Blind, read-only SQL injection in Zabbix API via sortfield parameter

Host and event action script regex validation can be bypassed in certain situations, leading to potential command injection

SQL injection in Zabbix API

Unauthenticated Zabbix frontend takeover when SSO is being used

Authentication privilege escalation via user groups due to missing authorization checks

The implementation of atob in "Zabbix JS" allows to create a string with arbitrary content and use it to access internal properties of objects

Direct access to memory pointers within the JS engine for modification

Zabbix server can perform command execution for configured scripts

The website configured in the URL widget will receive a session cookie when testing or executing scheduled reports

Memory pointer is in a property of the Ducktape object

In Zabbix from 4.0.x before 4.0.28rc1, 5.0.0alpha1 before 5.0.10rc1, 5.2.x before 5.2.6rc1, and 5.4.0alpha1 before 5.4.0beta2, the CControllerAuthenticationUpdate controller lacks…

Zabbix 2.0.9 has an Arbitrary Command Execution Vulnerability

Stack buffer overflow in zbx_snmp_cache_handle_engineid

Unauthorized host creation via configuration.import API by low-privilege user with write permissions

Front-end audit log shows passwords in plaintext

An exploitable code execution vulnerability exists in the trapper command functionality of Zabbix Server 2.4.X

The mysql user parameter configuration script (userparameter_mysql.conf) in the agent in Zabbix before 2.0.18, 2.2.x before 2.2.13, and 3.0.x before 3.0.3, when used with a shell…

Improper validation of custom installation directories on Windows could allow installation into locations with unsafe permissions, increasing the risk of DLL sideloading.

The zabbix/src/libs/zbxjson module is vulnerable to a buffer overflow when parsing JSON files via zbx_json_open

Frontend DoS via the popup.testtriggerexpr action

Allocation of resources without limits or throttling (uncontrolled resource consumption)

Duktape is an 3rd-party embeddable JavaScript engine, with a focus on portability and compact footprint

Specially crafted string can cause a buffer overrun in the JSON parser library leading to a crash of the Zabbix Server or a Zabbix Proxy

JavaScript pre-processing can be used by the attacker to gain access to the file system (read-only access on behalf of user "zabbix") on the Zabbix Server or Zabbix Proxy,…

Zabbix before 5.0 represents passwords in the users table with unsalted MD5

DLL injection in Zabbix Agent and Agent 2 via OpenSSL configuration

Zabbix Agent 2 smartctl plugin RCE vulnerability in Zabbix 5.0.

During Zabbix installation from RPM, DAC_OVERRIDE SELinux capability is in use to access PID files in [/var/run/zabbix] folder

Secondary-order SQL injection in Zabbix Server when deleting an autoregistered host

Remote code execution within ping script

An attacker who has the privilege to configure Zabbix items can use function icmpping() with additional malicious command inside it to execute arbitrary code on the current Zabbix…

Zabbix 4.0 LTS, 4.2, 4.4, and 5.0 LTS is vulnerable to Remote Code Execution (RCE)

In the trapper functionality of Zabbix Server 2.4.x, specifically crafted trapper packets can pass database logic checks, resulting in database writes