CVSS: 8.3EPSS: 0%CPEs: 8EXPL: 0CVE-2023-32727 – Code execution vulnerability in icmpping
https://notcve.org/view.php?id=CVE-2023-32727
18 Dec 2023 — An attacker who has the privilege to configure Zabbix items can use function icmpping() with additional malicious command inside it to execute arbitrary code on the current Zabbix server. Un atacante que tiene el privilegio de configurar elementos de Zabbix puede usar la función icmpping() con un comando malicioso adicional dentro para ejecutar código arbitrario en el servidor Zabbix actual. • https://support.zabbix.com/browse/ZBX-23857 • CWE-20: Improper Input Validation •
CVSS: 8.1EPSS: 0%CPEs: 5EXPL: 0CVE-2023-32726 – Possible buffer overread from reading DNS responses
https://notcve.org/view.php?id=CVE-2023-32726
18 Dec 2023 — The vulnerability is caused by improper check for check if RDLENGTH does not overflow the buffer in response from DNS server. La vulnerabilidad se debe a una verificación incorrecta de si RDLENGTH no desborda el búfer en respuesta del servidor DNS. • https://lists.debian.org/debian-lts-announce/2024/01/msg00012.html • CWE-754: Improper Check for Unusual or Exceptional Conditions •
CVSS: 10.0EPSS: 0%CPEs: 10EXPL: 0CVE-2023-32725 – Leak of zbx_session cookie when using a scheduled report that includes a dashboard with a URL widget.
https://notcve.org/view.php?id=CVE-2023-32725
18 Dec 2023 — The website configured in the URL widget will receive a session cookie when testing or executing scheduled reports. The received session cookie can then be used to access the frontend as the particular user. El sitio web configurado en el widget de la URL recibirá una cookie de sesión al probar o ejecutar informes programados. La cookie de sesión recibida se puede utilizar para acceder a la interfaz como usuario particular. • https://support.zabbix.com/browse/ZBX-23854 • CWE-565: Reliance on Cookies without Validation and Integrity Checking •
CVSS: 9.1EPSS: 0%CPEs: 6EXPL: 0CVE-2023-32724 – JavaScript engine memory pointers are directly available for Zabbix users for modification
https://notcve.org/view.php?id=CVE-2023-32724
12 Oct 2023 — Memory pointer is in a property of the Ducktape object. This leads to multiple vulnerabilities related to direct memory access and manipulation. El puntero de memoria está en una propiedad del objeto Ducktape. Esto conduce a múltiples vulnerabilidades relacionadas con el acceso directo y la manipulación de la memoria. • https://support.zabbix.com/browse/ZBX-23391 • CWE-732: Incorrect Permission Assignment for Critical Resource •
CVSS: 9.4EPSS: 0%CPEs: 5EXPL: 0CVE-2023-32723 – Inefficient permission check in class CControllerAuthenticationUpdate
https://notcve.org/view.php?id=CVE-2023-32723
12 Oct 2023 — Request to LDAP is sent before user permissions are checked. La solicitud a LDAP se envía antes de que se verifiquen los permisos del usuario. • https://lists.debian.org/debian-lts-announce/2024/01/msg00012.html • CWE-732: Incorrect Permission Assignment for Critical Resource •
CVSS: 9.6EPSS: 0%CPEs: 5EXPL: 0CVE-2023-32722 – Stack-buffer Overflow in library module zbxjson
https://notcve.org/view.php?id=CVE-2023-32722
12 Oct 2023 — The zabbix/src/libs/zbxjson module is vulnerable to a buffer overflow when parsing JSON files via zbx_json_open. El módulo zabbix/src/libs/zbxjson es vulnerable a un desbordamiento del búfer al analizar archivos JSON a través de zbx_json_open. • https://support.zabbix.com/browse/ZBX-23390 • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') CWE-787: Out-of-bounds Write •
CVSS: 7.6EPSS: 0%CPEs: 7EXPL: 0CVE-2023-32721 – Stored XSS in Maps element
https://notcve.org/view.php?id=CVE-2023-32721
12 Oct 2023 — A stored XSS has been found in the Zabbix web application in the Maps element if a URL field is set with spaces before URL. Se ha encontrado Cross-Site Scripting (XSS) almacenado en la aplicación web Zabbix en el elemento Maps si un campo URL está configurado con espacios antes de la URL. • https://lists.debian.org/debian-lts-announce/2024/01/msg00012.html • CWE-20: Improper Input Validation CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 10.0EPSS: 0%CPEs: 3EXPL: 0CVE-2023-29453 – Agent 2 package are built with Go version affected by CVE-2023-24538
https://notcve.org/view.php?id=CVE-2023-29453
12 Oct 2023 — Templates do not properly consider backticks (`) as Javascript string delimiters, and do not escape them as expected. Backticks are used, since ES6, for JS template literals. If a template contains a Go template action within a Javascript template literal, the contents of the action can be used to terminate the literal, injecting arbitrary Javascript code into the Go template. As ES6 template literals are rather complex, and themselves can do string interpolation, the decision was made to simply disallow Go... • https://support.zabbix.com/browse/ZBX-23388 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 0CVE-2023-30958 – DOM XSS in Developer mode dashboard via redirect GET parameter
https://notcve.org/view.php?id=CVE-2023-30958
03 Aug 2023 — A security defect was identified in Foundry Frontend that enabled users to potentially conduct DOM XSS attacks if Foundry's CSP were to be bypassed. This defect was resolved with the release of Foundry Frontend 6.225.0. • https://palantir.safebase.us/?tcuUid=5764b094-d3c0-4380-90f2-234f36116c9b • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CWE-83: Improper Neutralization of Script in Attributes in a Web Page •
CVSS: 6.4EPSS: 0%CPEs: 3EXPL: 0CVE-2023-29457 – Insufficient validation of Action form input fields
https://notcve.org/view.php?id=CVE-2023-29457
13 Jul 2023 — Reflected XSS attacks, occur when a malicious script is reflected off a web application to the victim's browser. The script can be activated through Action form fields, which can be sent as request to a website with a vulnerability that enables execution of malicious scripts. • https://lists.debian.org/debian-lts-announce/2023/08/msg00027.html • CWE-20: Improper Input Validation CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •