CVSS: 5.5EPSS: 0%CPEs: 10EXPL: 1CVE-2024-22119 – Stored XSS in graph items select form
https://notcve.org/view.php?id=CVE-2024-22119
The cause of vulnerability is improper validation of form input field “Name” on Graph page in Items section. La causa de la vulnerabilidad es la validación inadecuada del campo de entrada del formulario "Nombre" en la página Gráfico en la sección Elementos. • https://lists.debian.org/debian-lts-announce/2024/04/msg00020.html https://support.zabbix.com/browse/ZBX-24070 • CWE-20: Improper Input Validation CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.8EPSS: 0%CPEs: 8EXPL: 0CVE-2023-32728 – Code injection in zabbix_agent2 smart.disk.get caused by smartctl plugin
https://notcve.org/view.php?id=CVE-2023-32728
The Zabbix Agent 2 item key smart.disk.get does not sanitize its parameters before passing them to a shell command resulting possible vulnerability for remote code execution. La clave del elemento Zabbix Agent 2 smart.disk.get no sanitiza sus parámetros antes de pasarlos a un comando de shell, lo que resulta en una posible vulnerabilidad de ejecución remota de código. • https://support.zabbix.com/browse/ZBX-23858 • CWE-20: Improper Input Validation CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 7.2EPSS: 0%CPEs: 8EXPL: 0CVE-2023-32727 – Code execution vulnerability in icmpping
https://notcve.org/view.php?id=CVE-2023-32727
An attacker who has the privilege to configure Zabbix items can use function icmpping() with additional malicious command inside it to execute arbitrary code on the current Zabbix server. Un atacante que tiene el privilegio de configurar elementos de Zabbix puede usar la función icmpping() con un comando malicioso adicional dentro para ejecutar código arbitrario en el servidor Zabbix actual. • https://support.zabbix.com/browse/ZBX-23857 • CWE-20: Improper Input Validation •
CVSS: 8.1EPSS: 0%CPEs: 5EXPL: 0CVE-2023-32726 – Possible buffer overread from reading DNS responses
https://notcve.org/view.php?id=CVE-2023-32726
The vulnerability is caused by improper check for check if RDLENGTH does not overflow the buffer in response from DNS server. La vulnerabilidad se debe a una verificación incorrecta de si RDLENGTH no desborda el búfer en respuesta del servidor DNS. • https://lists.debian.org/debian-lts-announce/2024/01/msg00012.html https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BYSYLA7VTHR25CBLYO5ZLEJFGU7HTHQB https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UMFKNV5E4LG2DIZNPRWQ2ENH75H6UEQT https://support.zabbix.com/browse/ZBX-23855 • CWE-754: Improper Check for Unusual or Exceptional Conditions •
CVSS: 9.6EPSS: 0%CPEs: 10EXPL: 0CVE-2023-32725 – Leak of zbx_session cookie when using a scheduled report that includes a dashboard with a URL widget.
https://notcve.org/view.php?id=CVE-2023-32725
The website configured in the URL widget will receive a session cookie when testing or executing scheduled reports. The received session cookie can then be used to access the frontend as the particular user. El sitio web configurado en el widget de la URL recibirá una cookie de sesión al probar o ejecutar informes programados. La cookie de sesión recibida se puede utilizar para acceder a la interfaz como usuario particular. • https://support.zabbix.com/browse/ZBX-23854 • CWE-565: Reliance on Cookies without Validation and Integrity Checking •