Zabbix

Zabbix

98 vulnerabilities found.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
8.1

CVE-2016-4338

Exploit
  • EPSS 44.96%
  • Published 23.01.2017 21:59:01
  • Last modified 20.04.2025 01:37:25

The mysql user parameter configuration script (userparameter_mysql.conf) in the agent in Zabbix before 2.0.18, 2.2.x before 2.2.13, and 3.0.x before 3.0.3, when used with a shell other than bash, allows context-dependent attackers to execute arbitrar...

7.5

CVE-2014-9450

  • EPSS 0.46%
  • Published 02.01.2015 20:59:09
  • Last modified 12.04.2025 10:46:40

Multiple SQL injection vulnerabilities in chart_bar.php in the frontend in Zabbix before 1.8.22, 2.0.x before 2.0.14, and 2.2.x before 2.2.8 allow remote attackers to execute arbitrary SQL commands via the (1) itemid or (2) periods parameter.

5.5

CVE-2014-1685

  • EPSS 0.39%
  • Published 08.05.2014 14:29:14
  • Last modified 12.04.2025 10:46:40

The Frontend in Zabbix before 1.8.20rc2, 2.0.x before 2.0.11rc2, and 2.2.x before 2.2.2rc1 allows remote "Zabbix Admin" users to modify the media of arbitrary users via unspecified vectors.

4

CVE-2014-1682

  • EPSS 0.25%
  • Published 08.05.2014 14:29:14
  • Last modified 12.04.2025 10:46:40

The API in Zabbix before 1.8.20rc1, 2.0.x before 2.0.11rc1, and 2.2.x before 2.2.2rc1 allows remote authenticated users to spoof arbitrary users via the user name in a user.login request.

4.3

CVE-2012-6086

  • EPSS 0.19%
  • Published 29.01.2014 18:55:26
  • Last modified 11.04.2025 00:51:21

libs/zbxmedia/eztexting.c in Zabbix 1.8.x before 1.8.18rc1, 2.0.x before 2.0.8rc1, and 2.1.x before 2.1.2 does not properly set the CURLOPT_SSL_VERIFYHOST option for libcurl, which allows man-in-the-middle attackers to spoof SSL servers via an arbitr...

7.5

CVE-2013-6824

Exploit
  • EPSS 0.8%
  • Published 19.12.2013 04:24:57
  • Last modified 11.04.2025 00:51:21

Zabbix before 1.8.19rc1, 2.0 before 2.0.10rc1, and 2.2 before 2.2.1rc1 allows remote Zabbix servers and proxies to execute arbitrary commands via a newline in a flexible user parameter.

5

CVE-2013-1364

  • EPSS 0.44%
  • Published 14.12.2013 17:21:45
  • Last modified 11.04.2025 00:51:21

The user.login function in Zabbix before 1.8.16 and 2.x before 2.0.5rc1 allows remote attackers to override LDAP configuration via the cnf parameter.

3.5

CVE-2013-5572

  • EPSS 7.82%
  • Published 01.10.2013 03:48:24
  • Last modified 11.04.2025 00:51:21

Zabbix 2.0.5 allows remote authenticated users to discover the LDAP bind password by leveraging management-console access and reading the ldap_bind_password value in the HTML source code.

7.5

CVE-2012-3435

Exploit
  • EPSS 2.76%
  • Published 15.08.2012 20:55:03
  • Last modified 11.04.2025 00:51:21

SQL injection vulnerability in frontends/php/popup_bitem.php in Zabbix 1.8.15rc1 and earlier, and 2.x before 2.0.2rc1, allows remote attackers to execute arbitrary SQL commands via the itemid parameter.

4.3

CVE-2011-5027

  • EPSS 0.44%
  • Published 29.12.2011 22:55:01
  • Last modified 11.04.2025 00:51:21

Cross-site scripting (XSS) vulnerability in ZABBIX before 1.8.10 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to the profiler.