CVSS: 6.1EPSS: 0%CPEs: 67EXPL: 1CVE-2011-2904 – Gentoo Linux Security Advisory 201311-15
https://notcve.org/view.php?id=CVE-2011-2904
19 Aug 2011 — Cross-site scripting (XSS) vulnerability in acknow.php in Zabbix before 1.8.6 allows remote attackers to inject arbitrary web script or HTML via the backurl parameter. Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en acknow.php en Zabbix antes de la versión 1.8.6 permite a atacantes remotos inyectar secuencias de comandos web o HTML a través del parámetro 'backurl'. Multiple vulnerabilities have been found in Zabbix, possibly leading to SQL injection attacks, Denial of Service, or inform... • http://lists.fedoraproject.org/pipermail/package-announce/2011-August/063884.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 0%CPEs: 71EXPL: 1CVE-2011-3263 – Gentoo Linux Security Advisory 201311-15
https://notcve.org/view.php?id=CVE-2011-3263
19 Aug 2011 — zabbix_agentd in Zabbix before 1.8.6 and 1.9.x before 1.9.4 allows context-dependent attackers to cause a denial of service (CPU consumption) by executing the vfs.file.cksum command for a special device, as demonstrated by the /dev/urandom device. zabbix_agentd en Zabbix antes de las versiones v1.8.6 y v1.9.x antes de v1.9.4 permite provocar una denegación de servicio (por consumo de CPU) a atacantes (dependiendo del contexto) mediante la ejecución de la orden vfs.file.cksum de un dispositivo especial, por ... • http://www.zabbix.com/rn1.8.6.php • CWE-399: Resource Management Errors •
CVSS: 5.3EPSS: 0%CPEs: 67EXPL: 0CVE-2011-3264
https://notcve.org/view.php?id=CVE-2011-3264
19 Aug 2011 — Zabbix before 1.8.6 allows remote attackers to obtain sensitive information via an invalid srcfld2 parameter to popup.php, which reveals the installation path in an error message. Zabbix antes de la versión v1.8.6 permite a atacantes remotos obtener información sensible a través de un parámetro 'srcfld2' inválido para popup.php, lo que revela la ruta de instalación en un mensaje de error. • http://www.zabbix.com/rn1.8.6.php • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 7.5EPSS: 0%CPEs: 70EXPL: 0CVE-2011-3265
https://notcve.org/view.php?id=CVE-2011-3265
19 Aug 2011 — popup.php in Zabbix before 1.8.7 allows remote attackers to read the contents of arbitrary database tables via a modified srctbl parameter. popup.php en Zabbix antes de la versión v1.8.7 permite a atacantes remotos leer cualquier contenido de las tablas de base de datos mediante un parámetro 'srctbl' debidamente modificado. • http://lists.fedoraproject.org/pipermail/package-announce/2011-September/066092.html • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 6.1EPSS: 0%CPEs: 56EXPL: 0CVE-2010-2790
https://notcve.org/view.php?id=CVE-2010-2790
04 Aug 2010 — Multiple cross-site scripting (XSS) vulnerabilities in the formatQuery function in frontends/php/include/classes/class.curl.php in Zabbix before 1.8.3rc1 allow remote attackers to inject arbitrary web script or HTML via the (1) filter_set, (2) show_details, (3) filter_rst, or (4) txt_select parameters to the triggers page (tr_status.php). NOTE: some of these details are obtained from third party information. Múltiples vulnerabilidades de secuencias de comandos en sitios cruzados (XSS) en la función formatQu... • http://secunia.com/advisories/40679 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.8EPSS: 71%CPEs: 14EXPL: 2CVE-2009-4498 – Zabbix Server - Arbitrary Command Execution
https://notcve.org/view.php?id=CVE-2009-4498
31 Dec 2009 — The node_process_command function in Zabbix Server before 1.8 allows remote attackers to execute arbitrary commands via a crafted request. La función node_process_command function de Zabbix Server en versiones anteriores a la v1.8 permite a atacantes remotos ejecutar comandos de su elección a través de una petición modificada. • https://www.exploit-db.com/exploits/20796 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 9.8EPSS: 0%CPEs: 10EXPL: 1CVE-2009-4499 – Zabbix Server - Multiple Vulnerabilities
https://notcve.org/view.php?id=CVE-2009-4499
31 Dec 2009 — SQL injection vulnerability in the get_history_lastid function in the nodewatcher component in Zabbix Server before 1.6.8 allows remote attackers to execute arbitrary SQL commands via a crafted request, possibly related to the send_history_last_id function in zabbix_server/trapper/nodehistory.c. Vulnerabilidad de inyección SQL en la función get_history_lastid en el componente nodewatcher en Zabbix Server anterior a v1.6.8 permite a atacantes remotos ejecutar comandos SQL de su elección a través de una petic... • https://www.exploit-db.com/exploits/10432 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 7.5EPSS: 0%CPEs: 8EXPL: 0CVE-2009-4500
https://notcve.org/view.php?id=CVE-2009-4500
31 Dec 2009 — The process_trap function in trapper/trapper.c in Zabbix Server before 1.6.6 allows remote attackers to cause a denial of service (crash) via a crafted request with data that lacks an expected : (colon) separator, which triggers a NULL pointer dereference. La función process_trap en trapper/trapper.c en Zabbix Server anteriores a v1.6.6 permite a atacantes remotos provocar una denegación de servicio (caída) a través de una petición manipulada con datos de carece del separador esperado (:), lo que provoca un... • http://secunia.com/advisories/37740 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 7.5EPSS: 4%CPEs: 10EXPL: 1CVE-2009-4501 – Zabbix Server - Multiple Vulnerabilities
https://notcve.org/view.php?id=CVE-2009-4501
31 Dec 2009 — The zbx_get_next_field function in libs/zbxcommon/str.c in Zabbix Server before 1.6.8 allows remote attackers to cause a denial of service (crash) via a request that lacks expected separators, which triggers a NULL pointer dereference, as demonstrated using the Command keyword. La función zbx_get_next_field de libs/zbxcommon/str.c de Zabbix Server anterior a v1.6.8 permite a atacantes remotos provocar una denegación de servicio (caída) a través de una solicitud que carece de los separadores esperados; esto ... • https://www.exploit-db.com/exploits/10432 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 9.8EPSS: 63%CPEs: 11EXPL: 3CVE-2009-4502 – Zabbix Agent - 'net.tcp.listen' Command Injection
https://notcve.org/view.php?id=CVE-2009-4502
31 Dec 2009 — The NET_TCP_LISTEN function in net.c in Zabbix Agent before 1.6.7, when running on FreeBSD or Solaris, allows remote attackers to bypass the EnableRemoteCommands setting and execute arbitrary commands via shell metacharacters in the argument to net.tcp.listen. NOTE: this attack is limited to attacks from trusted IP addresses. La función NET_TCP_LISTEN en net.c en Zabbix Agent versiones anteriores a v1.6.7, cuando se ejecuta en FreeBSD o Solaris, permite a atacantes remotos eludir la asignación de EnableRemo... • https://www.exploit-db.com/exploits/16918 • CWE-264: Permissions, Privileges, and Access Controls •