The vulnerability of the Universal Monitoring System Interface of Zabbix, which allows attackers to escalate their privileges

The vulnerability of the Zabbix monitoring system’s universal interface is related to deficiencies in the authentication process. Exploiting this vulnerability allows a malicious actor to increase their privileges remotely...

Exploit for CVE-2024-42327

PoC for CVE-2024-42327 / ZBX-25623 A non-admin user account on...

The vulnerability of the addRelatedObjects function in the universal monitoring system Zabbix allows attackers to increase their privileges.

The vulnerability of the addRelatedObjects function in the universal monitoring system Zabbix is related to the lack of measures taken to protect the SQL query structure. Exploiting this vulnerability allows a malicious actor to enhance their privileges by sending specially crafted SQL queries...

FreeBSD : zabbix -- SQL injection in user.get API (f0d33375-b0e0-11ef-a724-b42e991fc52e)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the f0d33375-b0e0-11ef-a724-b42e991fc52e advisory. [email protected] reports: A non-admin user account on the Zabbix frontend with the default User role...

OPENSUSE-SU-2024:0384-1 Security update for zabbix

This update for zabbix fixes the following issues: Zabbix was updated to 6.0.33: - this version fixes CVE-2024-36461 and CVE-2024-22114 - New Features and Improvements + ZBXNEXT-9000 Changed query table for ASM disk group metrics in Oracle Database plugin and Oracle by ODBC template Agent Templat...

Security update for zabbix (moderate)

openSUSE Security Update: Security update for zabbix Announcement ID: openSUSE-SU-2024:0384-1 Rating: moderate References: 1229198 1229204 Cross-References: CVE-2024-22114 CVE-2024-36461 CVSS scores: CVE-2024-22114 SUSE: 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CVE-2024-36461 SUSE: 9.1...

SUSE CVE-2024-36463

The implementation of atob in "Zabbix JS" allows to create a string with arbitrary content and use it to access internal properties of objects...

SUSE CVE-2024-42332

The researcher is showing that due to the way the SNMP trap log is parsed, an attacker can craft an SNMP trap with additional lines of information and have forged data show in the Zabbix UI. This attack requires SNMP auth to be off and/or the attacker to know the community/auth details. The attac...

Vulnerability fixed in Zabbix

A vulnerability has been fixed in Zabbix. The vulnerability is in how the CUser class handles the addRelatedObjects function. This could allow non-administrators with API access to perform an SQL injection, which could lead to unauthorized access to sensitive data. The vulnerability could enable...

CVE-2024-36466 Unauthenticated Zabbix frontend takeover when SSO is being used

A bug in the code allows an attacker to sign a forged zbxsession cookie, which then allows them to sign in with admin permissions...

CVE-2024-36466 Unauthenticated Zabbix frontend takeover when SSO is being used

A bug in the code allows an attacker to sign a forged zbxsession cookie, which then allows them to sign in with admin permissions...

SUSE CVE-2024-36468

The reported vulnerability is a stack buffer overflow in the zbxsnmpcachehandleengineid function within the Zabbix server/proxy code. This issue occurs when copying data from session-securityEngineID to localrecord.engineid without proper bounds checking...

SUSE CVE-2024-42327

A non-admin user account on the Zabbix frontend with the default User role, or with any other role that gives API access can exploit this vulnerability. An SQLi exists in the CUser class in the addRelatedObjects function, this function is being called from the CUser.get function which is availabl...

SUSE CVE-2024-42333

The researcher is showing that it is possible to leak a small amount of Zabbix Server memory using an out of bounds read in src/libs/zbxmedia/email.c...

Zabbix 安全漏洞

Zabbix is an open source monitoring system from Zabbix. The system supports network monitoring, server monitoring, cloud monitoring, and application monitoring. A security vulnerability exists in Zabbix versions 6.0.0 through 6.0.31, 6.4.0 through 6.4.16, and 7.0.0, which stems from a bug in the...

DEBIAN-CVE-2024-42332

The researcher is showing that due to the way the SNMP trap log is parsed, an attacker can craft an SNMP trap with additional lines of information and have forged data show in the Zabbix UI. This attack requires SNMP auth to be off and/or the attacker to know the community/auth details. The attac...

DEBIAN-CVE-2024-42333

The researcher is showing that it is possible to leak a small amount of Zabbix Server memory using an out of bounds read in src/libs/zbxmedia/email.c...

CVE-2024-42332

The researcher is showing that due to the way the SNMP trap log is parsed, an attacker can craft an SNMP trap with additional lines of information and have forged data show in the Zabbix UI. This attack requires SNMP auth to be off and/or the attacker to know the community/auth details. The attac...

CVE-2024-42332

The researcher is showing that due to the way the SNMP trap log is parsed, an attacker can craft an SNMP trap with additional lines of information and have forged data show in the Zabbix UI. This attack requires SNMP auth to be off and/or the attacker to know the community/auth details. The attac...

CVE-2024-42333

The researcher is showing that it is possible to leak a small amount of Zabbix Server memory using an out of bounds read in src/libs/zbxmedia/email.c...