
CVSS:6.5(Medium)

Adobe Creative Cloud Desktop Application version 5.3 (and earlier) is affected by an Unquoted Service Path vulnerability in CCXProcess that could allow an attacker to achieve arbitrary code execution ...

CWE-4262021

CVE-2024-42439

MEDIUM
CVSS:6.5(Medium)

Untrusted search path in the installer for Zoom Workplace Desktop App for macOS and Zoom Meeting SDK for macOS before 6.1.0 may allow a privileged user to conduct an escalation of privilege via local ...

CWE-4262024

CVE-2019-17449

MEDIUM
CVSS:6.7(Medium)

Avira Software Updater before 2.0.6.21094 allows a DLL side-loading attack. NOTE: The vendor thinks that this vulnerability is invalid because exploiting it would require at least administrator privil...

CWE-4262019