CVE-2024-22123

CVE-2024-22123 affects Zabbix server on Linux where SMS media can point to a GSM modem file. The underlying issue is that Linux treats everything as a file, allowing an attacker to replace the modem file with another file (e.g., a log file). Zabbix server may then attempt to communicate with that...

CVE-2024-22123 Zabbix Arbitrary File Read

Setting SMS media allows to set GSM modem file. Later this file is used as Linux device. But due everything is a file for Linux, it is possible to set another file, e.g. log file and zabbixserver will try to communicate with it as modem. As a result, log file will be broken with AT commands and...

CVE-2024-22123 Zabbix Arbitrary File Read

Setting SMS media allows to set GSM modem file. Later this file is used as Linux device. But due everything is a file for Linux, it is possible to set another file, e.g. log file and zabbixserver will try to communicate with it as modem. As a result, log file will be broken with AT commands and...

CVE-2024-36461 Direct access to memory pointers within the JS engine for modification

Within Zabbix, users have the ability to directly modify memory pointers in the JavaScript engine...

CVE-2024-36461

CVE-2024-36461 affects Zabbix where a user can directly modify memory pointers in the JavaScript engine, enabling remote code execution with limited privileges. Public advisories in multiple distros corroborate the vulnerability and list patches: openSUSE/SUSE notes CVE-36461 fixed in Zabbix 6.0....

CVE-2024-36461 Direct access to memory pointers within the JS engine for modification

Within Zabbix, users have the ability to directly modify memory pointers in the JavaScript engine...

CVE-2024-36461

Within Zabbix, users have the ability to directly modify memory pointers in the JavaScript engine...

CVE-2024-22122 AT(GSM) Command Injection

Zabbix allows to configure SMS notifications. AT command injection occurs on "Zabbix Server" because there is no validation of "Number" field on Web nor on Zabbix server side. Attacker can run test of SMS providing specially crafted phone number and execute additional AT commands on modem...

CVE-2024-22122

CVE-2024-22122 affects Zabbix: AT command injection via SMS configuration in Zabbix Server due to lack of validation of the Number field on both web and server sides. Exploitation involves sending crafted phone numbers to trigger AT commands on the modem, enabling remote-like actions. Affected pr...

CVE-2024-22122 AT(GSM) Command Injection

Zabbix allows to configure SMS notifications. AT command injection occurs on "Zabbix Server" because there is no validation of "Number" field on Web nor on Zabbix server side. Attacker can run test of SMS providing specially crafted phone number and execute additional AT commands on modem...

CVE-2024-22122

Zabbix allows to configure SMS notifications. AT command injection occurs on "Zabbix Server" because there is no validation of "Number" field on Web nor on Zabbix server side. Attacker can run test of SMS providing specially crafted phone number and execute additional AT commands on modem...

CVE-2024-22121 Zabbix Agent MSI Installer Allows Non-Admin User to Access Change Option via msiexec.exe

A non-admin user can change or remove important features within the Zabbix Agent application, thus impacting the integrity and availability of the application...

CVE-2024-22121 Zabbix Agent MSI Installer Allows Non-Admin User to Access Change Option via msiexec.exe

A non-admin user can change or remove important features within the Zabbix Agent application, thus impacting the integrity and availability of the application...

CVE-2024-22121

Technical details about CVE-2024-22121 are not publicly provided in the connected documents. Descriptions only state that a non-admin user can modify Zabbix Agent features. Monitor for updates from vendors and advisories.

CVE-2024-22121

A non-admin user can change or remove important features within the Zabbix Agent application, thus impacting the integrity and availability of the application...

PT-2024-10427 · Zabbix +3 · Zabbix +3

Name of the Vulnerable Software and Affected Versions: Zabbix affected versions not specified Description: The issue is related to incorrect permission storage in the Zabbix monitoring system. This allows an unauthorized user to access and view host count and other statistics through the System...

PT-2024-5538 · Zabbix +3 · Zabbix +3

Name of the Vulnerable Software and Affected Versions: Zabbix versions 6.4.0 through 6.4.15 Zabbix versions 7.0.0alpha1 through 7.0.0rc2 Description: The issue is related to the lack of default escaping for script parameters in the Monitoring Hosts section of Zabbix, allowing an administrator wit...

PT-2024-6098 · Zabbix +4 · Zabbix +4

Name of the Vulnerable Software and Affected Versions: Zabbix versions 5.0.0 through 7.0.0rc2 Description: The issue is related to the configuration of SMS notifications in Zabbix, where an AT command injection occurs due to the lack of validation of the Number field. This allows an attacker to...

PT-2024-6099 · Zabbix +4 · Zabbix +4

Name of the Vulnerable Software and Affected Versions: Zabbix affected versions not specified Description: The issue is related to the front-end audit log, which allows viewing of unprotected plaintext passwords. These passwords are displayed in plain text, potentially enabling a remote attacker ...

PT-2024-6100 · Zabbix +4 · Zabbix +4

Name of the Vulnerable Software and Affected Versions: Zabbix affected versions not specified Description: The issue is related to incorrect code generation control in the Zabbix monitoring system. It allows a remote attacker to execute arbitrary code. Setting SMS media allows configuring a GSM...