Frontend DoS via the validate.api.exists action

Agent 2 Oracle plugin TNS connection string injection via the 'service' parameter

A regular Zabbix user can search other users in their user group via Zabbix API by select fields the user does not have access to view

Zabbix server is vulnerable to a DoS vulnerability due to uncontrolled resource exhaustion

A non-admin user can change or remove important features within the Zabbix Agent application, thus impacting the integrity and availability of the application

An unauthenticated user can create a link with reflected Javascript code inside the backurl parameter and send it to other authenticated users in order to create a fake account…

Zabbix before 3.0.32rc1, 4.x before 4.0.22rc1, 4.1.x through 4.4.x before 4.4.10rc1, and 5.x before 5.0.2rc1 allows stored XSS in the URL Widget

Zabbix before 2.2.21rc1, 3.x before 3.0.13rc1, 3.1.x and 3.2.x before 3.2.10rc1, and 3.3.x and 3.4.x before 3.4.4rc1 allows open redirect via the request parameter

Insufficient isolation of JavaScript (Duktape) execution context on Zabbix Server

Stored XSS vulnerability in OAuth configuration form

When the webdriver for the Browser object downloads data from a HTTP server, the data pointer is set to NULL and is allocated only in curl_write_cb when receiving data

Prototype pollution leading to stored XSS

The endpoint /zabbix.php?action=export.valuemaps suffers from a Cross-Site Scripting vulnerability via the backurl parameter

The cause of vulnerability is improper validation of form input field “Name” on Graph page in Items section

A stored XSS has been found in the Zabbix web application in the Maps element if a URL field is set with spaces before URL

Currently, geomap configuration (Administration -> General -> Geographical maps) allows using HTML in the field “Attribution text” when selected “Other” Tile provider

An authenticated user can create a link with reflected Javascript code inside it for the graphs page and send it to other users

An authenticated user can create a link with reflected Javascript code inside it for the discovery page and send it to other users

An authenticated user can create a hosts group from the configuration with XSS payload, which will be available for other users

SNMP trap injection in zabbix_trap_receiver.pl

Unauthenticated arbitrary PHP class instantiation

Zabbix through 4.4.0alpha1 allows User Enumeration

Hidden host credentials inferable via multiselect.get filtering

Server DoS via JavaScript preprocessing or script items

Use-after-free read in script item/preprocessing HttpRequest body

Email media OAuth secret leak to Super Admin

Agent 2 Docker plugin arbitrary file read via Docker API injection

The LDAP 'Bind password' value cannot be read after saving, but a Super Admin account can leak it by changing LDAP 'Host' to a rogue LDAP server

JavaScript preprocessing, webhooks and global scripts can cause uncontrolled CPU, memory, and disk I/O utilization

There was discovered a use after free bug in browser.c in the es_browser_get_variant function

Frontend plaintext macro value enumeration via the validatate.api.exists action

A regular Zabbix user with no permission to the Monitoring -> Problems view is still able to call the problem.view.refresh action and therefore still retrieve a list of active…

User with no permission to any of the Hosts can access and view host count & other statistics through System Information Widget in Global View Dashboard

API and Frontend login lockout race condition

The researcher is showing that due to the way the SNMP trap log is parsed, an attacker can craft an SNMP trap with additional lines of information and have forged data show in the…

An information disclosure vulnerability exists in the iConfig proxy request of Zabbix server 2.4.X

Due to a bug in Zabbix API, the hostprototype.get method lists all host prototypes to users that do not have any user groups assigned to them

Zabbix API user.get returns all users that share common group with the calling user

In the src/libs/zbxembed/browser.c file, the es_browser_ctor method retrieves a heap pointer from the Duktape JavaScript engine

The webdriver for the Browser object expects an error object to be initialized when the webdriver_session_query function fails

Execution time for an unsuccessful login differs when using a non-existing username compared to using an existing one

When exporting media types, the password is exported in the YAML in plain text

The researcher is showing that it is possible to leak a small amount of Zabbix Server memory using an out of bounds read in src/libs/zbxmedia/email.c

Setting SMS media allows to set GSM modem file

Server DoS via binary items

When a URL is added to the map element, it is recorded in the database with sequential IDs

Multiple SQL injection vulnerabilities in chart_bar.php in the frontend in Zabbix before 1.8.22, 2.0.x before 2.0.14, and 2.2.x before 2.2.8 allow remote attackers to execute…

The Frontend in Zabbix before 1.8.20rc2, 2.0.x before 2.0.11rc2, and 2.2.x before 2.2.2rc1 allows remote "Zabbix Admin" users to modify the media of arbitrary users via…

The API in Zabbix before 1.8.20rc1, 2.0.x before 2.0.11rc1, and 2.2.x before 2.2.2rc1 allows remote authenticated users to spoof arbitrary users via the user name in a user.login…

libs/zbxmedia/eztexting.c in Zabbix 1.8.x before 1.8.18rc1, 2.0.x before 2.0.8rc1, and 2.1.x before 2.1.2 does not properly set the CURLOPT_SSL_VERIFYHOST option for libcurl,…