ZA
Monitoring
Zabbix
On CISA KEVExploited in the wild
123
CVEs
2
On KEV
9.9
Max CVSS
6
New 30D
Severity mix
Critical 13High 31Medium 39Low 13
Watch
Add Zabbix to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2013-6824 | – | Dec 19 | Zabbix before 1.8.19rc1, 2.0 before 2.0.10rc1, and 2.2 before 2.2.1rc1 allows remote Zabbix servers and proxies to execute arbitrary commands via a newline in a flexible user… Affected: through 1.8.18; 2.0.0; 2.2.0 |
| CVE-2013-1364 | – | Dec 14 | The user.login function in Zabbix before 1.8.16 and 2.x before 2.0.5rc1 allows remote attackers to override LDAP configuration via the cnf parameter Affected: through 1.8.15; 2.0.0; 2.0.1; 2.0.2; 2.0.3; 2.0.4 |
| CVE-2013-5572 | – | Oct 1 | Zabbix 2.0.5 allows remote authenticated users to discover the LDAP bind password by leveraging management-console access and reading the ldap_bind_password value in the HTML… Affected: 2.0.5 |
| CVE-2012-3435 | – | Aug 15 | SQL injection vulnerability in frontends/php/popup_bitem.php in Zabbix 1.8.15rc1 and earlier, and 2.x before 2.0.2rc1, allows remote attackers to execute arbitrary SQL commands… Affected: through 1.8.15; 1.1; 1.1; 1.1; 1.1; 1.1; +34 more |
| CVE-2011-5027 | – | Dec 29 | Cross-site scripting (XSS) vulnerability in ZABBIX before 1.8.10 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to the profiler Affected: through 1.8.10; 1.1; 1.1; 1.1; 1.1; 1.1; +34 more |
| CVE-2011-4615 | – | Dec 29 | Multiple cross-site scripting (XSS) vulnerabilities in Zabbix before 1.8.10 allow remote attackers to inject arbitrary web script or HTML via the gname parameter (aka host groups… Affected: through 1.8.10; 1.1; 1.1; 1.1; 1.1; 1.1; +34 more |
| CVE-2011-4674 | – | Dec 2 | SQL injection vulnerability in popup.php in Zabbix 1.8.3 and 1.8.4, and possibly other versions before 1.8.9, allows remote attackers to execute arbitrary SQL commands via the… Affected: 1.8.3; 1.8.4 |
| CVE-2010-5049 | – | Nov 23 | SQL injection vulnerability in events.php in Zabbix 1.8.1 and earlier allows remote attackers to execute arbitrary SQL commands via the nav_time parameter Affected: through 1.8.1; 1.1; 1.1; 1.1; 1.1; 1.1; +34 more |
| CVE-2011-3265 | – | Aug 19 | popup.php in Zabbix before 1.8.7 allows remote attackers to read the contents of arbitrary database tables via a modified srctbl parameter Affected: through 1.8.6; 1.1; 1.1; 1.1; 1.1; 1.1; +34 more |
| CVE-2011-3264 | – | Aug 19 | Zabbix before 1.8.6 allows remote attackers to obtain sensitive information via an invalid srcfld2 parameter to popup.php, which reveals the installation path in an error message Affected: through 1.8.5; 1.1; 1.1; 1.1; 1.1; 1.1; +34 more |
| CVE-2011-3263 | – | Aug 19 | zabbix_agentd in Zabbix before 1.8.6 and 1.9.x before 1.9.4 allows context-dependent attackers to cause a denial of service (CPU consumption) by executing the vfs.file.cksum… Affected: through 1.8.5; 1.1; 1.1; 1.1; 1.1; 1.1; +34 more |
| CVE-2011-2904 | – | Aug 19 | Cross-site scripting (XSS) vulnerability in acknow.php in Zabbix before 1.8.6 allows remote attackers to inject arbitrary web script or HTML via the backurl parameter Affected: through 1.8.5; 1.1; 1.1; 1.1; 1.1; 1.1; +34 more |
| CVE-2010-2790 | – | Aug 5 | Multiple cross-site scripting (XSS) vulnerabilities in the formatQuery function in frontends/php/include/classes/class.curl.php in Zabbix before 1.8.3rc1 allow remote attackers to… Affected: through 1.8.2; 1.1; 1.1; 1.1; 1.1; 1.1; +34 more |
| CVE-2010-1277 | – | Apr 6 | SQL injection vulnerability in the user.authenticate method in the API in Zabbix 1.8 before 1.8.2 allows remote attackers to execute arbitrary SQL commands via the user parameter… Affected: 1.8; 1.8.1 |
| CVE-2009-4502 | – | Dec 31 | The NET_TCP_LISTEN function in net.c in Zabbix Agent before 1.6.7, when running on FreeBSD or Solaris, allows remote attackers to bypass the EnableRemoteCommands setting and… Affected: through 1.6.6; 1.1.2; 1.1.3; 1.1.4; 1.1.5; 1.4.2; +3 more |
| CVE-2009-4501 | – | Dec 31 | The zbx_get_next_field function in libs/zbxcommon/str.c in Zabbix Server before 1.6.8 allows remote attackers to cause a denial of service (crash) via a request that lacks… Affected: through 1.6.7; 1.1.2; 1.1.3; 1.1.4; 1.1.5; 1.4.2; +4 more |
| CVE-2009-4500 | – | Dec 31 | The process_trap function in trapper/trapper.c in Zabbix Server before 1.6.6 allows remote attackers to cause a denial of service (crash) via a crafted request with data that… Affected: through 1.4.6; 1.1.2; 1.1.3; 1.1.4; 1.1.5; 1.4.2; +2 more |
| CVE-2009-4499 | – | Dec 31 | SQL injection vulnerability in the get_history_lastid function in the nodewatcher component in Zabbix Server before 1.6.8 allows remote attackers to execute arbitrary SQL commands… Affected: through 1.6.7; 1.1.2; 1.1.3; 1.1.4; 1.1.5; 1.4.2; +4 more |
| CVE-2009-4498 | – | Dec 31 | The node_process_command function in Zabbix Server before 1.8 allows remote attackers to execute arbitrary commands via a crafted request Affected: through 1.7.4; 1.1.2; 1.1.3; 1.1.4; 1.1.5; 1.4.2; +8 more |
| CVE-2008-1353 | – | Mar 17 | zabbix_agentd in ZABBIX 1.4.4 allows remote attackers to cause a denial of service (CPU and connection consumption) via multiple vfs.file.cksum commands with a special device node… Affected: 1.1.2; 1.1.3; 1.1.4; 1.1.5; 1.4.2; 1.4.3 |
| CVE-2007-0640 | – | Jan 31 | Buffer overflow in ZABBIX before 1.1.5 has unknown impact and attack vectors related to "SNMP IP addresses." Affected: through 1.1.4; 1.1.2; 1.1.3 |
| CVE-2006-6692 | – | Dec 21 | Multiple format string vulnerabilities in zabbix before 20061006 allow attackers to cause a denial of service (application crash) and possibly execute arbitrary code via format… Affected: 1.1.2 |
| CVE-2006-6693 | – | Dec 21 | Multiple buffer overflows in zabbix before 20061006 allow attackers to cause a denial of service (application crash) and possibly execute arbitrary code via long strings to the… Affected: 1.1.2 |