Page 7 of 98 results (0.010 seconds)

CVSS: 5.3EPSS: 0%CPEs: 5EXPL: 0

CVE-2019-15132

https://notcve.org/view.php?id=CVE-2019-15132

17 Aug 2019 — Zabbix through 4.4.0alpha1 allows User Enumeration. With login requests, it is possible to enumerate application usernames based on the variability of server responses (e.g., the "Login name or password is incorrect" and "No permissions for system access" messages, or just blocking for a number of seconds). This affects both api_jsonrpc.php and index.php. Zabbix versiones hasta 4.4.0alpha1, permite la enumeración de usuarios. Con las peticiones de inicio de sesión, es posible enumerar los nombres de usuario... • https://lists.debian.org/debian-lts-announce/2021/04/msg00018.html • CWE-203: Observable Discrepancy •

CVSS: 6.1EPSS: 0%CPEs: 5EXPL: 1

CVE-2016-10742

https://notcve.org/view.php?id=CVE-2016-10742

17 Feb 2019 — Zabbix before 2.2.21rc1, 3.x before 3.0.13rc1, 3.1.x and 3.2.x before 3.2.10rc1, and 3.3.x and 3.4.x before 3.4.4rc1 allows open redirect via the request parameter. Zabbix, en versiones anteriores a la 2.2.21rc1, versiones 3.x anteriores a la 3.0.13rc1, versiones 3.1.x y versiones 3.2.x anteriores a la 3.2.10rc1, y en versiones 3.3.x y 3.4.x anteriores a la 3.4.4rc1, permite la redirección abierta mediante el parámetro request. • https://lists.debian.org/debian-lts-announce/2019/03/msg00010.html • CWE-601: URL Redirection to Untrusted Site ('Open Redirect') •

CVSS: 4.3EPSS: 0%CPEs: 24EXPL: 1

CVE-2017-2826

https://notcve.org/view.php?id=CVE-2017-2826

09 Apr 2018 — An information disclosure vulnerability exists in the iConfig proxy request of Zabbix server 2.4.X. A specially crafted iConfig proxy request can cause the Zabbix server to send the configuration information of any Zabbix proxy, resulting in information disclosure. An attacker can make requests from an active Zabbix proxy to trigger this vulnerability. Existe una vulnerabilidad de divulgación de información en la petición del proxy iConfig en las versiones 2.4.X del servidor Zabbix. Una petición del proxy i... • https://lists.debian.org/debian-lts-announce/2019/03/msg00010.html • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •

CVSS: 9.8EPSS: 4%CPEs: 43EXPL: 2

CVE-2014-3005

https://notcve.org/view.php?id=CVE-2014-3005

01 Feb 2018 — XML external entity (XXE) vulnerability in Zabbix 1.8.x before 1.8.21rc1, 2.0.x before 2.0.13rc1, 2.2.x before 2.2.5rc1, and 2.3.x before 2.3.2 allows remote attackers to read arbitrary files or potentially execute arbitrary code via a crafted DTD in an XML request. Vulnerabilidad XEE (XML External Entity) en Zabbix 1.8.x anteriores a 1.8.21rc1, 2.0.x anteriores a 2.0.13rc1, 2.2.x anteriores a 2.2.5rc1 y 2.3.x anteriores a 2.3.2 permite que los atacantes remotos lean archivos arbitrarios o puedan ejecutar c... • http://lists.fedoraproject.org/pipermail/package-announce/2014-June/134885.html • CWE-611: Improper Restriction of XML External Entity Reference •

CVSS: 7.0EPSS: 0%CPEs: 3EXPL: 1

CVE-2017-2825 – Debian Security Advisory 3937-1

https://notcve.org/view.php?id=CVE-2017-2825

12 Aug 2017 — In the trapper functionality of Zabbix Server 2.4.x, specifically crafted trapper packets can pass database logic checks, resulting in database writes. An attacker can set up a Man-in-the-Middle server to alter trapper requests made between an active Zabbix proxy and Server to trigger this vulnerability. En la funcionalidad trapper de Zabbix Server 2.4.x, los paquetes trapper específicamente manipulados pueden pasar comprobaciones de lógica de base de datos, lo que resulta en escrituras en la base de datos.... • http://www.securityfocus.com/bid/98094 •

CVSS: 8.1EPSS: 73%CPEs: 23EXPL: 2

CVE-2017-2824 – Debian Security Advisory 3937-1

https://notcve.org/view.php?id=CVE-2017-2824

24 May 2017 — An exploitable code execution vulnerability exists in the trapper command functionality of Zabbix Server 2.4.X. A specially crafted set of packets can cause a command injection resulting in remote code execution. An attacker can make requests from an active Zabbix Proxy to trigger this vulnerability. Se presenta una vulnerabilidad de ejecución de código explotable en la funcionalidad trapper command de Zabbix Server versiones 2.4.X. Un conjunto de paquetes especialmente diseñado puede causar una inyección d... • https://github.com/listenquiet/cve-2017-2824-reverse-shell • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •

CVSS: 9.8EPSS: 88%CPEs: 5EXPL: 2

CVE-2016-10134 – Zabbix toggle_ids SQL Injection

https://notcve.org/view.php?id=CVE-2016-10134

16 Feb 2017 — SQL injection vulnerability in Zabbix before 2.2.14 and 3.0 before 3.0.4 allows remote attackers to execute arbitrary SQL commands via the toggle_ids array parameter in latest.php. Vulnerabilidad de inyección SQL en Zabbix en versiones anteriores a 2.2.14 y 3.0 en versiones anteriores a 3.0.4 permite a atacantes remotos ejecutar comandos SQL arbitrarios a través del parámetro de array toggle_ids en latest.php. • https://packetstorm.news/files/id/180650 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •

CVSS: 8.1EPSS: 45%CPEs: 33EXPL: 5

CVE-2016-4338 – Zabbix Agent 3.0.1 - 'mysql.size' Shell Command Injection

https://notcve.org/view.php?id=CVE-2016-4338

03 May 2016 — The mysql user parameter configuration script (userparameter_mysql.conf) in the agent in Zabbix before 2.0.18, 2.2.x before 2.2.13, and 3.0.x before 3.0.3, when used with a shell other than bash, allows context-dependent attackers to execute arbitrary code or SQL commands via the mysql.size parameter. La secuencia de comandos de configuración de parámetros de usuario de mysql (userparameter_mysql.conf) en el agente en Zabbix en versiones anteriores a 2.0.18, 2.2.x en versiones anteriores a 2.2.13 y 3.0.x en... • https://packetstorm.news/files/id/136898 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •

CVSS: 9.8EPSS: 0%CPEs: 57EXPL: 0

CVE-2014-9450

https://notcve.org/view.php?id=CVE-2014-9450

02 Jan 2015 — Multiple SQL injection vulnerabilities in chart_bar.php in the frontend in Zabbix before 1.8.22, 2.0.x before 2.0.14, and 2.2.x before 2.2.8 allow remote attackers to execute arbitrary SQL commands via the (1) itemid or (2) periods parameter. Múltiples vulnerabilidades de inyección SQL en chart_bar.php en el frontend en Zabbix anterior a 1.8.22, 2.0.x anterior a 2.0.14, y 2.2.x anterior a 2.2.8 permiten a atacantes remotos ejecutar comandos SQL arbitrarios a través del parámetro (1) itemid o (2) periods. • http://secunia.com/advisories/61554 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •

CVSS: 6.5EPSS: 0%CPEs: 46EXPL: 0

CVE-2014-1682

https://notcve.org/view.php?id=CVE-2014-1682

08 May 2014 — The API in Zabbix before 1.8.20rc1, 2.0.x before 2.0.11rc1, and 2.2.x before 2.2.2rc1 allows remote authenticated users to spoof arbitrary users via the user name in a user.login request. La API en Zabbix anterior a 1.8.20rc1, 2.0.x anterior a 2.0.11rc1 y 2.2.x anterior a 2.2.2rc1 permite a usuarios remotos autenticados falsificar usuarios arbitrarios a través del nombre de usuario en una solicitud user.login. • http://lists.fedoraproject.org/pipermail/package-announce/2014-May/132376.html • CWE-287: Improper Authentication •