Scan report

ZoneMinder / zoneminder

View on GitHub (opens in a new tab)
PHP
5936 stars
Scanned 24 Sep 2026, 06:48

Report Rescan

Vulnerability Medium

Could an attacker exploit mistakes in this code?

22 risk score

Real issues worth reviewing before you rely on this code.

High: 2
Medium: 1
Low: 13

Sources: Bandit, Semgrep, pip-audit

Malicious pattern Medium

Does this code look like it is trying to cause harm?

34 risk score

Real issues worth reviewing before you rely on this code.

High: 54
Medium: 0
Low: 16

Sources: YARA, ClamAV, GuardDog, dependency checker

Findings overview

86 total findings

Likely real: 6
Uncertain: 1
Likely noise: 79

The risk classifier rates every finding for how likely it is to be a real issue. Likely noise still counts, just much less.

What we found, in plain English

The repository has two medium-risk scores, both indicating that there are some insecure coding patterns and signs of potentially malicious behavior, but these issues do not necessarily mean the code is intentionally harmful. The most critical finding is that the project uses Telnet to connect to remote servers, which is an extremely dangerous practice because it transmits data without encryption and can be easily exploited by attackers. Additionally, the code contains several other security concerns such as downloading files from the internet and executing them, along with potential memory scraping vulnerabilities, but these are likely due to standard development habits rather than deliberate attacks. While some of the flagged items appear in legitimate software like jQuery or Beowulf documentation, the presence of Telnet usage and the download-and-execute pattern suggests that this codebase requires immediate attention before it can be used safely.

Written by a local language model from the findings below. The risk scores come from the classifier, not from this summary.

Detections by engine

YARA 66

Malware signature rules · Malicious pattern
Bandit 16

Python security linter · Vulnerability
GuardDog 4

Supply-chain attack heuristics · Malicious pattern

Score over time

Overall score each time this repository was scanned.

Findings

Highest severity first. Select a finding to see the code and what it means.

Engine
GuardDog · Supply-chain attack heuristics

Counts towards
Malicious pattern

File
/web/skins/classic/js/jquery-ui-1.13.2/package.json line 21

Likely real
Yes, 98% confidence

Detects HTTP/HTTPS URL dependencies in package.json (dependency confusion, untrusted sources) [threat-npm-http-dependency]
```
"email": "mike.sherov@gmail.com",
			"url": "http://mike.sherov.com"
		},
		{
```
Engine
GuardDog · Supply-chain attack heuristics

Counts towards
Malicious pattern

File
/web/skins/classic/js/jquery-ui-1.13.2/package.json line 16

Likely real
Yes, 98% confidence

Detects HTTP/HTTPS URL dependencies in package.json (dependency confusion, untrusted sources) [threat-npm-http-dependency]
```
"email": "joern.zaefferer@gmail.com",
			"url": "http://bassistance.de"
		},
		{
```
Engine
GuardDog · Supply-chain attack heuristics

Counts towards
Malicious pattern

File
/web/skins/classic/js/jquery-ui-1.13.2/package.json line 6

Likely real
Yes, 98% confidence

Detects HTTP/HTTPS URL dependencies in package.json (dependency confusion, untrusted sources) [threat-npm-http-dependency]
```
"version": "1.13.2",
	"homepage": "http://jqueryui.com",
	"author": {
		"name": "jQuery Foundation and other contributors",
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/scripts/zmalarm-server.py line 68

Likely real
Yes, 98% confidence

Telnet-related functions are being called. Telnet is considered insecure. Use SSH or some other encrypted protocol.
```
67         telbuff = str(m_id) + '|on+'+str(eventlenght)+'|1|Human Motion Detected|'
68         with Telnet('localhost', 6802) as tn:
69           tn.write(telbuff.encode('ascii') + alarm_desc.encode('ascii') + b'\n')
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/scripts/zmalarm-server.py line 38

Likely real
Yes, 98% confidence

A telnet-related module is being imported. Telnet is considered insecure. Use SSH or some other encrypted protocol.
```
37 # telnet
38 from telnetlib import Telnet
39 # multi threading
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/scripts/zmalarm-server.py line 118

Likely real
Uncertain, 37% confidence

Possible binding to all interfaces.
```
117 server = socket(AF_INET, SOCK_STREAM)
118 server.bind(('0.0.0.0', int(port)))
119 # server.settimeout(0.5)
```
Engine
GuardDog · Supply-chain attack heuristics

Counts towards
Malicious pattern

File
/web/js/hls-1.6.13/hls.min.js line 1

Likely real
Yes, 92% confidence

Detects memory scraping and credential dumping from process memory [threat-process-memory]
```
....BACK_BUFFER_REACHED="hlsBackBufferReached",e.STEERING_MANIFEST_LOADED="hlsSteeringManifestLoaded",e.ASSET_LIST_LOADING="hlsAssetListLoading",e.ASSET_LIST_LOADED="hlsAssetListLoaded",e.INTERSTITIALS_UPDATED="hlsInterstitialsUpdated",e.INTERSTITIALS_...
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/scripts/zmalarm-server.py line 62

Likely real
Probably noise, 14% confidence

Consider possible security implications associated with the subprocess module.
```
61 def event_thread(m_id,eventlenght):
62     import subprocess
63     print("Monitor " + str(m_id)+" entered event_thread...")
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/scripts/zmalarm-server.py line 48

Likely real
Probably noise, 14% confidence

Consider possible security implications associated with the subprocess module.
```
47 def alarm_thread(m, monid,eventlenght):
48     import subprocess
49     print("Monitor " + str(monid)+" entered alarm_thread...")
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/utils/check-shareddata-abi.py line 24

Likely real
Probably noise, 13% confidence

Consider possible security implications associated with the subprocess module.
```
23 import re
24 import subprocess
25 import sys
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/utils/check-homoglyphs.py line 17

Likely real
Probably noise, 13% confidence

Consider possible security implications associated with the subprocess module.
```
16 import re
17 import subprocess
18 import sys
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/scripts/zmalarm-server.py line 50

Likely real
Probably noise, 12% confidence

Starting a process with a partial executable path
```
49     print("Monitor " + str(monid)+" entered alarm_thread...")
50     result = subprocess.run(['zmu','-m', str(monid), '-s'] ,stdout=subprocess.PIPE)
51     if result.stdout.decode('utf-8') != '3\n':
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/scripts/zmalarm-server.py line 64

Likely real
Probably noise, 12% confidence

Starting a process with a partial executable path
```
63     print("Monitor " + str(m_id)+" entered event_thread...")
64     result = subprocess.run(['zmu','-m', str(m_id), '-x'] ,stdout=subprocess.PIPE)
65     if result.stdout.decode('utf-8') == '0\n':
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/utils/check-homoglyphs.py line 52

Likely real
Probably noise, 12% confidence

Starting a process with a partial executable path
```
51 def tracked_files():
52     out = subprocess.check_output(['git', 'ls-files'], text=True)
53     return out.splitlines()
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/utils/check-shareddata-abi.py line 80

Likely real
Probably noise, 3% confidence

subprocess call - check for execution of untrusted input.
```
79         return None, compile_proc.stderr
80     run_proc = subprocess.run([exe], capture_output=True, text=True)
81     if run_proc.returncode != 0:
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/utils/check-shareddata-abi.py line 75

Likely real
Probably noise, 3% confidence

subprocess call - check for execution of untrusted input.
```
74     exe = os.path.join(workdir, 'probe{}'.format(bits))
75     compile_proc = subprocess.run(
76         [cxx, '-m{}'.format(bits), '-std=c++17', '-w', source, '-o', exe],
77         capture_output=True, text=True)
78     if compile_proc.returncode != 0:
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/utils/check-homoglyphs.py line 52

Likely real
Probably noise, 3% confidence

subprocess call - check for execution of untrusted input.
```
51 def tracked_files():
52     out = subprocess.check_output(['git', 'ls-files'], text=True)
53     return out.splitlines()
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/scripts/zmalarm-server.py line 64

Likely real
Probably noise, 3% confidence

subprocess call - check for execution of untrusted input.
```
63     print("Monitor " + str(m_id)+" entered event_thread...")
64     result = subprocess.run(['zmu','-m', str(m_id), '-x'] ,stdout=subprocess.PIPE)
65     if result.stdout.decode('utf-8') == '0\n':
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/scripts/zmalarm-server.py line 50

Likely real
Probably noise, 3% confidence

subprocess call - check for execution of untrusted input.
```
49     print("Monitor " + str(monid)+" entered alarm_thread...")
50     result = subprocess.run(['zmu','-m', str(monid), '-s'] ,stdout=subprocess.PIPE)
51     if result.stdout.decode('utf-8') != '3\n':
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/tools/zm_stream_socket_dump.py line 88

Likely real
Probably noise, 0% confidence

Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.
```
87             struct.unpack('<IBBBBIIq', header)
88         assert version == 1, 'unexpected protocol version %d' % version
89         payload = read_exact(sock, length - 20)
```