Rezultati pretraživanja za 'Proizvođač: zabbix'
| ID | CVSS | Sažetak | Zadnje ažurirano | Objavljeno |
|---|---|---|---|---|
| CVE-2026-23924 | 4.9 | Zabbix Agent 2 Docker plugin does not properly sanitize the 'docker.container_info' parameters when forwarding them to the Docker daemon. An attacker capable of invoking Agent 2 can read arbitrary files from running Docker containers by injecting the | 2026-09-18 17:02:40 | 2026-03-24 19:16:50 |
| CVE-2026-23926 | 6.8 | An authenticated (non-super) administrator can create a maintenance period with a JavaScript payload that is executed by any user that opens tooltip for that maintenance period in the Host navigator widget. This can allow the attacker to perform unau | 2026-09-18 15:35:11 | 2026-05-06 08:16:01 |
| CVE-2026-23927 | 6.5 | A user able to connect to Agent 2 can inject an Oracle TNS connection string via the 'service' parameter. This can lead to Agent 2 connecting to an attacker-controlled server and leaking Oracle database credentials if they are saved in a named sessio | 2026-09-18 15:26:56 | 2026-05-06 08:16:02 |
| CVE-2026-23928 | 6.8 | The Item history widget (in Zabbix 7.0+) or the Plain text widget (in Zabbix 6.0) can execute injected JavaScript when HTML display is enabled. This can allow an attacker to perform unauthorized actions depending on which user opens a dashboard conta | 2026-09-18 15:19:05 | 2026-05-06 08:16:03 |
| CVE-2026-23923 | 5.3 | An unauthenticated attacker can exploit the Frontend 'validate' action to blindly instantiate arbitrary PHP classes. The impact depends on environment setup but appears limited at this time. | 2026-09-10 21:16:44 | 2026-03-24 19:16:50 |
| CVE-2026-23920 | 8.8 | Host and event action script input is validated with a regex (set by the administrator), but the validation runs in multiline mode. If ^ and $ anchors are used in user input validation, an injected newline lets authenticated users bypass the check an | 2026-09-10 21:15:39 | 2026-03-24 19:16:49 |
| CVE-2026-23921 | 8.8 | A low privilege Zabbix user with API access can exploit a blind SQL injection vulnerability in include/classes/api/CApiService.php to execute arbitrary SQL selects via the sortfield parameter. Although query results are not returned directly, an atta | 2026-09-10 21:13:20 | 2026-03-24 19:16:50 |
| CVE-2026-23925 | 8.1 | An authenticated Zabbix user (User role) with template/host write permissions is able to create objects via the configuration.import API. This can lead to confidentiality loss by creating unauthorized hosts. Note that the User role is normally not su | 2026-06-05 17:05:16 | 2026-03-06 09:15:56 |
| CVE-2022-23131 | 5.1 | In the case of instances where the SAML SSO authentication is enabled (non-default), session data can be modified by a malicious actor, because a user login stored in the session was not verified. Malicious unauthenticated actor may exploit this issu | 2025-10-30 20:10:41 | 2022-01-13 16:15:08 |
| CVE-2022-23134 | 5.0 | After the initial setup process, some steps of setup.php file are reachable not only by super-administrators, but by unauthenticated users as well. Malicious actor can pass step checks and potentially change the configuration of Zabbix Frontend. | 2025-10-30 20:10:35 | 2022-01-13 16:15:08 |
| ID | CVSS | Sažetak | Zadnje ažurirano | Objavljeno |
|---|
Stranica
/12
Zapisa po stranici: