agentprime: zabbix

agentprime: zabbixEvery new CVE for zabbix.https://agentprime.io/CVE-2026-59788: Stored XSS vulnerability in OAuth configuration formhttps://agentprime.io/advisories/CVE-2026-59788/https://agentprime.io/advisories/CVE-2026-59788/CVSS 5.6 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 05 Oct 2026 10:29:43 GMTCVECVE-2026-59787: SNMP trap injection in zabbix_trap_receiver.plhttps://agentprime.io/advisories/CVE-2026-59787/https://agentprime.io/advisories/CVE-2026-59787/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 05 Oct 2026 10:29:20 GMTCVECVE-2026-59786: Active agent heartbeat missing TLS checkhttps://agentprime.io/advisories/CVE-2026-59786/https://agentprime.io/advisories/CVE-2026-59786/CVSS 6.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 05 Oct 2026 10:29:01 GMTCVECVE-2026-59785: Hidden host credentials inferable via multiselect.get filteringhttps://agentprime.io/advisories/CVE-2026-59785/https://agentprime.io/advisories/CVE-2026-59785/CVSS 5.1 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 05 Oct 2026 10:28:30 GMTCVECVE-2026-59783: Server DoS via binary itemshttps://agentprime.io/advisories/CVE-2026-59783/https://agentprime.io/advisories/CVE-2026-59783/CVSS 2.3 (Low). Published by the CVE Program. Not analysed by agentprime yet.Mon, 05 Oct 2026 10:28:09 GMTCVECVE-2026-59782: JavaScript preprocessing memory disclosurehttps://agentprime.io/advisories/CVE-2026-59782/https://agentprime.io/advisories/CVE-2026-59782/CVSS 6.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 05 Oct 2026 10:27:34 GMTCVECVE-2026-59781: Improper validation of custom installation directories on Windows could allow installation into locations with unsafe permissions, increasing the risk of DLL sideloading.https://agentprime.io/advisories/CVE-2026-59781/https://agentprime.io/advisories/CVE-2026-59781/CVSS 5.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 18 Aug 2026 12:21:29 GMTCVECVE-2026-23938: Server DoS via JavaScript preprocessing or script itemshttps://agentprime.io/advisories/CVE-2026-23938/https://agentprime.io/advisories/CVE-2026-23938/CVSS 2.1 (Low). Published by the CVE Program. Not analysed by agentprime yet.Tue, 18 Aug 2026 12:20:52 GMTCVECVE-2026-23937: Host PSK extraction in Zabbix APIhttps://agentprime.io/advisories/CVE-2026-23937/https://agentprime.io/advisories/CVE-2026-23937/CVSS 6.0 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 18 Aug 2026 12:20:16 GMTCVECVE-2026-23935: Use-after-free read in script item/preprocessing HttpRequest bodyhttps://agentprime.io/advisories/CVE-2026-23935/https://agentprime.io/advisories/CVE-2026-23935/CVSS 6.8 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 18 Aug 2026 12:19:38 GMTCVECVE-2026-23934: Frontend DoS via the validate.api.exists actionhttps://agentprime.io/advisories/CVE-2026-23934/https://agentprime.io/advisories/CVE-2026-23934/CVSS 5.1 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 18 Aug 2026 12:18:53 GMTCVECVE-2026-23933: Hardcoded session key in Zabbix 7.4https://agentprime.io/advisories/CVE-2026-23933/https://agentprime.io/advisories/CVE-2026-23933/CVSS 7.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 18 Aug 2026 12:18:09 GMTCVECVE-2026-23931: Frontend plaintext macro value enumeration via the validatate.api.exists actionhttps://agentprime.io/advisories/CVE-2026-23931/https://agentprime.io/advisories/CVE-2026-23931/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 18 Aug 2026 12:17:38 GMTCVECVE-2026-23930: Frontend DoS via the popup.testtriggerexpr actionhttps://agentprime.io/advisories/CVE-2026-23930/https://agentprime.io/advisories/CVE-2026-23930/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 18 Aug 2026 12:17:01 GMTCVECVE-2026-23929: Prototype pollution leading to stored XSShttps://agentprime.io/advisories/CVE-2026-23929/https://agentprime.io/advisories/CVE-2026-23929/CVSS 8.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 18 Aug 2026 12:16:15 GMTCVECVE-2026-1199: API and Frontend login lockout race conditionhttps://agentprime.io/advisories/CVE-2026-1199/https://agentprime.io/advisories/CVE-2026-1199/CVSS 6.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 18 Aug 2026 12:15:29 GMTCVECVE-2026-23922: Email media OAuth secret leak to Super Adminhttps://agentprime.io/advisories/CVE-2026-23922/https://agentprime.io/advisories/CVE-2026-23922/CVSS 2.1 (Low). Published by the CVE Program. Not analysed by agentprime yet.Tue, 18 Aug 2026 12:13:38 GMTCVECVE-2026-23928: Stored XSS vulnerability in the Item history/Plain text widgethttps://agentprime.io/advisories/CVE-2026-23928/https://agentprime.io/advisories/CVE-2026-23928/CVSS 7.3 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 06 May 2026 07:00:33 GMTCVECVE-2026-23927: Agent 2 Oracle plugin TNS connection string injection via the 'service' parameterhttps://agentprime.io/advisories/CVE-2026-23927/https://agentprime.io/advisories/CVE-2026-23927/CVSS 5.1 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 06 May 2026 06:59:42 GMTCVECVE-2026-23926: Stored XSS vulnerability in Host navigator widget maintenance tooltiphttps://agentprime.io/advisories/CVE-2026-23926/https://agentprime.io/advisories/CVE-2026-23926/CVSS 7.3 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 06 May 2026 06:58:51 GMTCVECVE-2026-23924: Agent 2 Docker plugin arbitrary file read via Docker API injectionhttps://agentprime.io/advisories/CVE-2026-23924/https://agentprime.io/advisories/CVE-2026-23924/CVSS 6.1 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 24 Mar 2026 18:30:00 GMTCVECVE-2026-23923: Unauthenticated arbitrary PHP class instantiationhttps://agentprime.io/advisories/CVE-2026-23923/https://agentprime.io/advisories/CVE-2026-23923/CVSS 6.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 24 Mar 2026 18:29:23 GMTCVECVE-2026-23921: Blind, read-only SQL injection in Zabbix API via sortfield parameterhttps://agentprime.io/advisories/CVE-2026-23921/https://agentprime.io/advisories/CVE-2026-23921/CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 24 Mar 2026 18:28:41 GMTCVECVE-2026-23920: Host and event action script regex validation can be bypassed in certain situations, leading to potential command injectionhttps://agentprime.io/advisories/CVE-2026-23920/https://agentprime.io/advisories/CVE-2026-23920/CVSS 7.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 24 Mar 2026 18:27:52 GMTCVECVE-2026-23919: Insufficient isolation of JavaScript (Duktape) execution context on Zabbix Serverhttps://agentprime.io/advisories/CVE-2026-23919/https://agentprime.io/advisories/CVE-2026-23919/CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 24 Mar 2026 18:26:43 GMTCVECVE-2026-23925: Unauthorized host creation via configuration.import API by low-privilege user with write permissionshttps://agentprime.io/advisories/CVE-2026-23925/https://agentprime.io/advisories/CVE-2026-23925/CVSS 5.1 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 06 Mar 2026 08:24:15 GMTCVECVE-2025-49643: Frontend DoS vulnerability due to asymmetric resource consumptionhttps://agentprime.io/advisories/CVE-2025-49643/https://agentprime.io/advisories/CVE-2025-49643/CVSS 6.0 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 01 Dec 2025 13:05:33 GMTCVECVE-2025-49642: Agent builds for AIX vulnerable to library loading hijackinghttps://agentprime.io/advisories/CVE-2025-49642/https://agentprime.io/advisories/CVE-2025-49642/CVSS 5.8 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 01 Dec 2025 13:03:38 GMTCVECVE-2025-27232: Frontend arbitrary file read in oauth.authorize actionhttps://agentprime.io/advisories/CVE-2025-27232/https://agentprime.io/advisories/CVE-2025-27232/CVSS 6.8 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 01 Dec 2025 12:55:51 GMTCVECVE-2025-49641: Insufficient permission check for the problem.view.refresh actionhttps://agentprime.io/advisories/CVE-2025-49641/https://agentprime.io/advisories/CVE-2025-49641/CVSS 5.1 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 03 Oct 2025 11:29:26 GMTCVECVE-2025-27237: DLL injection in Zabbix Agent and Agent 2 via OpenSSL configurationhttps://agentprime.io/advisories/CVE-2025-27237/https://agentprime.io/advisories/CVE-2025-27237/CVSS 7.3 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 03 Oct 2025 11:28:43 GMTCVECVE-2025-27236: User information disclosure via api_jsonrpc.php on method user.get with param searchhttps://agentprime.io/advisories/CVE-2025-27236/https://agentprime.io/advisories/CVE-2025-27236/CVSS 2.1 (Low). Published by the CVE Program. Not analysed by agentprime yet.Fri, 03 Oct 2025 11:28:09 GMTCVECVE-2025-27231: LDAP 'Bind password' field value can be leaked by a Zabbix Super Adminhttps://agentprime.io/advisories/CVE-2025-27231/https://agentprime.io/advisories/CVE-2025-27231/CVSS 4.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 03 Oct 2025 11:25:14 GMTCVECVE-2025-27240: Secondary-order SQL injection in Zabbix Server when deleting an autoregistered hosthttps://agentprime.io/advisories/CVE-2025-27240/https://agentprime.io/advisories/CVE-2025-27240/CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 12 Sep 2025 10:33:46 GMTCVECVE-2025-27238: API hostprototype.get lists data to users with insufficient authorization.https://agentprime.io/advisories/CVE-2025-27238/https://agentprime.io/advisories/CVE-2025-27238/CVSS 2.1 (Low). Published by the CVE Program. Not analysed by agentprime yet.Fri, 12 Sep 2025 10:33:17 GMTCVECVE-2025-27233: Zabbix Agent 2 smartctl plugin argument injection in Zabbix 6.0 and later.https://agentprime.io/advisories/CVE-2025-27233/https://agentprime.io/advisories/CVE-2025-27233/CVSS 5.7 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 12 Sep 2025 10:32:36 GMTCVECVE-2025-27234: Zabbix Agent 2 smartctl plugin RCE vulnerability in Zabbix 5.0.https://agentprime.io/advisories/CVE-2025-27234/https://agentprime.io/advisories/CVE-2025-27234/CVSS 7.3 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 12 Sep 2025 10:31:58 GMTCVECVE-2024-45700: DoS vulnerability due to uncontrolled resource exhaustionhttps://agentprime.io/advisories/CVE-2024-45700/https://agentprime.io/advisories/CVE-2024-45700/CVSS 6.0 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 02 Apr 2025 06:13:26 GMTCVECVE-2024-45699: Reflected XSS vulnerability in /zabbix.php?action=export.valuemapshttps://agentprime.io/advisories/CVE-2024-45699/https://agentprime.io/advisories/CVE-2024-45699/CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 02 Apr 2025 06:12:58 GMTCVECVE-2024-42325: Excessive information returned by user.gethttps://agentprime.io/advisories/CVE-2024-42325/https://agentprime.io/advisories/CVE-2024-42325/CVSS 2.1 (Low). Published by the CVE Program. Not analysed by agentprime yet.Wed, 02 Apr 2025 06:12:24 GMTCVECVE-2024-36469: User enumeration via timing attack in Zabbix web interfacehttps://agentprime.io/advisories/CVE-2024-36469/https://agentprime.io/advisories/CVE-2024-36469/CVSS 2.3 (Low). Published by the CVE Program. Not analysed by agentprime yet.Wed, 02 Apr 2025 06:11:55 GMTCVECVE-2024-36465: SQL injection in Zabbix APIhttps://agentprime.io/advisories/CVE-2024-36465/https://agentprime.io/advisories/CVE-2024-36465/CVSS 8.6 (High). Critical: CVSS score 8.6 (7.0 or more) and EPSS 0.40 (0.1 or more): a high score and a real chance of exploitation in the next 30 days. Published by the CVE Program. Not analysed by agentprime yet.Wed, 02 Apr 2025 06:11:26 GMTCVEcriticalCVE-2024-36466: Unauthenticated Zabbix frontend takeover when SSO is being usedhttps://agentprime.io/advisories/CVE-2024-36466/https://agentprime.io/advisories/CVE-2024-36466/CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 28 Nov 2024 07:19:48 GMTCVECVE-2024-36464: Media Types: Office365, SMTP passwords are unencrypted and visible in plaintext when exportedhttps://agentprime.io/advisories/CVE-2024-36464/https://agentprime.io/advisories/CVE-2024-36464/CVSS 2.7 (Low). Published by the CVE Program. Not analysed by agentprime yet.Wed, 27 Nov 2024 14:01:58 GMTCVECVE-2024-42333: Heap buffer over-readhttps://agentprime.io/advisories/CVE-2024-42333/https://agentprime.io/advisories/CVE-2024-42333/CVSS 2.7 (Low). Published by the CVE Program. Not analysed by agentprime yet.Wed, 27 Nov 2024 12:07:11 GMTCVECVE-2024-42332: New line injection in Zabbix SNMP trapshttps://agentprime.io/advisories/CVE-2024-42332/https://agentprime.io/advisories/CVE-2024-42332/CVSS 3.7 (Low). Published by the CVE Program. Not analysed by agentprime yet.Wed, 27 Nov 2024 12:06:44 GMTCVECVE-2024-42331: Use after free in browser_push_errorhttps://agentprime.io/advisories/CVE-2024-42331/https://agentprime.io/advisories/CVE-2024-42331/CVSS 3.3 (Low). Published by the CVE Program. Not analysed by agentprime yet.Wed, 27 Nov 2024 12:06:12 GMTCVECVE-2024-42330: JS - Internal strings in HTTP headershttps://agentprime.io/advisories/CVE-2024-42330/https://agentprime.io/advisories/CVE-2024-42330/CVSS 9.1 (Critical). Critical: CVSS score 9.1: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Wed, 27 Nov 2024 12:05:47 GMTCVEcriticalCVE-2024-42329: JS - Crash on unexpected HTTP server responsehttps://agentprime.io/advisories/CVE-2024-42329/https://agentprime.io/advisories/CVE-2024-42329/CVSS 3.3 (Low). Published by the CVE Program. Not analysed by agentprime yet.Wed, 27 Nov 2024 12:05:21 GMTCVECVE-2024-42328: JS - Crash on empty HTTP server responsehttps://agentprime.io/advisories/CVE-2024-42328/https://agentprime.io/advisories/CVE-2024-42328/CVSS 3.3 (Low). Published by the CVE Program. Not analysed by agentprime yet.Wed, 27 Nov 2024 12:04:53 GMTCVE