ZA
Monitoring
Zabbix
On CISA KEVExploited in the wild
123
CVEs
2
On KEV
9.9
Max CVSS
6
New 30D
Severity mix
Critical 13High 31Medium 39Low 13
Watch
Add Zabbix to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2022-23131 In wildKEV | 9.8 | Jan 13 | Unsafe client-side session storage leading to authentication bypass/instance takeover via Zabbix Frontend with configured SAML Affected: 5.4.0 - 5.4.8 |
| CVE-2024-42327 | 9.9 | Nov 27 | A non-admin user account on the Zabbix frontend with the default User role, or with any other role that gives API access can exploit this vulnerability Affected: 6.0.0 before 6.0.32; 6.4.0 before 6.4.17; 7.0.0 before 7.0.1 |
| CVE-2022-43516 | 9.8 | Dec 5 | A Firewall Rule which allows all incoming TCP connections to all programs from any source and to all ports is created in Windows Firewall after Zabbix agent installation (MSI) Affected: 6.0.10 before 6.0.12; 6.2.0 before 6.2.6; 6.0.12; 6.2.6 |
| CVE-2020-11800 | 9.8 | Oct 7 | Zabbix Server 2.2.x and 3.0.x before 3.0.31, and 3.2 allows remote attackers to execute arbitrary code Affected: 2.2.0 before 3.0.31; 3.2.0 |
| CVE-2013-3738 | 9.8 | Feb 17 | A File Inclusion vulnerability exists in Zabbix 2.0.6 due to inadequate sanitization of request strings in CGI scripts, which could let a remote malicious user execute arbitrary… Affected: 2.0.6 |
| CVE-2013-5743 | 9.8 | Dec 11 | Multiple SQL injection vulnerabilities in Zabbix 1.8.x before 1.8.18rc1, 2.0.x before 2.0.9rc1, and 2.1.x before 2.1.7 Affected: 1.8 through 1.8.17; 2.0.0 through 2.0.8; 2.1.0 through 2.1.7 |
| CVE-2014-3005 | 9.8 | Feb 1 | XML external entity (XXE) vulnerability in Zabbix 1.8.x before 1.8.21rc1, 2.0.x before 2.0.13rc1, 2.2.x before 2.2.5rc1, and 2.3.x before 2.3.2 allows remote attackers to read… Affected: 1.8; 1.8.1; 1.8.2; 1.8.3; 1.8.4; 1.8.5; +34 more |
| CVE-2016-10134 | 9.8 | Feb 17 | SQL injection vulnerability in Zabbix before 2.2.14 and 3.0 before 3.0.4 allows remote attackers to execute arbitrary SQL commands via the toggle_ids array parameter in latest.php Affected: through 2.2.13; 3.0.0; 3.0.1; 3.0.2; 3.0.3 |
| CVE-2026-23933 | 9.1 | Aug 18 | Hardcoded session key in Zabbix 7.4 Affected: 7.4.0 through 7.4.10 |
| CVE-2024-42330 | 9.1 | Nov 27 | The HttpRequest object allows to get the HTTP headers from the server's response after sending the request Affected: 5.0.0 before 5.4.6; 6.0.0 before 6.0.34; 6.4.0 before 6.4.19; 7.0.0 before 7.0.4 |
| CVE-2024-22122 | 9.1 | Aug 12 | Zabbix allows to configure SMS notifications Affected: 5.0.0 through 5.0.42; 6.0.0 through 6.0.30; 6.4.0 through 6.4.15; 7.0.0; 7.0.0; 7.0.0; +11 more |
| CVE-2023-32723 | 9.1 | Oct 12 | Request to LDAP is sent before user permissions are checked Affected: 4.0.0 before 4.0.19; 4.4.0 before 4.4.7; 4.0.19; 4.4.7; 5.0.0 |
| CVE-2019-17382 | 9.1 | Oct 9 | An issue was discovered in zabbix.php?action=dashboard.view&dashboardid=1 in Zabbix through 4.4 Affected: through 4.4 |
Showing 13