Advisories · Technology
Zabbix.
Every CVE that names Zabbix among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 9.1 CriticalCritical · CVSS 9+
Direct access to memory pointers within the JS engine for modification
- Zabbix
- Memory corruption
- CVSS 8.1 High
Front-end audit log shows passwords in plaintext
- Zabbix
- CWE-256
- CVSS 3.0 Low
AT(GSM) Command Injection
- Zabbix
- Command injection
- CVSS 6.1 Medium
Zabbix Agent MSI Installer Allows Non-Admin User to Access Change Option via msiexec.exe
- Zabbix
- CWE-281
- CVSS 9.1 CriticalCritical · CVSS 9+, CVSS 7+ and EPSS
Time Based SQL Injection in Zabbix Server Audit Log
- Zabbix
- CWE-20
- CVSS 5.5 Medium
Stored XSS in graph items select form
- Zabbix
- CWE-20
- CVSS 4.6 Medium
Code injection in zabbix_agent2 smart.disk.get caused by smartctl plugin
- Zabbix
- CWE-20
- CVSS 6.8 Medium
Code execution vulnerability in icmpping
- Zabbix
- CWE-20
- CVSS 3.9 Low
Possible buffer overread from reading DNS responses
- Zabbix
- CWE-754
- CVSS 9.6 CriticalCritical · CVSS 9+
Leak of zbx_session cookie when using a scheduled report that includes a dashboard with a URL widget.
- Zabbix
- CWE-565
- CVSS 9.1 CriticalCritical · CVSS 9+
JavaScript engine memory pointers are directly available for Zabbix users for modification
- Zabbix
- Broken access control
- CVSS 8.5 High
Inefficient permission check in class CControllerAuthenticationUpdate
- Zabbix
- Broken access control
- CVSS 9.6 CriticalCritical · CVSS 9+
Stack-buffer Overflow in library module zbxjson
- Zabbix
- Memory corruption
- CVSS 7.6 High
Stored XSS in Maps element
- Zabbix
- CWE-20
- CVSS 9.8 CriticalCritical · CVSS 9+
Agent 2 package are built with Go version affected by CVE-2023-24538
- Zabbix
- Code injection
- CVSS 6.3 Medium
Insufficient validation of Action form input fields
- Zabbix
- CWE-20
- CVSS 5.9 Medium
Duktape 2.6 bug crashes JavaScript putting too many values in valstack.
- Zabbix
- CWE-129
- CVSS 5.7 Medium
Inefficient URL schema validation
- Zabbix
- CWE-20
- CVSS 5.4 Medium
Reflected XSS in several fields of graph form
- Zabbix
- CWE-20
- CVSS 5.4 Medium
Persistent XSS in the user form
- Zabbix
- CWE-20
- CVSS 5.5 Medium
Remove possibility to add html into Geomap attribution field
- Zabbix
- CWE-20
- CVSS 4.7 Medium
Denial of service caused by a bug in the JSON parser
- Zabbix
- CWE-20
- CVSS 8.5 High
Unauthorized limited filesystem access from preprocessing
- Zabbix
- Information disclosure
- CVSS 5.9 Medium
Limited control of resource utilization in JS preprocessing
- Zabbix
- Denial of service
-
Zabbix 2.0.9 has an Arbitrary Command Execution Vulnerability
- Zabbix