128 results · Feed
-
Critical 9.9
SQL injection in user.get API
A non-admin user account on the Zabbix frontend with the default User role, or with any other role that gives API access can exploit this vulnerability. An SQLi exists in the CUser class in the addRelatedObjects function, this function is being called from th…
-
Medium 4.4
Use after free vulnerability in browser.c
There was discovered a use after free bug in browser.c in the es_browser_get_variant function
-
Low 3.0
Stack buffer overflow in zbx_snmp_cache_handle_engineid
The reported vulnerability is a stack buffer overflow in the zbx_snmp_cache_handle_engineid function within the Zabbix server/proxy code. This issue occurs when copying data from session->securityEngineID to local_record.engineid without proper bounds checkin…
-
High 7.5
Authentication privilege escalation via user groups due to missing authorization checks
An authenticated user with API access (e.g.: user with default User role), more specifically a user with access to the user.update API endpoint is enough to be able to add themselves to any group (e.g.: Zabbix Administrators), except to groups that are disabl…
-
Medium 6.5
The implementation of atob in "Zabbix JS" allows to create a string with arbitrary content and use it to access interna…
-
Low 2.2
Value of sysmap_element_url can be de-synchronized causing the map element to crash when new URLs is added
When a URL is added to the map element, it is recorded in the database with sequential IDs. Upon adding a new URL, the system retrieves the last sysmapelementurlid value and increments it by one. However, an issue arises when a user manually changes the sysma…
-
Low 2.7
Zabbix Arbitrary File Read
Setting SMS media allows to set GSM modem file. Later this file is used as Linux device. But due everything is a file for Linux, it is possible to set another file, e.g. log file and zabbix_server will try to communicate with it as modem. As a result, log fil…
-
Critical 9.9
Remote code execution within ping script
An administrator with restricted permissions can exploit the script execution functionality within the Monitoring Hosts section. The lack of default escaping for script parameters enabled this user ability to execute arbitrary code via the Ping script, thereb…
-
Medium 4.3
System Information Widget in Global View Dashboard exposes information about Hosts to Users without Permission
User with no permission to any of the Hosts can access and view host count & other statistics through System Information Widget in Global View Dashboard.
-
High 7.5
Allocation of resources without limits or throttling (uncontrolled resource consumption)
Uncontrolled resource consumption refers to a software vulnerability where a attacker or system uses excessive resources, such as CPU, memory, or network bandwidth, without proper limitations or controls. This can cause a denial-of-service (DoS) attack or deg…
-
Critical 9.1
Direct access to memory pointers within the JS engine for modification
Within Zabbix, users have the ability to directly modify memory pointers in the JavaScript engine.
-
High 8.1
Front-end audit log shows passwords in plaintext
The front-end audit log allows viewing of unprotected plaintext passwords, where the passwords are displayed in plain text.
-
Low 3.0
AT(GSM) Command Injection
Zabbix allows to configure SMS notifications. AT command injection occurs on "Zabbix Server" because there is no validation of "Number" field on Web nor on Zabbix server side. Attacker can run test of SMS providing specially crafted phone number and execute a…
-
Critical 9.1
Time Based SQL Injection in Zabbix Server Audit Log
Zabbix server can perform command execution for configured scripts. After command is executed, audit entry is added to "Audit Log". Due to "clientip" field is not sanitized, it is possible to injection SQL into "clientip" and exploit time based blind SQL inje…
-
Medium 5.5
Stored XSS in graph items select form
The cause of vulnerability is improper validation of form input field “Name” on Graph page in Items section.
-
Medium 4.6
Code injection in zabbix_agent2 smart.disk.get caused by smartctl plugin
The Zabbix Agent 2 item key smart.disk.get does not sanitize its parameters before passing them to a shell command resulting possible vulnerability for remote code execution.
-
Medium 6.8
Code execution vulnerability in icmpping
An attacker who has the privilege to configure Zabbix items can use function icmpping() with additional malicious command inside it to execute arbitrary code on the current Zabbix server.
-
Low 3.9
Possible buffer overread from reading DNS responses
The vulnerability is caused by improper check for check if RDLENGTH does not overflow the buffer in response from DNS server.
-
Critical 9.6
Leak of zbx_session cookie when using a scheduled report that includes a dashboard with a URL widget.
The website configured in the URL widget will receive a session cookie when testing or executing scheduled reports. The received session cookie can then be used to access the frontend as the particular user.
-
Critical 9.1
JavaScript engine memory pointers are directly available for Zabbix users for modification
Memory pointer is in a property of the Ducktape object. This leads to multiple vulnerabilities related to direct memory access and manipulation.
-
High 8.5
Inefficient permission check in class CControllerAuthenticationUpdate
Request to LDAP is sent before user permissions are checked.
-
Critical 9.6
Stack-buffer Overflow in library module zbxjson
The zabbix/src/libs/zbxjson module is vulnerable to a buffer overflow when parsing JSON files via zbx_json_open.
-
High 7.6
Stored XSS in Maps element
A stored XSS has been found in the Zabbix web application in the Maps element if a URL field is set with spaces before URL.
-
Critical 9.8
Agent 2 package are built with Go version affected by CVE-2023-24538
Templates do not properly consider backticks (`) as Javascript string delimiters, and do not escape them as expected. Backticks are used, since ES6, for JS template literals. If a template contains a Go template action within a Javascript template literal, th…
-
Medium 6.3
Insufficient validation of Action form input fields
Reflected XSS attacks, occur when a malicious script is reflected off a web application to the victim's browser. The script can be activated through Action form fields, which can be sent as request to a website with a vulnerability that enables execution of m…
-
Medium 5.9
Duktape 2.6 bug crashes JavaScript putting too many values in valstack.
Duktape is an 3rd-party embeddable JavaScript engine, with a focus on portability and compact footprint. When adding too many values in valstack JavaScript will crash. This issue occurs due to bug in Duktape 2.6 which is an 3rd-party solution that we use.
-
Medium 5.7
Inefficient URL schema validation
URL validation scheme receives input from a user and then parses it to identify its various components. The validation scheme can ensure that all URL components comply with internet standards.
-
Medium 5.4
Reflected XSS in several fields of graph form
Reflected XSS attacks, also known as non-persistent attacks, occur when a malicious script is reflected off a web application to the victim's browser. The script is activated through a link, which sends a request to a website with a vulnerability that enables…
-
Medium 5.4
Persistent XSS in the user form
Stored or persistent cross-site scripting (XSS) is a type of XSS where the attacker first sends the payload to the web application, then the application saves the payload (e.g., in a database or server-side text files), and finally, the application unintentio…
-
Medium 5.5CVE-2023-29452 EPSS 64%
Remove possibility to add html into Geomap attribution field
Currently, geomap configuration (Administration -> General -> Geographical maps) allows using HTML in the field “Attribution text” when selected “Other” Tile provider.
-
Medium 4.7
Denial of service caused by a bug in the JSON parser
Specially crafted string can cause a buffer overrun in the JSON parser library leading to a crash of the Zabbix Server or a Zabbix Proxy.
-
High 8.5
Unauthorized limited filesystem access from preprocessing
JavaScript pre-processing can be used by the attacker to gain access to the file system (read-only access on behalf of user "zabbix") on the Zabbix Server or Zabbix Proxy, potentially leading to unauthorized access to sensitive data.
-
Medium 5.9
Limited control of resource utilization in JS preprocessing
JavaScript preprocessing, webhooks and global scripts can cause uncontrolled CPU, memory, and disk I/O utilization. Preprocessing/webhook/global script configuration and testing are only available to Administrative roles (Admin and Superadmin). Administrative…
-
Medium 5.9CVE-2022-46768 EPSS 48%
File name information disclosure vulnerability in Zabbix Web Service Report Generation
Arbitrary file read vulnerability exists in Zabbix Web Service Report Generation, which listens on the port 10053. The service does not have proper validation for URL parameters before reading the files.
-
Medium 5.3
X-Forwarded-For header is active by default causes access to Zabbix sites in maintenance mode
Zabbix Frontend provides a feature that allows admins to maintain the installation and ensure that only certain IP addresses can access it. In this way, any user will not be able to access the Zabbix Frontend while it is being maintained and possible sensitiv…
-
Medium 4.8
Reflected XSS in the backurl parameter of Zabbix Frontend
An unauthenticated user can create a link with reflected Javascript code inside the backurl parameter and send it to other authenticated users in order to create a fake account with predefined login, password and role in Zabbix Frontend.
-
Low 3.7
Reflected XSS in graphs page of Zabbix Frontend
An authenticated user can create a link with reflected Javascript code inside it for the graphs page and send it to other users. The payload can be executed only with a known CSRF token value of the victim, which is changed periodically and is difficult to pr…
-
Low 3.7
Reflected XSS in discovery page of Zabbix Frontend
An authenticated user can create a link with reflected Javascript code inside it for the discovery page and send it to other users. The payload can be executed only with a known CSRF token value of the victim, which is changed periodically and is difficult to…
-
Low 3.7
Reflected XSS in graph configuration window of Zabbix Frontend
An authenticated user can create a link with reflected Javascript code inside it for graphs’ page and send it to other users. The payload can be executed only with a known CSRF token value of the victim, which is changed periodically and is difficult to predi…
-
Low 3.7
Reflected XSS in item configuration window of Zabbix Frontend
An authenticated user can create a link with reflected Javascript code inside it for items’ page and send it to other users. The payload can be executed only with a known CSRF token value of the victim, which is changed periodically and is difficult to predic…