CVE-2016-10206

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Cross-site request forgery (CSRF) vulnerability in Zoneminder 1.30 and earlier allows remote attackers to hijack the authentication of users for requests that change passwords and possibly have unspecified other impact as demonstrated by a crafted user action request to index.php.

Metrics

CVSS 3.0 8.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-352

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.openwall.com/lists/oss-security/2017/02/05/1Exploit, Mailing List
http://www.securityfocus.com/bid/97114
https://www.foxmole.com/advisories/foxmole-2016-07-05.txtExploit, Third Party Advisory
http://www.openwall.com/lists/oss-security/2017/02/05/1Exploit, Mailing List
http://www.securityfocus.com/bid/97114
https://www.foxmole.com/advisories/foxmole-2016-07-05.txtExploit, Third Party Advisory

Timeline

Published: Mar 3, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-102077.5The Xvnc server in TigerVNC allows remote attackers to cause a denial of service (invalid memory access and crash) by terminating a TLS hand CVE-2016-102084.3The ext4_fill_super function in fs/ext4/super.c in the Linux kernel through 4.9.8 does not properly validate meta block groups, which allows CVE-2016-102095.5The archive_wstring_append_from_mbs function in archive_string.c in libarchive 3.2.2 allows remote attackers to cause a denial of service (N CVE-2016-10218.8Adobe Flash Player before 18.0.0.343 and 19.x through 21.x before 21.0.0.213 on Windows and OS X and before 11.2.202.616 on Linux allows att CVE-2016-102107.5libyara/lexer.l in YARA 3.5.0 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a cr CVE-2016-102117.5libyara/grammar.y in YARA 3.5.0 allows remote attackers to cause a denial of service (use-after-free and application crash) via a crafted ru CVE-2016-102125.9Radware devices use the same value for the first two GCM nonces, which allows remote attackers to obtain the authentication key and spoof da CVE-2016-102135.9A10 AX1030 and possibly other devices with software before 2.7.2-P8 uses random GCM nonce generations, which makes it easier for remote atta CVE-2016-102146.5Memory leak in the virgl_resource_attach_backing function in virglrenderer before 0.6.0 allows local guest OS users to cause a denial of ser CVE-2016-102156.1An issue was discovered in Fastspot BigTree bigtree-form-builder before 1.2. The vulnerability exists due to insufficient filtration of user CVE-2016-102166.1An issue was discovered in IT ITems DataBase (ITDB) through 1.23. The vulnerability exists due to insufficient filtration of user-supplied d CVE-2016-102175.5The pdf14_open function in base/gdevp14.c in Artifex Software, Inc. Ghostscript 9.20 allows remote attackers to cause a denial of service (u