Unsafe client-side session storage leading to authentication bypass/instance takeover via Zabbix Frontend with configured SAML

Possible view of the setup pages by unauthenticated users if config file already exists

SQL injection in user.get API

A Firewall Rule which allows all incoming TCP connections to all programs from any source and to all ports is created in Windows Firewall after Zabbix agent installation (MSI)

Zabbix Server 2.2.x and 3.0.x before 3.0.31, and 3.2 allows remote attackers to execute arbitrary code

A File Inclusion vulnerability exists in Zabbix 2.0.6 due to inadequate sanitization of request strings in CGI scripts, which could let a remote malicious user execute arbitrary…

Multiple SQL injection vulnerabilities in Zabbix 1.8.x before 1.8.18rc1, 2.0.x before 2.0.9rc1, and 2.1.x before 2.1.7

XML external entity (XXE) vulnerability in Zabbix 1.8.x before 1.8.21rc1, 2.0.x before 2.0.13rc1, 2.2.x before 2.2.5rc1, and 2.3.x before 2.3.2 allows remote attackers to read…

SQL injection vulnerability in Zabbix before 2.2.14 and 3.0 before 3.0.4 allows remote attackers to execute arbitrary SQL commands via the toggle_ids array parameter in latest.php

Hardcoded session key in Zabbix 7.4

JS - Internal strings in HTTP headers

AT(GSM) Command Injection

Request to LDAP is sent before user permissions are checked

An issue was discovered in zabbix.php?action=dashboard.view&dashboardid=1 in Zabbix through 4.4

Blind, read-only SQL injection in Zabbix API via sortfield parameter

Host and event action script regex validation can be bypassed in certain situations, leading to potential command injection

SQL injection in Zabbix API

Unauthenticated Zabbix frontend takeover when SSO is being used

Authentication privilege escalation via user groups due to missing authorization checks

The implementation of atob in "Zabbix JS" allows to create a string with arbitrary content and use it to access internal properties of objects

Direct access to memory pointers within the JS engine for modification

Time Based SQL Injection in Zabbix Server Audit Log

The website configured in the URL widget will receive a session cookie when testing or executing scheduled reports

Memory pointer is in a property of the Ducktape object

In Zabbix from 4.0.x before 4.0.28rc1, 5.0.0alpha1 before 5.0.10rc1, 5.2.x before 5.2.6rc1, and 5.4.0alpha1 before 5.4.0beta2, the CControllerAuthenticationUpdate controller lacks…

Zabbix 2.0.9 has an Arbitrary Command Execution Vulnerability

Stack buffer overflow in zbx_snmp_cache_handle_engineid

Unauthorized host creation via configuration.import API by low-privilege user with write permissions

Front-end audit log shows passwords in plaintext

An exploitable code execution vulnerability exists in the trapper command functionality of Zabbix Server 2.4.X

The mysql user parameter configuration script (userparameter_mysql.conf) in the agent in Zabbix before 2.0.18, 2.2.x before 2.2.13, and 3.0.x before 3.0.3, when used with a shell…

Improper validation of custom installation directories on Windows could allow installation into locations with unsafe permissions, increasing the risk of DLL sideloading.

The zabbix/src/libs/zbxjson module is vulnerable to a buffer overflow when parsing JSON files via zbx_json_open

Frontend DoS via the popup.testtriggerexpr action

Allocation of resources without limits or throttling (uncontrolled resource consumption)

Duktape is an 3rd-party embeddable JavaScript engine, with a focus on portability and compact footprint

Specially crafted string can cause a buffer overrun in the JSON parser library leading to a crash of the Zabbix Server or a Zabbix Proxy

JavaScript pre-processing can be used by the attacker to gain access to the file system (read-only access on behalf of user "zabbix") on the Zabbix Server or Zabbix Proxy,…

Zabbix before 5.0 represents passwords in the users table with unsalted MD5

DLL injection in Zabbix Agent and Agent 2 via OpenSSL configuration

Zabbix Agent 2 smartctl plugin RCE vulnerability in Zabbix 5.0.

During Zabbix installation from RPM, DAC_OVERRIDE SELinux capability is in use to access PID files in [/var/run/zabbix] folder

Secondary-order SQL injection in Zabbix Server when deleting an autoregistered host

Remote code execution within ping script

An attacker who has the privilege to configure Zabbix items can use function icmpping() with additional malicious command inside it to execute arbitrary code on the current Zabbix…

Zabbix 4.0 LTS, 4.2, 4.4, and 5.0 LTS is vulnerable to Remote Code Execution (RCE)

In the trapper functionality of Zabbix Server 2.4.x, specifically crafted trapper packets can pass database logic checks, resulting in database writes

Active agent heartbeat missing TLS check

JavaScript preprocessing memory disclosure

Stored XSS vulnerability in the Item history/Plain text widget