Zabbix vulnerabilities, page 5
145 vulnerabilities
Known vulnerabilities in Zabbix products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 10 products.
CVE-2024-36466debianzabbix+2
EPSS score0.73%
A bug in the code allows an attacker to sign a forged zbx_session cookie, which then allows them to sign in with admin permissions.CVE-2024-22120debianzabbix+2EPSS score76.62%
Zabbix server can perform command execution for configured scripts. After command is executed, audit entry is added to "Audit Log". Due to "clientip" field is not sanitized, it is possible to injection SQL into "clientip" and exploit time based blind SQL injection.CVE-2024-22122debianzabbix+2EPSS score1.61%
Zabbix allows to configure SMS notifications. AT command injection occurs on "Zabbix Server" because there is no validation of "Number" field on Web nor on Zabbix server side. Attacker can run test of SMS providing specially crafted phone number and execute additional AT commands on modem.CVE-2024-22123debianzabbix+2EPSS score0.57%
Setting SMS media allows to set GSM modem file. Later this file is used as Linux device. But due everything is a file for Linux, it is possible to set another file, e.g. log file and zabbix_server will try to communicate with it as modem. As a result, log file will be broken with AT commands and small part for log file content will be leaked to UI.CVE-2024-22119debianzabbix+6EPSS score0.73%
The cause of vulnerability is improper validation of form input field “Name” on Graph page in Items section.CVE-2024-22116debianzabbix+2EPSS score1.59%
An administrator with restricted permissions can exploit the script execution functionality within the Monitoring Hosts section. The lack of default escaping for script parameters enabled this user ability to execute arbitrary code via the Ping script, thereby compromising infrastructure.CVE-2024-22114debianzabbix+2EPSS score0.59%
User with no permission to any of the Hosts can access and view host count & other statistics through System Information Widget in Global View Dashboard.CVE-2024-22117debianzabbix+2EPSS score0.51%
When a URL is added to the map element, it is recorded in the database with sequential IDs. Upon adding a new URL, the system retrieves the last sysmapelementurlid value and increments it by one. However, an issue arises when a user manually changes the sysmapelementurlid value by adding sysmapelementurlid + 1. This action prevents others from adding URLs to the map element.CVE-2024-22121ubuntuzabbix+1EPSS score0.23%
A non-admin user can change or remove important features within the Zabbix Agent application, thus impacting the integrity and availability of the application.CVE-2024-45699debianzabbix+2EPSS score0.36%
The endpoint /zabbix.php?action=export.valuemaps suffers from a Cross-Site Scripting vulnerability via the backurl parameter. This is caused by the reflection of user-supplied data without appropriate HTML escaping or output encoding. As a result, a JavaScript payload may be injected into the above endpoint causing it to be executed within the context of the victim's browser.CVE-2024-45700debianzabbix+2EPSS score0.35%
Zabbix server is vulnerable to a DoS vulnerability due to uncontrolled resource exhaustion. An attacker can send specially crafted requests to the server, which will cause the server to allocate an excessive amount of memory and perform CPU-intensive decompression operations, ultimately leading to a service crash.CVE-2009-4501debianzabbix+1EPSS score8.53%
The zbx_get_next_field function in libs/zbxcommon/str.c in Zabbix Server before 1.6.8 allows remote attackers to cause a denial of service (crash) via a request that lacks expected separators, which triggers a NULL pointer dereference, as demonstrated using the Command keyword.CVE-2009-4500debianzabbix+1EPSS score2.29%
The process_trap function in trapper/trapper.c in Zabbix Server before 1.6.6 allows remote attackers to cause a denial of service (crash) via a crafted request with data that lacks an expected : (colon) separator, which triggers a NULL pointer dereference.CVE-2009-4502debianzabbix+1EPSS score21.57%
The NET_TCP_LISTEN function in net.c in Zabbix Agent before 1.6.7, when running on FreeBSD or Solaris, allows remote attackers to bypass the EnableRemoteCommands setting and execute arbitrary commands via shell metacharacters in the argument to net.tcp.listen. NOTE: this attack is limited to attacks from trusted IP addresses.CVE-2009-4498debianzabbix+1EPSS score31.91%
The node_process_command function in Zabbix Server before 1.8 allows remote attackers to execute arbitrary commands via a crafted request.CVE-2009-4499debianzabbix+1EPSS score2.39%
SQL injection vulnerability in the get_history_lastid function in the nodewatcher component in Zabbix Server before 1.6.8 allows remote attackers to execute arbitrary SQL commands via a crafted request, possibly related to the send_history_last_id function in zabbix_server/trapper/nodehistory.c.CVE-2019-17382debianzabbix+1EPSS score54.15%
An issue was discovered in zabbix.php?action=dashboard.view&dashboardid=1 in Zabbix through 4.4. An attacker can bypass the login page and access the dashboard page, and then create a Dashboard, Report, Screen, or Map without any Username/Password (i.e., anonymously). All created elements (Dashboard/Report/Screen/Map) are accessible by other users and by an admin.CVE-2019-15132debianzabbix+3EPSS score2.03%
Zabbix through 4.4.0alpha1 allows User Enumeration. With login requests, it is possible to enumerate application usernames based on the variability of server responses (e.g., the "Login name or password is incorrect" and "No permissions for system access" messages, or just blocking for a number of seconds). This affects both api_jsonrpc.php and index.php.CVE-2026-59787debianzabbix+2EPSS score0.23%
The Perl SNMP trap receiver script shipped with Zabbix does not properly neutralize the ZBXTRAP record delimiter in trap content. This means someone able to send SNMP traps can inject a record targeting another host, resulting in a loss of integrity.CVE-2026-59788ubuntuzabbix+1EPSS score0.25%
The email media type OAuth form passes the Authorization endpoint value to window.open() without validating the URL scheme, so a javascript: URL is executed in the browser. This means a crafted media type configuration, deliverable as an import file, runs arbitrary JavaScript as the Super Admin who grants consent.