Zabbix vulnerabilities
100 CVEs and advisories name Zabbix as an affected vendor, 2 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2024-36461Direct access to memory pointers within the JS engine for modification
- CVE-2024-36460Front-end audit log shows passwords in plaintext
- CVE-2024-22122AT(GSM) Command Injection
- CVE-2024-22121Zabbix Agent MSI Installer Allows Non-Admin User to Access Change Option via msiexec.exe
- CVE-2024-22120Time Based SQL Injection in Zabbix Server Audit Log
- CVE-2024-22119Stored XSS in graph items select form
- CVE-2023-32728Code injection in zabbix_agent2 smart.disk.get caused by smartctl plugin
- CVE-2023-32727Code execution vulnerability in icmpping
- CVE-2023-32726Possible buffer overread from reading DNS responses
- CVE-2023-32725Leak of zbx_session cookie when using a scheduled report that includes a dashboard with a URL widget.
- CVE-2023-32724JavaScript engine memory pointers are directly available for Zabbix users for modification
- CVE-2023-32723Inefficient permission check in class CControllerAuthenticationUpdate
- CVE-2023-32722Stack-buffer Overflow in library module zbxjson
- CVE-2023-32721Stored XSS in Maps element
- CVE-2023-29453Agent 2 package are built with Go version affected by CVE-2023-24538
- CVE-2023-29457Insufficient validation of Action form input fields
- CVE-2023-29458Duktape 2.6 bug crashes JavaScript putting too many values in valstack.
- CVE-2023-29456Inefficient URL schema validation
- CVE-2023-29455Reflected XSS in several fields of graph form
- CVE-2023-29454Persistent XSS in the user form
- CVE-2023-29452Remove possibility to add html into Geomap attribution field
- CVE-2023-29451Denial of service caused by a bug in the JSON parser
- CVE-2023-29450Unauthorized limited filesystem access from preprocessing
- CVE-2023-29449Limited control of resource utilization in JS preprocessing
- CVE-2022-46768File name information disclosure vulnerability in Zabbix Web Service Report Generation
- CVE-2022-43516Zabbix Agent installer adds “allow all TCP any any” firewall rule
- CVE-2022-43515X-Forwarded-For header is active by default causes access to Zabbix sites in maintenance mode
- CVE-2022-40626Reflected XSS in the backurl parameter of Zabbix Frontend
- CVE-2022-35230Reflected XSS in graphs page of Zabbix Frontend
- CVE-2022-35229Reflected XSS in discovery page of Zabbix Frontend