Astra Linux – Vulnerability in Zabbix

Templates do not properly handle backticks as JavaScript string delimiters, and do not escape them as expected. Backticks have been used since ES6 for JavaScript template literals. If a template contains a Go template action within a JavaScript template literal, the contents of the action can be...

Astra Linux – Vulnerability in Zabbix

A authenticated user can create a link containing reflected JavaScript code on it for the discovery page and send it to other users. The payload can only be executed with a known CSRF token value of the victim, which is changed periodically and is difficult to predict...

Astra Linux – Vulnerability in Zabbix

An attacker who has the privilege to configure Zabbix items can use the icmpping function, along with additional malicious commands, to execute arbitrary code on the current Zabbix server...

Astra Linux – Vulnerability in Zabbix

There is a vulnerability related to arbitrary file reading in the Zabbix Web Service Report Generation module, which listens on port 10053. The service does not perform proper validation on URL parameters before reading the files...

Astra Linux – Vulnerability in Zabbix

A authenticated user can create a link containing reflected JavaScript code on its own pages and send it to other users. The payload can only be executed with a known CSRF token value of the victim, which is changed periodically and is difficult to predict. Malicious code has access to all the sa...

Astra Linux – Vulnerability in Zabbix

Reflected XSS attacks occur when a malicious script is reflected from a web application into the victim’s browser. The script can be activated through action form fields, which are sent as requests to a website with vulnerabilities that allow the execution of malicious scripts...

Astra Linux – Vulnerability in Zabbix

The vulnerability is caused by an improper check to ensure that RDLENGTH does not overflow the buffer in response from the DNS server...

Astra Linux – Vulnerability in Zabbix

The cause of the vulnerability is improper validation of the “Name” field in the form input on the Graph page in the Items section...

Astra Linux – Vulnerability in Zabbix

The zabbix/src/libs/zbxjson module is vulnerable to a buffer overflow when parsing JSON files using zbxjsonopen...

Astra Linux – Vulnerability in Zabbix

A stored XSS vulnerability has been detected in the Zabbix web application, specifically in the Maps element, when a URL field contains spaces before the URL...

Astra Linux – Vulnerability in Zabbix

Reflected XSS attacks, also known as non-persistent attacks, occur when a malicious script is reflected from a web application to the victim’s browser. The script is activated through a link, which sends a request to a website with a vulnerability that allows the execution of malicious scripts...

Astra Linux – Vulnerability in Zabbix

The Zabbix Agent 2 item key “smart.disk.get” does not sanitize its parameters before passing them to a shell command, which may lead to a vulnerability for remote code execution...

Astra Linux – Vulnerability in Zabbix

A specially crafted string can cause a buffer overflow in the JSON parser library, resulting in a crash of the Zabbix Server or Zabbix Proxy...

Astra Linux – Vulnerability in Zabbix

Currently, the geomap configuration Administration - General - Geographical maps allows the use of HTML in the “Attribution text” field when the “Other” Tile provider is selected...

Astra Linux – Vulnerability in Zabbix

Zabbix Frontend offers a feature that enables administrators to manage the installation and ensure that only certain IP addresses can access it. This way, no user will be able to access the Zabbix Frontend during maintenance, and sensitive data will be protected from being disclosed. An attacker...

Astra Linux – Vulnerability in Zabbix

The memory pointer is a property of the Ducktape object. This leads to multiple vulnerabilities related to direct memory access and manipulation...

Astra Linux – Vulnerability in Zabbix

The Zabbix Agent 2 smartctl plugin does not properly sanitize the parameters of the smart.disk.get command, allowing an attacker to inject unexpected arguments into the smartctl command. In Zabbix 5.0, this allows for remote code execution...

Astra Linux – Vulnerability in Zabbix

The Zabbix server can execute commands for configured scripts. After the command is executed, an audit entry is added to the “Audit Log”. Since the “clientip” field is not sanitized, it is possible to inject SQL code into the “clientip” field, resulting in time-based blind SQL injection attacks...

Astra Linux – Vulnerability in Zabbix

Stored or persistent cross-site scripting XSS is a type of XSS attack where the attacker first sends the malicious payload to the web application. The application then stores the payload e.g., in a database or server-side text files. Eventually, the application inadvertently executes the payload...

Astra Linux – Vulnerability in Zabbix

The URL validation scheme receives input from a user and then parses it to identify its various components. This validation scheme ensures that all URL components comply with internet standards...