CVSS: 6.1EPSS: 0%CPEs: 84EXPL: 0CVE-2011-4615
https://notcve.org/view.php?id=CVE-2011-4615
29 Dec 2011 — Multiple cross-site scripting (XSS) vulnerabilities in Zabbix before 1.8.10 allow remote attackers to inject arbitrary web script or HTML via the gname parameter (aka host groups name) to (1) hostgroups.php and (2) usergrps.php, the update action to (3) hosts.php and (4) scripts.php, and (5) maintenance.php. Varias vulnerabilidades de ejecución de comandos en sitios cruzados (XSS) en Zabbix anterior a v1.8.10 permite a atacantes remotos inyectar secuencias de comandos web o HTML a través del parámetro gname... • http://lists.fedoraproject.org/pipermail/package-announce/2012-January/071660.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 84EXPL: 0CVE-2011-5027
https://notcve.org/view.php?id=CVE-2011-5027
29 Dec 2011 — Cross-site scripting (XSS) vulnerability in ZABBIX before 1.8.10 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to the profiler. Vulnerabilidad de ejecución de secuencias de comandos en sitios cruzados (XSS) en Zabbix anterior a v1.8.10 permite a atacantes remotos inyectar secuencias de comandos web o HTML a través de vectores no especificados relacionados con el perfilador. • http://lists.fedoraproject.org/pipermail/package-announce/2012-January/071660.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.8EPSS: 0%CPEs: 2EXPL: 4CVE-2011-4674 – Zabbix 1.8.4 - 'popup.php' SQL Injection
https://notcve.org/view.php?id=CVE-2011-4674
02 Dec 2011 — SQL injection vulnerability in popup.php in Zabbix 1.8.3 and 1.8.4, and possibly other versions before 1.8.9, allows remote attackers to execute arbitrary SQL commands via the only_hostid parameter. Vulnerabilidad de inyección SQL en popup.php en Zabbix v1.8.3 y v1.8.4, y posiblemente otras versiones anteriores a v1.8.9, permite a atacantes remotos inyectar comandos SQL de su elección a través del parámetro only_hostid Multiple vulnerabilities have been found in Zabbix, possibly leading to SQL injection att... • https://www.exploit-db.com/exploits/18155 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 9.8EPSS: 0%CPEs: 55EXPL: 0CVE-2010-5049
https://notcve.org/view.php?id=CVE-2010-5049
23 Nov 2011 — SQL injection vulnerability in events.php in Zabbix 1.8.1 and earlier allows remote attackers to execute arbitrary SQL commands via the nav_time parameter. Vulnerabilidad de inyección SQL en events.php en Zabbix v1.8.1 y anteriores, permite a atacantes remotos inyectar comandos SQL de su elección a través del parámetro nav_time. • http://packetstormsecurity.org/1004-exploits/zabbix181-sql.txt • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 7.5EPSS: 0%CPEs: 71EXPL: 1CVE-2011-3263 – Gentoo Linux Security Advisory 201311-15
https://notcve.org/view.php?id=CVE-2011-3263
19 Aug 2011 — zabbix_agentd in Zabbix before 1.8.6 and 1.9.x before 1.9.4 allows context-dependent attackers to cause a denial of service (CPU consumption) by executing the vfs.file.cksum command for a special device, as demonstrated by the /dev/urandom device. zabbix_agentd en Zabbix antes de las versiones v1.8.6 y v1.9.x antes de v1.9.4 permite provocar una denegación de servicio (por consumo de CPU) a atacantes (dependiendo del contexto) mediante la ejecución de la orden vfs.file.cksum de un dispositivo especial, por ... • http://www.zabbix.com/rn1.8.6.php • CWE-399: Resource Management Errors •
CVSS: 6.1EPSS: 0%CPEs: 67EXPL: 1CVE-2011-2904 – Gentoo Linux Security Advisory 201311-15
https://notcve.org/view.php?id=CVE-2011-2904
19 Aug 2011 — Cross-site scripting (XSS) vulnerability in acknow.php in Zabbix before 1.8.6 allows remote attackers to inject arbitrary web script or HTML via the backurl parameter. Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en acknow.php en Zabbix antes de la versión 1.8.6 permite a atacantes remotos inyectar secuencias de comandos web o HTML a través del parámetro 'backurl'. Multiple vulnerabilities have been found in Zabbix, possibly leading to SQL injection attacks, Denial of Service, or inform... • http://lists.fedoraproject.org/pipermail/package-announce/2011-August/063884.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.3EPSS: 0%CPEs: 67EXPL: 0CVE-2011-3264
https://notcve.org/view.php?id=CVE-2011-3264
19 Aug 2011 — Zabbix before 1.8.6 allows remote attackers to obtain sensitive information via an invalid srcfld2 parameter to popup.php, which reveals the installation path in an error message. Zabbix antes de la versión v1.8.6 permite a atacantes remotos obtener información sensible a través de un parámetro 'srcfld2' inválido para popup.php, lo que revela la ruta de instalación en un mensaje de error. • http://www.zabbix.com/rn1.8.6.php • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 7.5EPSS: 0%CPEs: 70EXPL: 0CVE-2011-3265
https://notcve.org/view.php?id=CVE-2011-3265
19 Aug 2011 — popup.php in Zabbix before 1.8.7 allows remote attackers to read the contents of arbitrary database tables via a modified srctbl parameter. popup.php en Zabbix antes de la versión v1.8.7 permite a atacantes remotos leer cualquier contenido de las tablas de base de datos mediante un parámetro 'srctbl' debidamente modificado. • http://lists.fedoraproject.org/pipermail/package-announce/2011-September/066092.html • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 6.1EPSS: 0%CPEs: 56EXPL: 0CVE-2010-2790
https://notcve.org/view.php?id=CVE-2010-2790
04 Aug 2010 — Multiple cross-site scripting (XSS) vulnerabilities in the formatQuery function in frontends/php/include/classes/class.curl.php in Zabbix before 1.8.3rc1 allow remote attackers to inject arbitrary web script or HTML via the (1) filter_set, (2) show_details, (3) filter_rst, or (4) txt_select parameters to the triggers page (tr_status.php). NOTE: some of these details are obtained from third party information. Múltiples vulnerabilidades de secuencias de comandos en sitios cruzados (XSS) en la función formatQu... • http://secunia.com/advisories/40679 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.8EPSS: 0%CPEs: 2EXPL: 4CVE-2010-1277 – Gentoo Linux Security Advisory 201311-15
https://notcve.org/view.php?id=CVE-2010-1277
06 Apr 2010 — SQL injection vulnerability in the user.authenticate method in the API in Zabbix 1.8 before 1.8.2 allows remote attackers to execute arbitrary SQL commands via the user parameter in JSON data to api_jsonrpc.php. Vulnerabilidad de inyección SQL en el método user.authenticate en la API en Zabbix desde v1.8 anteriores a 1.8.2 permite a atacantes remotos ejecutar comandos SQL arbitrarios a través del parámetro "user" en los datos JSON a api_jsonrpc.php. Multiple vulnerabilities have been found in Zabbix, possib... • http://archives.neohapsis.com/archives/fulldisclosure/2010-04/0001.html • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •