Advisories · Technology
Zabbix.
Every CVE that names Zabbix among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 5.6 Medium
Stored XSS vulnerability in OAuth configuration form
- Zabbix
- Cross-site scripting (XSS)
- CVSS 5.3 Medium
SNMP trap injection in zabbix_trap_receiver.pl
- Zabbix
- CWE-143
- CVSS 6.9 Medium
Active agent heartbeat missing TLS check
- Zabbix
- CWE-940
- CVSS 5.1 Medium
Hidden host credentials inferable via multiselect.get filtering
- Zabbix
- CWE-204
- CVSS 2.3 Low
Server DoS via binary items
- Zabbix
- Memory corruption
- CVSS 6.9 Medium
JavaScript preprocessing memory disclosure
- Zabbix
- Memory corruption
- CVSS 5.4 Medium
Improper validation of custom installation directories on Windows could allow installation into locations with unsafe permissions, increasing the risk of DLL sideloading.
- Zabbix
- CWE-427
- CVSS 2.1 Low
Server DoS via JavaScript preprocessing or script items
- Zabbix
- CWE-248
- CVSS 6.0 Medium
Host PSK extraction in Zabbix API
- Zabbix
- Information disclosure
- CVSS 6.8 Medium
Use-after-free read in script item/preprocessing HttpRequest body
- Zabbix
- Memory corruption
- CVSS 5.1 Medium
Frontend DoS via the validate.api.exists action
- Zabbix
- CWE-405
- CVSS 7.7 High
Hardcoded session key in Zabbix 7.4
- Zabbix
- Hard-coded credentials
- CVSS 5.3 Medium
Frontend plaintext macro value enumeration via the validatate.api.exists action
- Zabbix
- Information disclosure
- CVSS 5.3 Medium
Frontend DoS via the popup.testtriggerexpr action
- Zabbix
- CWE-405
- CVSS 8.5 High
Prototype pollution leading to stored XSS
- Zabbix
- Prototype pollution
- CVSS 6.9 Medium
API and Frontend login lockout race condition
- Zabbix
- Race condition
- CVSS 2.1 Low
Email media OAuth secret leak to Super Admin
- Zabbix
- Hard-coded credentials
- CVSS 7.3 High
Stored XSS vulnerability in the Item history/Plain text widget
- Zabbix
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
Agent 2 Oracle plugin TNS connection string injection via the 'service' parameter
- Zabbix
- Hard-coded credentials
- CVSS 7.3 High
Stored XSS vulnerability in Host navigator widget maintenance tooltip
- Zabbix
- Cross-site scripting (XSS)
- CVSS 6.1 Medium
Agent 2 Docker plugin arbitrary file read via Docker API injection
- Zabbix
- Command injection
- CVSS 6.9 Medium
Unauthenticated arbitrary PHP class instantiation
- Zabbix
- Code injection
- CVSS 8.7 High
Blind, read-only SQL injection in Zabbix API via sortfield parameter
- Zabbix
- SQL injection
- CVSS 7.7 High
Host and event action script regex validation can be bypassed in certain situations, leading to potential command injection
- Zabbix
- Command injection
- CVSS 7.1 High
Insufficient isolation of JavaScript (Duktape) execution context on Zabbix Server
- Zabbix
- CWE-488
- CVSS 5.1 Medium
Unauthorized host creation via configuration.import API by low-privilege user with write permissions
- Zabbix
- Broken access control
- CVSS 6.0 Medium
Frontend DoS vulnerability due to asymmetric resource consumption
- Zabbix
- CWE-405
- CVSS 5.8 Medium
Agent builds for AIX vulnerable to library loading hijacking
- Zabbix
- CWE-426
- CVSS 6.8 Medium
Frontend arbitrary file read in oauth.authorize action
- Zabbix
- Server-side request forgery (SSRF)
- CVSS 5.1 Medium
Insufficient permission check for the problem.view.refresh action
- Zabbix
- Broken access control
- CVSS 7.3 High
DLL injection in Zabbix Agent and Agent 2 via OpenSSL configuration
- Zabbix
- CWE-427
- CVSS 2.1 Low
User information disclosure via api_jsonrpc.php on method user.get with param search
- Zabbix
- Broken access control
- CVSS 4.3 Medium
LDAP 'Bind password' field value can be leaked by a Zabbix Super Admin
- Zabbix
- Hard-coded credentials
- CVSS 7.5 High
Secondary-order SQL injection in Zabbix Server when deleting an autoregistered host
- Zabbix
- SQL injection
- CVSS 2.1 Low
API hostprototype.get lists data to users with insufficient authorization.
- Zabbix
- Broken access control
- CVSS 5.7 Medium
Zabbix Agent 2 smartctl plugin argument injection in Zabbix 6.0 and later.
- Zabbix
- Command injection
- CVSS 7.3 High
Zabbix Agent 2 smartctl plugin RCE vulnerability in Zabbix 5.0.
- Zabbix
- Command injection
- CVSS 6.0 Medium
DoS vulnerability due to uncontrolled resource exhaustion
- Zabbix
- Denial of service
- CVSS 7.5 High
Reflected XSS vulnerability in /zabbix.php?action=export.valuemaps
- Zabbix
- Cross-site scripting (XSS)
- CVSS 2.1 Low
Excessive information returned by user.get
- Zabbix
- Information disclosure
- CVSS 2.3 Low
User enumeration via timing attack in Zabbix web interface
- Zabbix
- CWE-208
- CVSS 8.6 HighCritical · CVSS 7+ and EPSS
SQL injection in Zabbix API
- Zabbix
- SQL injection
- CVSS 8.8 High
Unauthenticated Zabbix frontend takeover when SSO is being used
- Zabbix
- Authentication bypass
- CVSS 2.7 Low
Media Types: Office365, SMTP passwords are unencrypted and visible in plaintext when exported
- Zabbix
- CWE-256
- CVSS 2.7 Low
Heap buffer over-read
- Zabbix
- CWE-126
- CVSS 3.7 Low
New line injection in Zabbix SNMP traps
- Zabbix
- CVSS 3.3 Low
Use after free in browser_push_error
- Zabbix
- Memory corruption
- CVSS 9.1 CriticalCritical · CVSS 9+
JS - Internal strings in HTTP headers
- Zabbix
- Memory corruption
- CVSS 3.3 Low
JS - Crash on unexpected HTTP server response
- Zabbix
- Memory corruption
- CWE-690
- CVSS 3.3 Low
JS - Crash on empty HTTP server response
- Zabbix
- Memory corruption
- CWE-690
- CVSS 9.9 CriticalCritical · CVSS 9+, CVSS 7+ and EPSS
SQL injection in user.get API
- Zabbix
- SQL injection
- CVSS 4.4 Medium
Use after free vulnerability in browser.c
- Zabbix
- Memory corruption
- CVSS 3.0 Low
Stack buffer overflow in zbx_snmp_cache_handle_engineid
- Zabbix
- Memory corruption
- CVSS 7.5 High
Authentication privilege escalation via user groups due to missing authorization checks
- Zabbix
- Broken access control
- CVSS 6.5 Medium
Zabbix: The implementation of atob in "Zabbix JS" allows to create a string with arbitrary…
- Zabbix
- CWE-767
- CVSS 2.2 Low
Value of sysmap_element_url can be de-synchronized causing the map element to crash when new URLs is added
- Zabbix
- CWE-20
- CVSS 2.7 Low
Zabbix Arbitrary File Read
- Zabbix
- Code injection
- CVSS 9.9 CriticalCritical · CVSS 9+
Remote code execution within ping script
- Zabbix
- Code injection
- CVSS 4.3 Medium
System Information Widget in Global View Dashboard exposes information about Hosts to Users without Permission
- Zabbix
- CWE-281
- CVSS 7.5 High
Allocation of resources without limits or throttling (uncontrolled resource consumption)
- Zabbix
- Denial of service