Total 115 security vulnerabilities recorded for zabbix software and firmware.
Reflected XSS attacks, occur when a malicious script is reflected off a web application to the victim's browser. The script can be activated through A...
URL validation scheme receives input from a user and then parses it to identify its various components. The validation scheme can ensure that all URL ...
Reflected XSS attacks, also known as non-persistent attacks, occur when a malicious script is reflected off a web application to the victim's browser....
Stored or persistent cross-site scripting (XSS) is a type of XSS where the attacker first sends the payload to the web application, then the applicati...
Currently, geomap configuration (Administration -> General -> Geographical maps) allows using HTML in the field “Attribution text” when selected “Oth...
Specially crafted string can cause a buffer overrun in the JSON parser library leading to a crash of the Zabbix Server or a Zabbix Proxy....
JavaScript pre-processing can be used by the attacker to gain access to the file system (read-only access on behalf of user "zabbix") on the Zabbix Se...
JavaScript preprocessing, webhooks and global scripts can cause uncontrolled CPU, memory, and disk I/O utilization. Preprocessing/webhook/global scrip...
Arbitrary file read vulnerability exists in Zabbix Web Service Report Generation, which listens on the port 10053. The service does not have proper va...
Zabbix Frontend provides a feature that allows admins to maintain the installation and ensure that only certain IP addresses can access it. In this wa...
An unauthenticated user can create a link with reflected Javascript code inside the backurl parameter and send it to other authenticated users in orde...
An authenticated user can create a link with reflected Javascript code inside it for the graphs page and send it to other users. The payload can be ex...
An authenticated user can create a link with reflected Javascript code inside it for the discovery page and send it to other users. The payload can be...
An authenticated user can create a link with reflected Javascript code inside it for graphs’ page and send it to other users. The payload can be execu...
An authenticated user can create a link with reflected Javascript code inside it for items’ page and send it to other users. The payload can be execut...
An authenticated user can create a link with reflected Javascript code inside it for services’ page and send it to other users. The payload can be exe...
An authenticated user can create a link with reflected XSS payload for actions’ pages, and send it to other users. Malicious code has access to all th...
Zabbix 4.0 LTS, 4.2, 4.4, and 5.0 LTS is vulnerable to Remote Code Execution (RCE). Any user with the "Zabbix Admin" role is able to run custom shell ...
After the initial setup process, some steps of setup.php file are reachable not only by super-administrators, but by unauthenticated users as well. Ma...
An authenticated user can create a hosts group from the configuration with XSS payload, which will be available for other users. When XSS is stored by...
During Zabbix installation from RPM, DAC_OVERRIDE SELinux capability is in use to access PID files in [/var/run/zabbix] folder. In this case, Zabbix P...
In the case of instances where the SAML SSO authentication is enabled (non-default), session data can be modified by a malicious actor, because a user...
The zabbix-agent2 package before 5.4.9-r1 for Alpine Linux sometimes allows privilege escalation to root because the design incorrectly expected that ...
In Zabbix from 4.0.x before 4.0.28rc1, 5.0.0alpha1 before 5.0.10rc1, 5.2.x before 5.2.6rc1, and 5.4.0alpha1 before 5.4.0beta2, the CControllerAuthenti...