Vulmon
Recent Vulnerabilities
Research Posts
Trends
Blog
About
Contact
Vulmon Alerts
By Relevance
By Risk Score
By Publish Date
zabbix zabbix vulnerabilities and exploits
(subscribe to this query)
5
CVSSv2
CVE-2019-15132
Zabbix up to and including 4.4.0alpha1 allows User Enumeration. With login requests, it is possible to enumerate application usernames based on the variability of server responses (e.g., the "Login name or password is incorrect" and "No permissions for system acces...
Zabbix Zabbix 4.4.0
Zabbix Zabbix
Debian Debian Linux 9.0
3.5
CVSSv2
CVE-2022-23133
An authenticated user can create a hosts group from the configuration with XSS payload, which will be available for other users. When XSS is stored by an authenticated malicious actor and other users try to search for groups during new host creation, the XSS payload will fire and...
Zabbix Zabbix
Zabbix Zabbix 6.0.0
Fedoraproject Fedora 34
Fedoraproject Fedora 35
NA
CVE-2022-43515
Zabbix Frontend provides a feature that allows admins to maintain the installation and ensure that only certain IP addresses can access it. In this way, any user will not be able to access the Zabbix Frontend while it is being maintained and possible sensitive data will be preven...
Zabbix Frontend 6.2.5
Zabbix Frontend 6.0.11
Zabbix Frontend 5.0.30
Zabbix Frontend
7.5
CVSSv2
CVE-2022-23132
During Zabbix installation from RPM, DAC_OVERRIDE SELinux capability is in use to access PID files in [/var/run/zabbix] folder. In this case, Zabbix Proxy or Server processes can bypass file read, write and execute permissions check on the file system level
Zabbix Zabbix 6.0.0
Zabbix Zabbix
Fedoraproject Fedora 34
Fedoraproject Fedora 35
NA
CVE-2023-29450
JavaScript pre-processing can be used by the malicious user to gain access to the file system (read-only access on behalf of user "zabbix") on the Zabbix Server or Zabbix Proxy, potentially leading to unauthorized access to sensitive data.
Zabbix Zabbix
6.4
CVSSv2
CVE-2019-17382
An issue exists in zabbix.php?action=dashboard.view&dashboardid=1 in Zabbix up to and including 4.4. An attacker can bypass the login page and access the dashboard page, and then create a Dashboard, Report, Screen, or Map without any Username/Password (i.e., anonymously). All...
Zabbix Zabbix
1 Github repository
6.8
CVSSv2
CVE-2021-27927
In Zabbix from 4.0.x prior to 4.0.28rc1, 5.0.0alpha1 prior to 5.0.10rc1, 5.2.x prior to 5.2.6rc1, and 5.4.0alpha1 prior to 5.4.0beta2, the CControllerAuthenticationUpdate controller lacks a CSRF protection mechanism. The code inside this controller calls diableSIDValidation insid...
Zabbix Zabbix
7.5
CVSSv2
CVE-2013-5743
Multiple SQL injection vulnerabilities in Zabbix 1.8.x prior to 1.8.18rc1, 2.0.x prior to 2.0.9rc1, and 2.1.x prior to 2.1.7.
Zabbix Zabbix
1 EDB exploit
6.5
CVSSv2
CVE-2021-46088
Zabbix 4.0 LTS, 4.2, 4.4, and 5.0 LTS is vulnerable to Remote Code Execution (RCE). Any user with the "Zabbix Admin" role is able to run custom shell script on the application server in the context of the application user.
Zabbix Zabbix
1 Github repository
NA
CVE-2022-46768
Arbitrary file read vulnerability exists in Zabbix Web Service Report Generation, which listens on the port 10053. The service does not have proper validation for URL parameters before reading the files.
Zabbix Zabbix-agent2
Zabbix Web Service Report Generation
CVSSv2
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2020-4463
CVE-2024-29895
inject
CVE-2023-52689
CVE-2024-5049
CVE-2024-5051
privilege escalation
physical
CVE-2023-52676
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started
« PREV
1
2
3
4
5
6
7
8
9
NEXT »