CVSS: 4.3EPSS: 0%CPEs: 56EXPL: 0CVE-2010-2790
https://notcve.org/view.php?id=CVE-2010-2790
Multiple cross-site scripting (XSS) vulnerabilities in the formatQuery function in frontends/php/include/classes/class.curl.php in Zabbix before 1.8.3rc1 allow remote attackers to inject arbitrary web script or HTML via the (1) filter_set, (2) show_details, (3) filter_rst, or (4) txt_select parameters to the triggers page (tr_status.php). NOTE: some of these details are obtained from third party information. Múltiples vulnerabilidades de secuencias de comandos en sitios cruzados (XSS) en la función formatQuery en frontends/php/include/classes/class.curl.php de Zabbix anterior a v1.8.3rc1 permite a atacantes remotos injectar a su elección código web o HTML a través de los parámetros (1) filter_set, (2) show_details, (3) filter_rst, o (4) txt_select al lanzar la página (tr_status.php). NOTA: algunos de estos detalles se han obtenido de información de terceros. • http://secunia.com/advisories/40679 http://www.securityfocus.com/bid/42017 http://www.vupen.com/english/advisories/2010/1908 http://www.zabbix.com/forum/showthread.php?p=68770 https://exchange.xforce.ibmcloud.com/vulnerabilities/60772 https://support.zabbix.com/browse/ZBX-2326 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 4CVE-2010-1277
https://notcve.org/view.php?id=CVE-2010-1277
SQL injection vulnerability in the user.authenticate method in the API in Zabbix 1.8 before 1.8.2 allows remote attackers to execute arbitrary SQL commands via the user parameter in JSON data to api_jsonrpc.php. Vulnerabilidad de inyección SQL en el método user.authenticate en la API en Zabbix desde v1.8 anteriores a 1.8.2 permite a atacantes remotos ejecutar comandos SQL arbitrarios a través del parámetro "user" en los datos JSON a api_jsonrpc.php. • http://archives.neohapsis.com/archives/fulldisclosure/2010-04/0001.html http://legalhackers.com/advisories/zabbix181api-sql.txt http://legalhackers.com/poc/zabbix181api.pl-poc http://secunia.com/advisories/39119 http://www.osvdb.org/63456 http://www.securityfocus.com/archive/1/510480/100/0/threaded http://www.securityfocus.com/bid/39148 http://www.vupen.com/english/advisories/2010/0799 http://www.zabbix.com/rn1.8.2.php • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •