Daniel Hofer

The issue is related to an origin bypass via the host header in an HTTP request. This can be triggered by an HTTP endpoint exposed to the network.

The issue affects devices from "PoS/ Dienstleistung, Entwicklung & Vertrieb GmbH" and allows for the leakage of the database, including system settings and user accounts. This can be triggered by an HTTP endpoint exposed to the network.

The issue is an unauthenticated remote code execution vulnerability that can be triggered by an HTTP endpoint exposed to the network.

The issue concerns ZoneMinder, a free, open source Closed-circuit television software application for Linux. It supports IP, USB, and Analog cameras. Log entries can be injected into the database logs, containing a malicious referrer field. This field is unescaped when viewing the logs in the web UI, leading to Cross-site Scripting.