Cross site request forgery (csrf)

An authenticated user can create a link with reflected Javascript code inside it for services’ page and send it to other users. The payload can be executed only with a known CSRF token value of the victim, which is changed periodically and is difficult to predict. Malicious code has access to all...

CVE-2022-24918

An authenticated user can create a link with reflected Javascript code inside it for items’ page and send it to other users. The payload can be executed only with a known CSRF token value of the victim, which is changed periodically and is difficult to predict. Malicious code has access to all th...

UBUNTU-CVE-2022-24919

An authenticated user can create a link with reflected Javascript code inside it for graphs’ page and send it to other users. The payload can be executed only with a known CSRF token value of the victim, which is changed periodically and is difficult to predict. Malicious code has access to all t...

CVE-2022-24349

An authenticated user can create a link with reflected XSS payload for actions’ pages, and send it to other users. Malicious code has access to all the same objects as the rest of the web page and can make arbitrary modifications to the contents of the page being displayed to a victim. This attac...

UBUNTU-CVE-2022-24349

An authenticated user can create a link with reflected XSS payload for actions’ pages, and send it to other users. Malicious code has access to all the same objects as the rest of the web page and can make arbitrary modifications to the contents of the page being displayed to a victim. This attac...

CVE-2022-24919

An authenticated user can create a link with reflected Javascript code inside it for graphs’ page and send it to other users. The payload can be executed only with a known CSRF token value of the victim, which is changed periodically and is difficult to predict. Malicious code has access to all t...

CVE-2022-24919

CVE-2022-24919 is a reflected XSS/CSRF type vulnerability in Zabbix frontend that is exploited via a link crafted by an authenticated user and sent to other users. The attack URL contains reflected JavaScript on the graphs page; the payload runs in the victim’s context only if the victim’s CSRF t...

CVE-2022-24919 Reflected XSS in graph configuration window of Zabbix Frontend

An authenticated user can create a link with reflected Javascript code inside it for graphs’ page and send it to other users. The payload can be executed only with a known CSRF token value of the victim, which is changed periodically and is difficult to predict. Malicious code has access to all t...

CVE-2022-24918 Reflected XSS in item configuration window of Zabbix Frontend

An authenticated user can create a link with reflected Javascript code inside it for items’ page and send it to other users. The payload can be executed only with a known CSRF token value of the victim, which is changed periodically and is difficult to predict. Malicious code has access to all th...

CVE-2022-24918

An authenticated user can create a link with reflected Javascript code inside it for items’ page and send it to other users. The payload can be executed only with a known CSRF token value of the victim, which is changed periodically and is difficult to predict. Malicious code has access to all th...

CVE-2022-24918

CVE-2022-24918 is a Zabbix Frontend issue where an authenticated user can craft a link containing reflected JavaScript on the items page. The payload executes in a victim’s browser only if a valid CSRF token is present, enabling manipulation of the displayed page during social engineering. Vulner...

CVE-2022-24917

An authenticated user can create a link with reflected Javascript code inside it for services’ page and send it to other users. The payload can be executed only with a known CSRF token value of the victim, which is changed periodically and is difficult to predict. Malicious code has access to all...

CVE-2022-24917 Reflected XSS in service configuration window of Zabbix Frontend

An authenticated user can create a link with reflected Javascript code inside it for services’ page and send it to other users. The payload can be executed only with a known CSRF token value of the victim, which is changed periodically and is difficult to predict. Malicious code has access to all...

CVE-2022-24917

The CVE-2022-24917 describes an authenticated-user cross-site scripting issue in Zabbix frontend: an attacker can generate a link containing reflected Javascript on a services page and persuade other users to open it. The payload executes only if the victim’s CSRF token value (which is periodical...

CVE-2022-24349 Reflected XSS in action configuration window of Zabbix Frontend

An authenticated user can create a link with reflected XSS payload for actions’ pages, and send it to other users. Malicious code has access to all the same objects as the rest of the web page and can make arbitrary modifications to the contents of the page being displayed to a victim. This attac...

CVE-2022-24349

CVE-2022-24349: In Zabbix, an authenticated user can create a hosts group with a stored XSS payload that becomes available to other users. When users search groups (and similar vectors described in the Debian/SUSE advisories), the XSS payload can execute in the victim’s browser, enabling actions ...

CVE-2022-24349

An authenticated user can create a link with reflected XSS payload for actions’ pages, and send it to other users. Malicious code has access to all the same objects as the rest of the web page and can make arbitrary modifications to the contents of the page being displayed to a victim. This attac...

PT-2022-4509 · Zabbix +2 · Zabbix Frontend +3

Name of the Vulnerable Software and Affected Versions: Zabbix Frontend affected versions not specified Description: The issue allows an authenticated user to create a link with reflected Javascript code inside it for the graphs' page and send it to other users. The payload can be executed only wi...

Hackers Try to Target European Officials to Get Info on Ukrainian Refugees, Supplies

Details of a new nation-state sponsored phishing campaign have been uncovered setting its sights on European governmental entities in what's seen as an attempt to obtain intelligence on refugee and supply movement in the region. Enterprise security company Proofpoint, which detected the malicious...

The Art of Non-boring Cybersec Training–Podcast

Log4j, ransomware, cloud vulnerabilities, phishing: Cyber threats are manifold. They all pale, however, in comparison to the security black holes that walk around on two legs. Studies have shown that nearly all successful breaches stem from human error, be it failure to install security patches...