CVSS: 6.8EPSS: 71%CPEs: 14EXPL: 2CVE-2009-4498 – Zabbix Server - Arbitrary Command Execution
https://notcve.org/view.php?id=CVE-2009-4498
The node_process_command function in Zabbix Server before 1.8 allows remote attackers to execute arbitrary commands via a crafted request. La función node_process_command function de Zabbix Server en versiones anteriores a la v1.8 permite a atacantes remotos ejecutar comandos de su elección a través de una petición modificada. • https://www.exploit-db.com/exploits/20796 https://www.exploit-db.com/exploits/10432 http://secunia.com/advisories/37740 http://www.openwall.com/lists/oss-security/2010/04/02/1 http://www.securityfocus.com/archive/1/508436/30/60/threaded http://www.vupen.com/english/advisories/2009/3514 https://support.zabbix.com/browse/ZBX-1030 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 7.5EPSS: 0%CPEs: 10EXPL: 1CVE-2009-4499 – Zabbix Server - Multiple Vulnerabilities
https://notcve.org/view.php?id=CVE-2009-4499
SQL injection vulnerability in the get_history_lastid function in the nodewatcher component in Zabbix Server before 1.6.8 allows remote attackers to execute arbitrary SQL commands via a crafted request, possibly related to the send_history_last_id function in zabbix_server/trapper/nodehistory.c. Vulnerabilidad de inyección SQL en la función get_history_lastid en el componente nodewatcher en Zabbix Server anterior a v1.6.8 permite a atacantes remotos ejecutar comandos SQL de su elección a través de una petición manipulada, posiblemente relacionada con la función send_history_last_id en zabbix_server/trapper/nodehistory.c. • https://www.exploit-db.com/exploits/10432 http://secunia.com/advisories/37740 http://www.securityfocus.com/archive/1/508436/30/60/threaded http://www.vupen.com/english/advisories/2009/3514 https://support.zabbix.com/browse/ZBX-1031 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 4.3EPSS: 7%CPEs: 6EXPL: 1CVE-2008-1353 – Zabbix 1.1x/1.4.x - File Checksum Request Denial of Service
https://notcve.org/view.php?id=CVE-2008-1353
zabbix_agentd in ZABBIX 1.4.4 allows remote attackers to cause a denial of service (CPU and connection consumption) via multiple vfs.file.cksum commands with a special device node such as /dev/urandom or /dev/zero. zabbix_agentd en ZABBIX 1.4.4, permite a atacantes remotos causar una Denegación de Servicio (Consumo de CPU y conexión) a través de múltiples comandos vfs.file.cksum con un nodo de dispositivo como /dev/urandom o /dev/zero. • https://www.exploit-db.com/exploits/31403 http://secunia.com/advisories/29383 http://securityreason.com/securityalert/3747 http://www.securityfocus.com/archive/1/489506/100/0/threaded http://www.securityfocus.com/bid/28244 http://www.vupen.com/english/advisories/2008/0878 https://exchange.xforce.ibmcloud.com/vulnerabilities/41196 •
CVSS: 10.0EPSS: 0%CPEs: 3EXPL: 0CVE-2007-0640
https://notcve.org/view.php?id=CVE-2007-0640
Buffer overflow in ZABBIX before 1.1.5 has unknown impact and attack vectors related to "SNMP IP addresses." Desbordamiento de búfer en el ZABBIX en versiones anteriores a la 1.1.5 tiene un impacto desconocido y vectores de ataque relacionados con "SNMP IP addresses". • http://osvdb.org/33081 http://secunia.com/advisories/24020 http://www.securityfocus.com/bid/22321 http://www.vupen.com/english/advisories/2007/0416 http://www.zabbix.com/rn1.1.5.php https://exchange.xforce.ibmcloud.com/vulnerabilities/32038 •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 2CVE-2006-6692 – Zabbix 1.1.2 - Multiple Remote Code Execution Vulnerabilities
https://notcve.org/view.php?id=CVE-2006-6692
Multiple format string vulnerabilities in zabbix before 20061006 allow attackers to cause a denial of service (application crash) and possibly execute arbitrary code via format string specifiers in information that would be recorded in the system log using (1) zabbix_log or (2) zabbix_syslog. Múltiples vulnerabilidades de formato de cadena en zabbix versiones anteriores a 20061006 permite a atacantes remotos provocar una denegación de servicio (caída de aplicación) y posiblemente ejecutar código de su elección mediante especificadores de formato de cadena en información que sería guardada en el fichero de trazas (log) del sistema usando (1) zabbix_log ó (2) zabbix_syslog. • https://www.exploit-db.com/exploits/28775 http://bugs.debian.org/cgi-bin/bugreport.cgi/zabbix.security.patch?bug=391388%3Bmsg=5%3Batt=1 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=391388 http://secunia.com/advisories/22313 http://www.securityfocus.com/bid/20416 http://www.vupen.com/english/advisories/2006/3959 •