Page 3 of 25 results (0.003 seconds)

CVSS: 5.3EPSS: 0%CPEs: 67EXPL: 0

CVE-2011-3264

https://notcve.org/view.php?id=CVE-2011-3264

19 Aug 2011 — Zabbix before 1.8.6 allows remote attackers to obtain sensitive information via an invalid srcfld2 parameter to popup.php, which reveals the installation path in an error message. Zabbix antes de la versión v1.8.6 permite a atacantes remotos obtener información sensible a través de un parámetro 'srcfld2' inválido para popup.php, lo que revela la ruta de instalación en un mensaje de error. • http://www.zabbix.com/rn1.8.6.php • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •

CVSS: 7.5EPSS: 0%CPEs: 71EXPL: 1

CVE-2011-3263 – Gentoo Linux Security Advisory 201311-15

https://notcve.org/view.php?id=CVE-2011-3263

19 Aug 2011 — zabbix_agentd in Zabbix before 1.8.6 and 1.9.x before 1.9.4 allows context-dependent attackers to cause a denial of service (CPU consumption) by executing the vfs.file.cksum command for a special device, as demonstrated by the /dev/urandom device. zabbix_agentd en Zabbix antes de las versiones v1.8.6 y v1.9.x antes de v1.9.4 permite provocar una denegación de servicio (por consumo de CPU) a atacantes (dependiendo del contexto) mediante la ejecución de la orden vfs.file.cksum de un dispositivo especial, por ... • http://www.zabbix.com/rn1.8.6.php • CWE-399: Resource Management Errors •

CVSS: 6.1EPSS: 0%CPEs: 67EXPL: 1

CVE-2011-2904 – Gentoo Linux Security Advisory 201311-15

https://notcve.org/view.php?id=CVE-2011-2904

19 Aug 2011 — Cross-site scripting (XSS) vulnerability in acknow.php in Zabbix before 1.8.6 allows remote attackers to inject arbitrary web script or HTML via the backurl parameter. Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en acknow.php en Zabbix antes de la versión 1.8.6 permite a atacantes remotos inyectar secuencias de comandos web o HTML a través del parámetro 'backurl'. Multiple vulnerabilities have been found in Zabbix, possibly leading to SQL injection attacks, Denial of Service, or inform... • http://lists.fedoraproject.org/pipermail/package-announce/2011-August/063884.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 6.1EPSS: 0%CPEs: 56EXPL: 0

CVE-2010-2790

https://notcve.org/view.php?id=CVE-2010-2790

04 Aug 2010 — Multiple cross-site scripting (XSS) vulnerabilities in the formatQuery function in frontends/php/include/classes/class.curl.php in Zabbix before 1.8.3rc1 allow remote attackers to inject arbitrary web script or HTML via the (1) filter_set, (2) show_details, (3) filter_rst, or (4) txt_select parameters to the triggers page (tr_status.php). NOTE: some of these details are obtained from third party information. Múltiples vulnerabilidades de secuencias de comandos en sitios cruzados (XSS) en la función formatQu... • http://secunia.com/advisories/40679 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 9.8EPSS: 71%CPEs: 14EXPL: 3

CVE-2009-4498 – Zabbix Server Arbitrary Command Execution

https://notcve.org/view.php?id=CVE-2009-4498

31 Dec 2009 — The node_process_command function in Zabbix Server before 1.8 allows remote attackers to execute arbitrary commands via a crafted request. La función node_process_command function de Zabbix Server en versiones anteriores a la v1.8 permite a atacantes remotos ejecutar comandos de su elección a través de una petición modificada. • https://packetstorm.news/files/id/115950 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •