Filtered by vendor Zabbix
Subscriptions
Total
83 CVE
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2019-17382 | 1 Zabbix | 1 Zabbix | 2024-08-05 | 9.1 Critical |
| An issue was discovered in zabbix.php?action=dashboard.view&dashboardid=1 in Zabbix through 4.4. An attacker can bypass the login page and access the dashboard page, and then create a Dashboard, Report, Screen, or Map without any Username/Password (i.e., anonymously). All created elements (Dashboard/Report/Screen/Map) are accessible by other users and by an admin. | ||||
| CVE-2019-15132 | 2 Debian, Zabbix | 2 Debian Linux, Zabbix | 2024-08-05 | 5.3 Medium |
| Zabbix through 4.4.0alpha1 allows User Enumeration. With login requests, it is possible to enumerate application usernames based on the variability of server responses (e.g., the "Login name or password is incorrect" and "No permissions for system access" messages, or just blocking for a number of seconds). This affects both api_jsonrpc.php and index.php. | ||||
| CVE-2020-15803 | 4 Debian, Fedoraproject, Opensuse and 1 more | 5 Debian Linux, Fedora, Backports and 2 more | 2024-08-04 | 6.1 Medium |
| Zabbix before 3.0.32rc1, 4.x before 4.0.22rc1, 4.1.x through 4.4.x before 4.4.10rc1, and 5.x before 5.0.2rc1 allows stored XSS in the URL Widget. | ||||
| CVE-2020-11800 | 3 Debian, Opensuse, Zabbix | 4 Debian Linux, Backports Sle, Leap and 1 more | 2024-08-04 | 9.8 Critical |
| Zabbix Server 2.2.x and 3.0.x before 3.0.31, and 3.2 allows remote attackers to execute arbitrary code. | ||||
| CVE-2021-46088 | 1 Zabbix | 1 Zabbix | 2024-08-04 | 7.2 High |
| Zabbix 4.0 LTS, 4.2, 4.4, and 5.0 LTS is vulnerable to Remote Code Execution (RCE). Any user with the "Zabbix Admin" role is able to run custom shell script on the application server in the context of the application user. | ||||
| CVE-2021-27927 | 1 Zabbix | 1 Zabbix | 2024-08-03 | 8.8 High |
| In Zabbix from 4.0.x before 4.0.28rc1, 5.0.0alpha1 before 5.0.10rc1, 5.2.x before 5.2.6rc1, and 5.4.0alpha1 before 5.4.0beta2, the CControllerAuthenticationUpdate controller lacks a CSRF protection mechanism. The code inside this controller calls diableSIDValidation inside the init() method. An attacker doesn't have to know Zabbix user login credentials, but has to know the correct Zabbix URL and contact information of an existing user with sufficient privileges. | ||||
| CVE-2022-22704 | 2 Alpinelinux, Zabbix | 2 Alpine Linux, Zabbix-agent2 | 2024-08-03 | 9.8 Critical |
| The zabbix-agent2 package before 5.4.9-r1 for Alpine Linux sometimes allows privilege escalation to root because the design incorrectly expected that systemd would (in effect) determine part of the configuration. | ||||
| CVE-2023-32727 | 1 Zabbix | 1 Zabbix Server | 2024-08-02 | 6.8 Medium |
| An attacker who has the privilege to configure Zabbix items can use function icmpping() with additional malicious command inside it to execute arbitrary code on the current Zabbix server. | ||||
| CVE-2023-32721 | 1 Zabbix | 1 Zabbix | 2024-08-02 | 7.6 High |
| A stored XSS has been found in the Zabbix web application in the Maps element if a URL field is set with spaces before URL. | ||||
| CVE-2023-32728 | 1 Zabbix | 1 Zabbix-agent2 | 2024-08-02 | 4.6 Medium |
| The Zabbix Agent 2 item key smart.disk.get does not sanitize its parameters before passing them to a shell command resulting possible vulnerability for remote code execution. | ||||
| CVE-2023-32725 | 1 Zabbix | 2 Frontend, Zabbix Server | 2024-08-02 | 9.6 Critical |
| The website configured in the URL widget will receive a session cookie when testing or executing scheduled reports. The received session cookie can then be used to access the frontend as the particular user. | ||||
| CVE-2023-32726 | 1 Zabbix | 1 Zabbix-agent | 2024-08-02 | 3.9 Low |
| The vulnerability is caused by improper check for check if RDLENGTH does not overflow the buffer in response from DNS server. | ||||
| CVE-2023-30958 | 1 Zabbix | 1 Frontend | 2024-08-02 | 4.7 Medium |
| A security defect was identified in Foundry Frontend that enabled users to potentially conduct DOM XSS attacks if Foundry's CSP were to be bypassed. This defect was resolved with the release of Foundry Frontend 6.225.0. | ||||
| CVE-2023-29457 | 1 Zabbix | 1 Frontend | 2024-08-02 | 6.3 Medium |
| Reflected XSS attacks, occur when a malicious script is reflected off a web application to the victim's browser. The script can be activated through Action form fields, which can be sent as request to a website with a vulnerability that enables execution of malicious scripts. | ||||
| CVE-2023-29449 | 1 Zabbix | 1 Zabbix | 2024-08-02 | 5.9 Medium |
| JavaScript preprocessing, webhooks and global scripts can cause uncontrolled CPU, memory, and disk I/O utilization. Preprocessing/webhook/global script configuration and testing are only available to Administrative roles (Admin and Superadmin). Administrative privileges should be typically granted to users who need to perform tasks that require more control over the system. The security risk is limited because not all users have this level of access. | ||||
| CVE-2023-29450 | 1 Zabbix | 1 Zabbix | 2024-08-02 | 8.5 High |
| JavaScript pre-processing can be used by the attacker to gain access to the file system (read-only access on behalf of user "zabbix") on the Zabbix Server or Zabbix Proxy, potentially leading to unauthorized access to sensitive data. | ||||
| CVE-2023-29456 | 1 Zabbix | 1 Frontend | 2024-08-02 | 5.7 Medium |
| URL validation scheme receives input from a user and then parses it to identify its various components. The validation scheme can ensure that all URL components comply with internet standards. | ||||
| CVE-2023-29452 | 1 Zabbix | 1 Zabbix | 2024-08-02 | 5.5 Medium |
| Currently, geomap configuration (Administration -> General -> Geographical maps) allows using HTML in the field “Attribution text” when selected “Other” Tile provider. | ||||
| CVE-2023-29451 | 1 Zabbix | 1 Zabbix | 2024-08-02 | 4.7 Medium |
| Specially crafted string can cause a buffer overrun in the JSON parser library leading to a crash of the Zabbix Server or a Zabbix Proxy. | ||||
| CVE-2023-29455 | 1 Zabbix | 1 Frontend | 2024-08-02 | 5.4 Medium |
| Reflected XSS attacks, also known as non-persistent attacks, occur when a malicious script is reflected off a web application to the victim's browser. The script is activated through a link, which sends a request to a website with a vulnerability that enables execution of malicious scripts. | ||||