There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - ZoneMinder is a free, open source Closed-circuit television software application The file parameter is
    vulnerable to a cross site scripting vulnerability (XSS) by backing out of the current "tr" "td" brackets.
    This then allows a malicious user to provide code that will execute when a user views the specific log on
    the "view=log" page. This vulnerability allows an attacker to store code within the logs that will be
    executed when loaded by a legitimate user. These actions will be performed with the permission of the
    victim. This could lead to data loss and/or further exploitation including account takeover. This issue
    has been addressed in versions `1.36.27` and `1.37.24`. Users are advised to upgrade. Users unable to
    upgrade should disable database logging. (CVE-2022-39285)

  - ZoneMinder is a free, open source Closed-circuit television software application. In affected versions the
    ZoneMinder API Exposes Database Log contents to user without privileges, allows insertion, modification,
    deletion of logs without System Privileges. Users are advised yo upgrade as soon as possible. Users unable
    to upgrade should disable database logging. (CVE-2022-39289)

  - ZoneMinder is a free, open source Closed-circuit television software application. In affected versions
    authenticated users can bypass CSRF keys by modifying the request supplied to the Zoneminder web
    application. These modifications include replacing HTTP POST with an HTTP GET and removing the CSRF key
    from the request. An attacker can take advantage of this by using an HTTP GET request to perform actions
    with no CSRF protection. This could allow an attacker to cause an authenticated user to perform unexpected
    actions on the web application. Users are advised to upgrade as soon as possible. There are no known
    workarounds for this issue. (CVE-2022-39290)

  - ZoneMinder is a free, open source Closed-circuit television software application. Affected versions of
    zoneminder are subject to a vulnerability which allows users with "View" system permissions to inject new
    data into the logs stored by Zoneminder. This was observed through an HTTP POST request containing log
    information to the "/zm/index.php" endpoint. Submission is not rate controlled and could affect database
    performance and/or consume all storage resources. Users are advised to upgrade. There are no known
    workarounds for this issue. (CVE-2022-39291)

Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且供應商未提供可用的修補程式。

  - ZoneMinder 是免費、開放原始碼的閉路電視軟體應用程式。受影響的 zoneminder 版本容易受到一個弱點影響，該弱點允許具有 View 系統權限的使用者將新資料插入 Zoneminder 儲存的記錄中。可透過對 /zm/index.php 端點提出包含記錄資訊的 HTTP POST 要求，觀察到此問題。提交未受速率控制，且可影響資料庫效能和/或消耗所有儲存資源。建議所有使用者進行升級。目前沒有任何因應措施可解決此問題。(CVE-2022-39291)

請注意，Nessus 依賴供應商報告的套件存在。

Linux/Unix 主机中安装的一个或多个程序包受到一个漏洞影响，而供应商没有提供补丁程序。

  - ZoneMinder 是一款免费的开源闭路电视软件应用程序。受影响的 zoneminder 版本受到一个漏洞影响，该漏洞允许具有 View 系统权限的用户将新数据注入到 Zoneminder 存储的日志中。此问题通过包含 /zm/index.php 端点的日志信息的 HTTP POST 请求观察到。提交未控制速率，可影响数据库性能和/或消耗所有存储资源。建议用户升级。目前尚无针对此问题的解决方案。(CVE-2022-39291)

请注意，Nessus 依赖供应商报告的程序包是否存在进行判断。

Linux/Unix ホストには、ベンダーが提供するパッチが利用できない脆弱性の影響を受ける複数のパッケージがインストールされています。

  - ZoneMinder は、無料のオープンソースの閉回路テレビソフトウェアアプリケーションです。影響を受けるバージョンの zoneminder は脆弱性の対象となり、システムの表示権限を持つユーザーが、Zoneminder によって保存されたログに新しいデータを注入する可能性があります。これは、/zm/index.php エンドポイントへのログ情報を含む HTTP POST リクエストを通じて発生します。送信はレート制御されていないため、データベースのパフォーマンスに影響を与えたり、すべてのストレージリソースを消費したりする可能性があります。ユーザーにアップグレードすることを推奨します。この問題についての既知の回避策はありません。(CVE-2022-39291)

Nessus は、ベンダーによって報告されたパッケージの存在に依存していることに注意してください。

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - ZoneMinder is a free, open source Closed-circuit television software application. Affected versions of     zoneminder are subject to a vulnerability which allows users with View system permissions to inject new     data into the logs stored by Zoneminder. This was observed through an HTTP POST request containing log     information to the /zm/index.php endpoint. Submission is not rate controlled and could affect database     performance and/or consume all storage resources. Users are advised to upgrade. There are no known     workarounds for this issue. (CVE-2022-39291)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	名稱	產品	系列	已發布	已更新	嚴重性
427034	Alpine: multiple zoneminder packages: security update to 1.36.31-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	2025/5/16	2026/8/7	high
427034	Alpine: multiple zoneminder packages: security update to 1.36.31-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	2025/5/16	2026/8/7	high
224938	Linux Distros 未修補弱點：CVE-2022-39291	Nessus	Misc.	2025/3/5	2026/9/2	medium
224938	Linux Distros 未修补的漏洞: CVE-2022-39291	Nessus	Misc.	2025/3/5	2026/9/2	medium
224938	Linux Distros のパッチ未適用の脆弱性: CVE-2022-39291	Nessus	Misc.	2025/3/5	2026/9/2	medium
224938	Linux Distros Unpatched Vulnerability : CVE-2022-39291	Nessus	Misc.	2025/3/5	2026/9/2	medium

偵測

搜尋 Plugin

high

high

medium

medium

medium

medium