Unsafe client-side session storage leading to authentication bypass/instance takeover via Zabbix Frontend with configured SAML

Possible view of the setup pages by unauthenticated users if config file already exists

A non-admin user account on the Zabbix frontend with the default User role, or with any other role that gives API access can exploit this vulnerability

A Firewall Rule which allows all incoming TCP connections to all programs from any source and to all ports is created in Windows Firewall after Zabbix agent installation (MSI)

Zabbix Server 2.2.x and 3.0.x before 3.0.31, and 3.2 allows remote attackers to execute arbitrary code

A File Inclusion vulnerability exists in Zabbix 2.0.6 due to inadequate sanitization of request strings in CGI scripts, which could let a remote malicious user execute arbitrary…

Multiple SQL injection vulnerabilities in Zabbix 1.8.x before 1.8.18rc1, 2.0.x before 2.0.9rc1, and 2.1.x before 2.1.7

XML external entity (XXE) vulnerability in Zabbix 1.8.x before 1.8.21rc1, 2.0.x before 2.0.13rc1, 2.2.x before 2.2.5rc1, and 2.3.x before 2.3.2 allows remote attackers to read…

SQL injection vulnerability in Zabbix before 2.2.14 and 3.0 before 3.0.4 allows remote attackers to execute arbitrary SQL commands via the toggle_ids array parameter in latest.php

Hardcoded session key in Zabbix 7.4

The HttpRequest object allows to get the HTTP headers from the server's response after sending the request

Zabbix allows to configure SMS notifications

Request to LDAP is sent before user permissions are checked

An issue was discovered in zabbix.php?action=dashboard.view&dashboardid=1 in Zabbix through 4.4

Blind, read-only SQL injection in Zabbix API via sortfield parameter

Host and event action script regex validation can be bypassed in certain situations, leading to potential command injection

A low privilege (regular) Zabbix user with API access can use SQL injection vulnerability in include/classes/api/CApiService.php to execute arbitrary SQL commands via the groupBy…

A bug in the code allows an attacker to sign a forged zbx_session cookie, which then allows them to sign in with admin permissions

An authenticated user with API access (e.g.: user with default User role), more specifically a user with access to the user.update API endpoint is enough to be able to add…

The implementation of atob in "Zabbix JS" allows to create a string with arbitrary content and use it to access internal properties of objects

Within Zabbix, users have the ability to directly modify memory pointers in the JavaScript engine

Zabbix server can perform command execution for configured scripts

The website configured in the URL widget will receive a session cookie when testing or executing scheduled reports

Memory pointer is in a property of the Ducktape object

In Zabbix from 4.0.x before 4.0.28rc1, 5.0.0alpha1 before 5.0.10rc1, 5.2.x before 5.2.6rc1, and 5.4.0alpha1 before 5.4.0beta2, the CControllerAuthenticationUpdate controller lacks…

Zabbix 2.0.9 has an Arbitrary Command Execution Vulnerability

The reported vulnerability is a stack buffer overflow in the zbx_snmp_cache_handle_engineid function within the Zabbix server/proxy code

An authenticated Zabbix user (User role) with template/host write permissions is able to create objects via the configuration.import API

The front-end audit log allows viewing of unprotected plaintext passwords, where the passwords are displayed in plain text

An exploitable code execution vulnerability exists in the trapper command functionality of Zabbix Server 2.4.X

The mysql user parameter configuration script (userparameter_mysql.conf) in the agent in Zabbix before 2.0.18, 2.2.x before 2.2.13, and 3.0.x before 3.0.3, when used with a shell…

Improper validation of custom installation directories on Windows could allow installation into locations with unsafe permissions, increasing the risk of DLL sideloading.

The zabbix/src/libs/zbxjson module is vulnerable to a buffer overflow when parsing JSON files via zbx_json_open

Frontend DoS via the popup.testtriggerexpr action

Uncontrolled resource consumption refers to a software vulnerability where a attacker or system uses excessive resources, such as CPU, memory, or network bandwidth, without proper…

Duktape is an 3rd-party embeddable JavaScript engine, with a focus on portability and compact footprint

Specially crafted string can cause a buffer overrun in the JSON parser library leading to a crash of the Zabbix Server or a Zabbix Proxy

JavaScript pre-processing can be used by the attacker to gain access to the file system (read-only access on behalf of user "zabbix") on the Zabbix Server or Zabbix Proxy,…

Zabbix before 5.0 represents passwords in the users table with unsalted MD5

During Zabbix installation from RPM, DAC_OVERRIDE SELinux capability is in use to access PID files in [/var/run/zabbix] folder

A Zabbix adminitrator can inject arbitrary SQL during the autoremoval of hosts by inserting malicious SQL in the 'Visible name' field

An administrator with restricted permissions can exploit the script execution functionality within the Monitoring Hosts section

An attacker who has the privilege to configure Zabbix items can use function icmpping() with additional malicious command inside it to execute arbitrary code on the current Zabbix…

Zabbix 4.0 LTS, 4.2, 4.4, and 5.0 LTS is vulnerable to Remote Code Execution (RCE)

In the trapper functionality of Zabbix Server 2.4.x, specifically crafted trapper packets can pass database logic checks, resulting in database writes

Active agent heartbeat missing TLS check

JavaScript preprocessing memory disclosure

Stored XSS vulnerability in the Item history/Plain text widget

Stored XSS vulnerability in Host navigator widget maintenance tooltip

Host PSK extraction in Zabbix API