Lucene search
Veracode Vulnerability DatabaseVERACODE:39586HistoryMar 08, 2023 - 5:38 a.m.
Cross-site Scripting (XSS)
2023-03-0805:38:27
Veracode Vulnerability Database
sca.analysiscenter.veracode.com
7
cross-site scripting
vulnerability
orchardcore
special characters
front end
database logs
malicious referrer
0.001 Low
EPSS
Percentile
37.7%
orchardcore is vulnerable to Cross-site Scripting (XSS) attacks. The library does not properly escape the special characters before it output to the front end, allowing an attacker to inject log entries into the database logs, containing a malicious referrer field.
| CPE | Name | Operator | Version |
|---|---|---|---|
| zoneminder:sid | eq | 1.34.21-1 | |
| zoneminder:sid | eq | 1.36.7+dfsg1-1 | |
| zoneminder:sid | eq | 1.34.21-1 | |
| zoneminder:sid | eq | 1.36.7+dfsg1-1 |
References
github.com/ZoneMinder/zoneminder/commit/4637eaf9ea530193e0897ec48899f5638bdd6d81
github.com/ZoneMinder/zoneminder/commit/57bf25d39f12d620693f26068b8441b4f3f0b6c0
github.com/ZoneMinder/zoneminder/commit/e1028c1d7f23cc1e0941b7b37bb6ae5a04364308
github.com/ZoneMinder/zoneminder/security/advisories/GHSA-68vf-g4qm-jr6v
security-tracker.debian.org/tracker/CVE-2023-25825
Related
osv
osv
CVE-2023-25825
2023-02-25 01:15:56
cve
cve
CVE-2023-25825
2023-02-25 01:15:56
ubuntucve
ubuntucve
CVE-2023-25825
2023-02-25 00:00:00
prion
prion
Cross site scripting
2023-02-25 01:15:00
debiancve
debiancve
CVE-2023-25825
2023-02-25 01:15:56
cvelist
cvelist
CVE-2023-25825 ZoneMinder contains Cross-site Scripting via log viewing
2023-02-25 00:44:25
nvd
nvd
CVE-2023-25825
2023-02-25 01:15:56
openvas
openvas
ZoneMinder < 1.36.33, 1.37.x < 1.37.33 Multiple Vulnerabilities
2023-02-27 00:00:00