Product:

Zabbix

(Zabbix)
Repositories

Unknown:

This might be proprietary software.
#Vulnerabilities 62
Date Id Summary Products Score Patch Annotated
2024-02-09 CVE-2024-22119 The cause of vulnerability is improper validation of form input field “Name” on Graph page in Items section. Zabbix 5.4
2023-10-12 CVE-2023-32721 A stored XSS has been found in the Zabbix web application in the Maps element if a URL field is set with spaces before URL. Zabbix 5.4
2023-10-12 CVE-2023-32723 Request to LDAP is sent before user permissions are checked. Zabbix 9.1
2006-12-21 CVE-2006-6693 Multiple buffer overflows in zabbix before 20061006 allow attackers to cause a denial of service (application crash) and possibly execute arbitrary code via long strings to the (1) zabbix_log and (2) zabbix_syslog functions. Zabbix N/A
2006-12-21 CVE-2006-6692 Multiple format string vulnerabilities in zabbix before 20061006 allow attackers to cause a denial of service (application crash) and possibly execute arbitrary code via format string specifiers in information that would be recorded in the system log using (1) zabbix_log or (2) zabbix_syslog. Zabbix N/A
2010-08-05 CVE-2010-2790 Multiple cross-site scripting (XSS) vulnerabilities in the formatQuery function in frontends/php/include/classes/class.curl.php in Zabbix before 1.8.3rc1 allow remote attackers to inject arbitrary web script or HTML via the (1) filter_set, (2) show_details, (3) filter_rst, or (4) txt_select parameters to the triggers page (tr_status.php). NOTE: some of these details are obtained from third party information. Zabbix N/A
2020-07-17 CVE-2020-15803 Zabbix before 3.0.32rc1, 4.x before 4.0.22rc1, 4.1.x through 4.4.x before 4.4.10rc1, and 5.x before 5.0.2rc1 allows stored XSS in the URL Widget. Debian_linux, Fedora, Backports, Leap, Zabbix 6.1
2022-01-13 CVE-2022-23132 During Zabbix installation from RPM, DAC_OVERRIDE SELinux capability is in use to access PID files in [/var/run/zabbix] folder. In this case, Zabbix Proxy or Server processes can bypass file read, write and execute permissions check on the file system level Fedora, Zabbix 7.3
2022-01-13 CVE-2022-23133 An authenticated user can create a hosts group from the configuration with XSS payload, which will be available for other users. When XSS is stored by an authenticated malicious actor and other users try to search for groups during new host creation, the XSS payload will fire and the actor can steal session cookies and perform session hijacking to impersonate users or take over their accounts. Fedora, Zabbix 5.4
2022-01-13 CVE-2022-23134 After the initial setup process, some steps of setup.php file are reachable not only by super-administrators, but by unauthenticated users as well. Malicious actor can pass step checks and potentially change the configuration of Zabbix Frontend. Debian_linux, Fedora, Zabbix 5.3