# Zabbix.

Every CVE that names Zabbix among its affected products, newest first. Vendors and products are as the CNA wrote them.

## Records, newest first (an older page)

- [Direct access to memory pointers within the JS engine for modification](https://agentprime.io/advisories/CVE-2024-36461.md)
  `CVE-2024-36461` · CVE record: Zabbix Zabbix · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Aug 2024 · Tags: Memory corruption
- [Front-end audit log shows passwords in plaintext](https://agentprime.io/advisories/CVE-2024-36460.md)
  `CVE-2024-36460` · CVE record: Zabbix Zabbix · CVSS 8.1 High · Not analysed yet · Published 9 Aug 2024 · Tags: CWE-256
- [AT(GSM) Command Injection](https://agentprime.io/advisories/CVE-2024-22122.md)
  `CVE-2024-22122` · CVE record: Zabbix Zabbix · CVSS 3.0 Low · Not analysed yet · Published 9 Aug 2024 · Tags: Command injection
- [Zabbix Agent MSI Installer Allows Non-Admin User to Access Change Option via msiexec.exe](https://agentprime.io/advisories/CVE-2024-22121.md)
  `CVE-2024-22121` · CVE record: Zabbix Zabbix · CVSS 6.1 Medium · Not analysed yet · Published 9 Aug 2024 · Tags: CWE-281
- [Time Based SQL Injection in Zabbix Server Audit Log](https://agentprime.io/advisories/CVE-2024-22120.md)
  `CVE-2024-22120` · CVE record: Zabbix Zabbix · CVSS 9.1 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.77 · Not analysed yet · Published 17 May 2024 · Tags: CWE-20
- [Stored XSS in graph items select form](https://agentprime.io/advisories/CVE-2024-22119.md)
  `CVE-2024-22119` · CVE record: Zabbix Zabbix · CVSS 5.5 Medium · Not analysed yet · Published 9 Feb 2024 · Tags: CWE-20
- [Code injection in zabbix_agent2 smart.disk.get caused by smartctl plugin](https://agentprime.io/advisories/CVE-2023-32728.md)
  `CVE-2023-32728` · CVE record: Zabbix Zabbix · CVSS 4.6 Medium · Not analysed yet · Published 18 Dec 2023 · Tags: CWE-20
- [Code execution vulnerability in icmpping](https://agentprime.io/advisories/CVE-2023-32727.md)
  `CVE-2023-32727` · CVE record: Zabbix Zabbix · CVSS 6.8 Medium · Not analysed yet · Published 18 Dec 2023 · Tags: CWE-20
- [Possible buffer overread from reading DNS responses](https://agentprime.io/advisories/CVE-2023-32726.md)
  `CVE-2023-32726` · CVE record: Zabbix Zabbix · CVSS 3.9 Low · Not analysed yet · Published 18 Dec 2023 · Tags: CWE-754
- [Leak of zbx_session cookie when using a scheduled report that includes a dashboard with a URL widget.](https://agentprime.io/advisories/CVE-2023-32725.md)
  `CVE-2023-32725` · CVE record: Zabbix Zabbix · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Dec 2023 · Tags: CWE-565
- [JavaScript engine memory pointers are directly available for Zabbix users for modification](https://agentprime.io/advisories/CVE-2023-32724.md)
  `CVE-2023-32724` · CVE record: Zabbix Zabbix · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 12 Oct 2023 · Tags: Broken access control
- [Inefficient permission check in class CControllerAuthenticationUpdate](https://agentprime.io/advisories/CVE-2023-32723.md)
  `CVE-2023-32723` · CVE record: Zabbix Zabbix · CVSS 8.5 High · Not analysed yet · Published 12 Oct 2023 · Tags: Broken access control
- [Stack-buffer Overflow in library module zbxjson](https://agentprime.io/advisories/CVE-2023-32722.md)
  `CVE-2023-32722` · CVE record: Zabbix Zabbix · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 12 Oct 2023 · Tags: Memory corruption
- [Stored XSS in Maps element](https://agentprime.io/advisories/CVE-2023-32721.md)
  `CVE-2023-32721` · CVE record: Zabbix Zabbix · CVSS 7.6 High · Not analysed yet · Published 12 Oct 2023 · Tags: CWE-20
- [Agent 2 package are built with Go version affected by CVE-2023-24538](https://agentprime.io/advisories/CVE-2023-29453.md)
  `CVE-2023-29453` · CVE record: Zabbix Zabbix · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 12 Oct 2023 · Tags: Code injection
- [Insufficient validation of Action form input fields](https://agentprime.io/advisories/CVE-2023-29457.md)
  `CVE-2023-29457` · CVE record: Zabbix Zabbix · CVSS 6.3 Medium · Not analysed yet · Published 13 Jul 2023 · Tags: CWE-20
- [Duktape 2.6 bug crashes JavaScript putting too many values in valstack.](https://agentprime.io/advisories/CVE-2023-29458.md)
  `CVE-2023-29458` · CVE record: Zabbix Zabbix · CVSS 5.9 Medium · Not analysed yet · Published 13 Jul 2023 · Tags: CWE-129
- [Inefficient URL schema validation](https://agentprime.io/advisories/CVE-2023-29456.md)
  `CVE-2023-29456` · CVE record: Zabbix Zabbix · CVSS 5.7 Medium · Not analysed yet · Published 13 Jul 2023 · Tags: CWE-20
- [Reflected XSS in several fields of graph form](https://agentprime.io/advisories/CVE-2023-29455.md)
  `CVE-2023-29455` · CVE record: Zabbix Zabbix · CVSS 5.4 Medium · Not analysed yet · Published 13 Jul 2023 · Tags: CWE-20
- [Persistent XSS in the user form](https://agentprime.io/advisories/CVE-2023-29454.md)
  `CVE-2023-29454` · CVE record: Zabbix Zabbix · CVSS 5.4 Medium · Not analysed yet · Published 13 Jul 2023 · Tags: CWE-20
- [Remove possibility to add html into Geomap attribution field](https://agentprime.io/advisories/CVE-2023-29452.md)
  `CVE-2023-29452` · CVE record: Zabbix Zabbix · CVSS 5.5 Medium · EPSS 0.64 · Not analysed yet · Published 13 Jul 2023 · Tags: CWE-20
- [Denial of service caused by a bug in the JSON parser](https://agentprime.io/advisories/CVE-2023-29451.md)
  `CVE-2023-29451` · CVE record: Zabbix Zabbix · CVSS 4.7 Medium · Not analysed yet · Published 13 Jul 2023 · Tags: CWE-20
- [Unauthorized limited filesystem access from preprocessing](https://agentprime.io/advisories/CVE-2023-29450.md)
  `CVE-2023-29450` · CVE record: Zabbix Zabbix · CVSS 8.5 High · Not analysed yet · Published 13 Jul 2023 · Tags: Information disclosure
- [Limited control of resource utilization in JS preprocessing](https://agentprime.io/advisories/CVE-2023-29449.md)
  `CVE-2023-29449` · CVE record: Zabbix Zabbix · CVSS 5.9 Medium · Not analysed yet · Published 13 Jul 2023 · Tags: Denial of service
- [Zabbix 2.0.9 has an Arbitrary Command Execution Vulnerability](https://agentprime.io/advisories/CVE-2013-3628.md)
  `CVE-2013-3628` · CVE record: Zabbix Zabbix · No CVSS score · EPSS 0.67 · Not analysed yet · Published 7 Feb 2020

Newest: <https://agentprime.io/advisories/technology/zabbix.md>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?technology=zabbix&cursor=WyIyMDI0LTA4LTA5VDA5OjQwOjMzLjMwMjAwMFoiLCJDVkUtMjAyNC0zNjQ2MiJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/technology/zabbix/?cursor=WyIyMDI0LTA4LTA5VDA5OjQwOjMzLjMwMjAwMFoiLCJDVkUtMjAyNC0zNjQ2MiJd>. Everything for agents: <https://agentprime.io/llms.txt>.