2074 matches found
Zabbix - SAML SSO Authentication Bypass
When SAML SSO authentication is enabled non-default, session data can be modified by a malicious actor because a user login stored in the session was not verified. id: CVE-2022-23131 info: name: Zabbix - SAML SSO Authentication Bypass author: For3stCo1d,spac3wh1te severity: critical description:...
Zabbix - SQL Injection
Zabbix before 2.2.14 and 3.0 before 3.0.4 allows remote attackers to execute arbitrary SQL commands via the toggleids array parameter in latest.php and perform SQL injection attacks. id: CVE-2016-10134 info: name: Zabbix - SQL Injection author: princechaddha severity: critical description: Zabbix...
Zabbix <=4.4 - Authentication Bypass
Zabbix through 4.4 is susceptible to an authentication bypass vulnerability via zabbix.php?action=dashboard.view&dashboardid=1. An attacker can bypass the login page and access the dashboard page, and then create a Dashboard, Report, Screen, or Map without any Username/Password i.e., anonymously...
Grafana & Zabbix Integration - Credentials Disclosure
Grafana through 7.3.4, when integrated with Zabbix, contains a credential disclosure vulnerability. The Zabbix password can be found in the apijsonrpc.php HTML source code. When the user logs in and allows the user to register, one can right click to view the source code and use Ctrl-F to search...
Astra Linux – Vulnerability in Zabbix
The researcher has shown that due to the way the SNMP trap log is parsed, an attacker can create an SNMP trap with additional lines of information, causing forged data to appear in the Zabbix UI. This attack requires that SNMP authentication be disabled, and/or that the attacker knows the...
Astra Linux – Vulnerability in Zabbix
During Zabbix installation from RPM, the DACOVERRIDE SELinux capability is used to access PID files in the /var/run/zabbix folder. In this case, processes of Zabbix Proxy or Server can bypass the file read, write, and execute permission checks at the file system level...
Astra Linux – Vulnerability in Zabbix
Currently, the geomap configuration Administration - General - Geographical maps allows the use of HTML in the “Attribution text” field when the “Other” Tile provider is selected...
Astra Linux – Vulnerability in Zabbix
The zabbix/src/libs/zbxjson module is vulnerable to a buffer overflow when parsing JSON files using zbxjsonopen...
Astra Linux – Vulnerability in Zabbix
Zabbix allows for the configuration of SMS notifications. AT command injection occurs on the “Zabbix Server” because there is no validation of the “Number” field either on the web interface or on the Zabbix server side. An attacker can send specially crafted phone numbers via SMS and execute...
Zabbix Setup Configuration Authentication Bypass
After the initial setup process, some steps of setup.php file are reachable not only by super-administrators but also by unauthenticated users. A malicious actor can pass step checks and potentially change the configuration of Zabbix Frontend. id: CVE-2022-23134 info: name: Zabbix Setup...
CVE-2026-45305 vulnerabilities
Vulnerabilities for packages: zabbix-fips...
CVE-2026-45133 vulnerabilities
Vulnerabilities for packages: zabbix-fips...
GHSA-C2P3-7M5P-CV8X vulnerabilities
Vulnerabilities for packages: zabbix-fips...
GHSA-9FRC-8383-795M vulnerabilities
Vulnerabilities for packages: zabbix-fips...
GHSA-4QPC-3HR4-R2P4 vulnerabilities
Vulnerabilities for packages: zabbix-fips...
CVE-2026-45304 vulnerabilities
Vulnerabilities for packages: zabbix-fips...
Vuln2Action-Demo
Vuln2Action-Demo This repository contains the demo video for t...
bug-bounty-hunts
Bug Bounty Hunts Curated writeups and proof-of-concept materi...
Astra Linux - уязвимость в zabbix
A specially crafted string can cause a buffer overflow in the JSON parser library, resulting in a crash of the Zabbix Server or Zabbix Proxy...
Astra Linux - уязвимость в zabbix
A authenticated user can create a link containing reflected JavaScript code for the graphs page and send it to other users. The payload can only be executed with a known CSRF token value of the victim, which is changed periodically and is difficult to predict...