Possible view of the setup pages by unauthenticated users if config file already exists

Active agent heartbeat missing TLS check

JavaScript preprocessing memory disclosure

Stored XSS vulnerability in the Item history/Plain text widget

Stored XSS vulnerability in Host navigator widget maintenance tooltip

Host PSK extraction in Zabbix API

Frontend DoS via the validate.api.exists action

Agent 2 Oracle plugin TNS connection string injection via the 'service' parameter

A regular Zabbix user can search other users in their user group via Zabbix API by select fields the user does not have access to view

Zabbix server is vulnerable to a DoS vulnerability due to uncontrolled resource exhaustion

A non-admin user can change or remove important features within the Zabbix Agent application, thus impacting the integrity and availability of the application

An unauthenticated user can create a link with reflected Javascript code inside the backurl parameter and send it to other authenticated users in order to create a fake account…

Zabbix before 3.0.32rc1, 4.x before 4.0.22rc1, 4.1.x through 4.4.x before 4.4.10rc1, and 5.x before 5.0.2rc1 allows stored XSS in the URL Widget

Zabbix before 2.2.21rc1, 3.x before 3.0.13rc1, 3.1.x and 3.2.x before 3.2.10rc1, and 3.3.x and 3.4.x before 3.4.4rc1 allows open redirect via the request parameter

Insufficient isolation of JavaScript (Duktape) execution context on Zabbix Server

Stored XSS vulnerability in OAuth configuration form

When the webdriver for the Browser object downloads data from a HTTP server, the data pointer is set to NULL and is allocated only in curl_write_cb when receiving data

Prototype pollution leading to stored XSS

The endpoint /zabbix.php?action=export.valuemaps suffers from a Cross-Site Scripting vulnerability via the backurl parameter

The cause of vulnerability is improper validation of form input field “Name” on Graph page in Items section

A stored XSS has been found in the Zabbix web application in the Maps element if a URL field is set with spaces before URL

Currently, geomap configuration (Administration -> General -> Geographical maps) allows using HTML in the field “Attribution text” when selected “Other” Tile provider

An authenticated user can create a link with reflected Javascript code inside it for the graphs page and send it to other users

An authenticated user can create a link with reflected Javascript code inside it for the discovery page and send it to other users

An authenticated user can create a hosts group from the configuration with XSS payload, which will be available for other users

SNMP trap injection in zabbix_trap_receiver.pl

Unauthenticated arbitrary PHP class instantiation

Zabbix through 4.4.0alpha1 allows User Enumeration

Hidden host credentials inferable via multiselect.get filtering

Server DoS via JavaScript preprocessing or script items

Use-after-free read in script item/preprocessing HttpRequest body

Email media OAuth secret leak to Super Admin

Agent 2 Docker plugin arbitrary file read via Docker API injection

The LDAP 'Bind password' value cannot be read after saving, but a Super Admin account can leak it by changing LDAP 'Host' to a rogue LDAP server

JavaScript preprocessing, webhooks and global scripts can cause uncontrolled CPU, memory, and disk I/O utilization

There was discovered a use after free bug in browser.c in the es_browser_get_variant function

Frontend plaintext macro value enumeration via the validatate.api.exists action

A regular Zabbix user with no permission to the Monitoring -> Problems view is still able to call the problem.view.refresh action and therefore still retrieve a list of active…

User with no permission to any of the Hosts can access and view host count & other statistics through System Information Widget in Global View Dashboard