Skip to contentZabbix vulnerabilities
Newest
- zabbixSQL injection in user.get APICVE-2024-42327Public exploitFix availableEPSS 79.1%9.9 Critical
- zabbixUse after free vulnerability in browser.cCVE-2024-42326Fix available4.4 Medium
- zabbixStack buffer overflow in zbx_snmp_cache_handle_engineidCVE-2024-36468Fix available3.0 Low
- zabbixAuthentication privilege escalation via user groups due to missing authorization checksCVE-2024-36467Fix available7.5 High
- zabbixThe implementation of atob in "Zabbix JS" allows to create a string with arbitrary content and...CVE-2024-36463Fix available6.5 Medium
- zabbixValue of sysmap_element_url can be de-synchronized causing the map element to crash when new URLs is addedCVE-2024-22117Fix available2.2 Low
- zabbixZabbix Arbitrary File ReadCVE-2024-22123Fix available2.7 Low
- zabbixRemote code execution within ping scriptCVE-2024-22116Fix available9.9 Critical
- zabbixSystem Information Widget in Global View Dashboard exposes information about Hosts to Users without PermissionCVE-2024-22114Fix available4.3 Medium
- zabbixAllocation of resources without limits or throttling (uncontrolled resource consumption)CVE-2024-36462Fix available7.5 High
- zabbixDirect access to memory pointers within the JS engine for modificationCVE-2024-36461Fix available9.1 Critical
- zabbixFront-end audit log shows passwords in plaintextCVE-2024-36460Fix available8.1 High
- zabbixAT(GSM) Command InjectionCVE-2024-22122Fix available3.0 Low
- zabbixZabbix Agent MSI Installer Allows Non-Admin User to Access Change Option via msiexec.exeCVE-2024-221216.1 Medium
- zabbix, zabbix server +1 moreTime Based SQL Injection in Zabbix Server Audit LogCVE-2024-22120Public exploitFix availableEPSS 76.6%9.1 Critical
- zabbixStored XSS in graph items select formCVE-2024-22119Fix available5.5 Medium
- zabbix, zabbix zabbix-agent2 +1 moreCode injection in zabbix_agent2 smart.disk.get caused by smartctl pluginCVE-2023-32728Fix available4.6 Medium
- zabbix, zabbix server +1 moreCode execution vulnerability in icmppingCVE-2023-32727Fix available6.8 Medium
- zabbix, zabbix zabbix-agent +1 morePossible buffer overread from reading DNS responsesCVE-2023-32726Fix available3.9 Low
- zabbix frontend, zabbix, zabbix server +2 moreLeak of zbx_session cookie when using a scheduled report that includes a dashboard with a URL widget.CVE-2023-32725Fix available9.6 Critical
- zabbixJavaScript engine memory pointers are directly available for Zabbix users for modificationCVE-2023-32724Fix available9.1 Critical
- zabbixInefficient permission check in class CControllerAuthenticationUpdateCVE-2023-32723Fix available8.5 High
- zabbixStack-buffer Overflow in library module zbxjsonCVE-2023-32722Fix available9.6 Critical
- zabbixStored XSS in Maps elementCVE-2023-32721Fix available7.6 High
- zabbix, zabbix zabbix-agent2 +1 moreAgent 2 package are built with Go version affected by CVE-2023-24538CVE-2023-29453Fix available9.8 Critical
- zabbix frontend, palantir com.palantir.foundry:foundry-frontend +1 moreDOM XSS in Developer mode dashboard via redirect GET parameterCVE-2023-309584.7 Medium
- zabbix frontend, zabbix +1 moreInsufficient validation of Action form input fieldsCVE-2023-29457Fix available6.3 Medium
- zabbixDuktape 2.6 bug crashes JavaScript putting too many values in valstack.CVE-2023-29458Fix available5.9 Medium
- zabbix frontend, zabbix +1 moreInefficient URL schema validationCVE-2023-29456Fix available5.7 Medium
- zabbix frontend, zabbix +1 moreReflected XSS in several fields of graph formCVE-2023-29455Fix available5.4 Medium
- zabbix frontend, zabbix +1 morePersistent XSS in the user formCVE-2023-29454Fix available5.4 Medium
- zabbixRemove possibility to add html into Geomap attribution fieldCVE-2023-29452Fix availableEPSS 64.1%5.5 Medium
- zabbixDenial of service caused by a bug in the JSON parserCVE-2023-29451Fix available4.7 Medium
- zabbixUnauthorized limited filesystem access from preprocessingCVE-2023-29450Fix available8.5 High
- zabbixLimited control of resource utilization in JS preprocessingCVE-2023-29449Fix available5.9 Medium
- zabbix web service report generation, agent 2 (msi packages), zabbix-agent2 +2 moreFile name information disclosure vulnerability in Zabbix Web Service Report GenerationCVE-2022-46768Fix availableEPSS 47.8%5.9 Medium
- microsoft windows firewall, zabbix, zabbix agent (msi packages) +1 more +3 moreZabbix Agent installer adds “allow all TCP any any” firewall ruleCVE-2022-435166.5 Medium
- dependencytrack frontendX-Forwarded-For header is active by default causes access to Zabbix sites in maintenance modeCVE-2022-43515Fix available5.3 Medium
- dependencytrack frontend, zabbix, fedoraproject fedora +2 moreReflected XSS in the backurl parameter of Zabbix FrontendCVE-2022-40626Fix available4.8 Medium
- dependencytrack frontend, zabbix +1 moreReflected XSS in graphs page of Zabbix FrontendCVE-2022-35230Fix available3.7 Low
- dependencytrack frontend, zabbix +1 moreReflected XSS in discovery page of Zabbix FrontendCVE-2022-35229Fix available3.7 Low
- dependencytrack frontend, debian linux, fedoraproject fedora +2 moreReflected XSS in graph configuration window of Zabbix FrontendCVE-2022-24919Fix available3.7 Low
- dependencytrack frontend, fedoraproject fedora +1 moreReflected XSS in item configuration window of Zabbix FrontendCVE-2022-24918Fix available3.7 Low
- dependencytrack frontend, debian linux, fedoraproject fedora +2 moreReflected XSS in service configuration window of Zabbix FrontendCVE-2022-24917Fix available3.7 Low
- dependencytrack frontend, debian linux, fedoraproject fedora +2 moreReflected XSS in action configuration window of Zabbix FrontendCVE-2022-24349Fix available4.6 Medium
- zabbixZabbix 4.0 LTS, 4.2, 4.4, and 5.0 LTS is vulnerable to Remote Code Execution (RCE). Any user with...CVE-2021-460887.2 High
- dependencytrack frontend, zabbix, debian linux +1 more +3 morePossible view of the setup pages by unauthenticated users if config file already existsCVE-2022-23134In KEVPublic exploitFix availableEPSS 95.3%3.7 Low
- dependencytrack frontend, zabbix, fedoraproject fedora +2 moreStored XSS in host groups configuration window in Zabbix FrontendCVE-2022-23133Fix available6.3 Medium
- zabbix, fedoraproject fedora, zabbix proxy, server +2 moreIncorrect permissions of [/var/run/zabbix] forces dac_overrideCVE-2022-23132Fix available3.3 Low
- dependencytrack frontend, zabbix +1 moreUnsafe client-side session storage leading to authentication bypass/instance takeover via Zabbix Frontend with configured SAMLCVE-2022-23131In KEVPublic exploitEPSS 95.7%9.1 Critical
- Show moreLoading…