Filtered by vendor Zabbix Subscriptions
Filtered by product Zabbix Subscriptions
Total 110 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2011-4674 1 Zabbix 1 Zabbix 2025-04-11 N/A
SQL injection vulnerability in popup.php in Zabbix 1.8.3 and 1.8.4, and possibly other versions before 1.8.9, allows remote attackers to execute arbitrary SQL commands via the only_hostid parameter.
CVE-2013-1364 1 Zabbix 1 Zabbix 2025-04-11 N/A
The user.login function in Zabbix before 1.8.16 and 2.x before 2.0.5rc1 allows remote attackers to override LDAP configuration via the cnf parameter.
CVE-2012-3435 1 Zabbix 1 Zabbix 2025-04-11 N/A
SQL injection vulnerability in frontends/php/popup_bitem.php in Zabbix 1.8.15rc1 and earlier, and 2.x before 2.0.2rc1, allows remote attackers to execute arbitrary SQL commands via the itemid parameter.
CVE-2011-4615 1 Zabbix 1 Zabbix 2025-04-11 N/A
Multiple cross-site scripting (XSS) vulnerabilities in Zabbix before 1.8.10 allow remote attackers to inject arbitrary web script or HTML via the gname parameter (aka host groups name) to (1) hostgroups.php and (2) usergrps.php, the update action to (3) hosts.php and (4) scripts.php, and (5) maintenance.php.
CVE-2011-3265 1 Zabbix 1 Zabbix 2025-04-11 N/A
popup.php in Zabbix before 1.8.7 allows remote attackers to read the contents of arbitrary database tables via a modified srctbl parameter.
CVE-2013-5572 1 Zabbix 1 Zabbix 2025-04-11 N/A
Zabbix 2.0.5 allows remote authenticated users to discover the LDAP bind password by leveraging management-console access and reading the ldap_bind_password value in the HTML source code.
CVE-2010-5049 1 Zabbix 1 Zabbix 2025-04-11 N/A
SQL injection vulnerability in events.php in Zabbix 1.8.1 and earlier allows remote attackers to execute arbitrary SQL commands via the nav_time parameter.
CVE-2011-5027 1 Zabbix 1 Zabbix 2025-04-11 N/A
Cross-site scripting (XSS) vulnerability in ZABBIX before 1.8.10 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to the profiler.
CVE-2011-3264 1 Zabbix 1 Zabbix 2025-04-11 N/A
Zabbix before 1.8.6 allows remote attackers to obtain sensitive information via an invalid srcfld2 parameter to popup.php, which reveals the installation path in an error message.
CVE-2010-2790 1 Zabbix 1 Zabbix 2025-04-11 N/A
Multiple cross-site scripting (XSS) vulnerabilities in the formatQuery function in frontends/php/include/classes/class.curl.php in Zabbix before 1.8.3rc1 allow remote attackers to inject arbitrary web script or HTML via the (1) filter_set, (2) show_details, (3) filter_rst, or (4) txt_select parameters to the triggers page (tr_status.php). NOTE: some of these details are obtained from third party information.
CVE-2023-32723 1 Zabbix 1 Zabbix 2025-02-13 8.5 High
Request to LDAP is sent before user permissions are checked.
CVE-2023-29451 1 Zabbix 1 Zabbix 2025-02-13 4.7 Medium
Specially crafted string can cause a buffer overrun in the JSON parser library leading to a crash of the Zabbix Server or a Zabbix Proxy.
CVE-2024-22121 1 Zabbix 1 Zabbix 2024-12-10 6.1 Medium
A non-admin user can change or remove important features within the Zabbix Agent application, thus impacting the integrity and availability of the application.
CVE-2024-36462 1 Zabbix 1 Zabbix 2024-12-10 7.5 High
Uncontrolled resource consumption refers to a software vulnerability where a attacker or system uses excessive resources, such as CPU, memory, or network bandwidth, without proper limitations or controls. This can cause a denial-of-service (DoS) attack or degrade the performance of the affected system.
CVE-2023-29452 1 Zabbix 1 Zabbix 2024-11-21 5.5 Medium
Currently, geomap configuration (Administration -> General -> Geographical maps) allows using HTML in the field “Attribution text” when selected “Other” Tile provider.
CVE-2022-40626 2 Fedoraproject, Zabbix 2 Fedora, Zabbix 2024-11-21 4.8 Medium
An unauthenticated user can create a link with reflected Javascript code inside the backurl parameter and send it to other authenticated users in order to create a fake account with predefined login, password and role in Zabbix Frontend.
CVE-2021-46088 1 Zabbix 1 Zabbix 2024-11-21 7.2 High
Zabbix 4.0 LTS, 4.2, 4.4, and 5.0 LTS is vulnerable to Remote Code Execution (RCE). Any user with the "Zabbix Admin" role is able to run custom shell script on the application server in the context of the application user.
CVE-2021-27927 1 Zabbix 1 Zabbix 2024-11-21 8.8 High
In Zabbix from 4.0.x before 4.0.28rc1, 5.0.0alpha1 before 5.0.10rc1, 5.2.x before 5.2.6rc1, and 5.4.0alpha1 before 5.4.0beta2, the CControllerAuthenticationUpdate controller lacks a CSRF protection mechanism. The code inside this controller calls diableSIDValidation inside the init() method. An attacker doesn't have to know Zabbix user login credentials, but has to know the correct Zabbix URL and contact information of an existing user with sufficient privileges.
CVE-2020-15803 4 Debian, Fedoraproject, Opensuse and 1 more 5 Debian Linux, Fedora, Backports and 2 more 2024-11-21 6.1 Medium
Zabbix before 3.0.32rc1, 4.x before 4.0.22rc1, 4.1.x through 4.4.x before 4.4.10rc1, and 5.x before 5.0.2rc1 allows stored XSS in the URL Widget.
CVE-2020-11800 3 Debian, Opensuse, Zabbix 4 Debian Linux, Backports Sle, Leap and 1 more 2024-11-21 9.8 Critical
Zabbix Server 2.2.x and 3.0.x before 3.0.31, and 3.2 allows remote attackers to execute arbitrary code.