Show filters
8 Total Results
Displaying 1-8 of 8
Sort by:
Attacker Value
Unknown

CVE-2014-3005

Disclosure Date: February 01, 2018 (last updated November 26, 2024)
XML external entity (XXE) vulnerability in Zabbix 1.8.x before 1.8.21rc1, 2.0.x before 2.0.13rc1, 2.2.x before 2.2.5rc1, and 2.3.x before 2.3.2 allows remote attackers to read arbitrary files or potentially execute arbitrary code via a crafted DTD in an XML request.
0
0
Attacker Value
Unknown

CVE-2016-4338

Disclosure Date: January 23, 2017 (last updated November 25, 2024)
The mysql user parameter configuration script (userparameter_mysql.conf) in the agent in Zabbix before 2.0.18, 2.2.x before 2.2.13, and 3.0.x before 3.0.3, when used with a shell other than bash, allows context-dependent attackers to execute arbitrary code or SQL commands via the mysql.size parameter.
0
0
Attacker Value
Unknown

CVE-2014-1685

Disclosure Date: May 08, 2014 (last updated October 05, 2023)
The Frontend in Zabbix before 1.8.20rc2, 2.0.x before 2.0.11rc2, and 2.2.x before 2.2.2rc1 allows remote "Zabbix Admin" users to modify the media of arbitrary users via unspecified vectors.
0
0
Attacker Value
Unknown

CVE-2014-1682

Disclosure Date: May 08, 2014 (last updated October 05, 2023)
The API in Zabbix before 1.8.20rc1, 2.0.x before 2.0.11rc1, and 2.2.x before 2.2.2rc1 allows remote authenticated users to spoof arbitrary users via the user name in a user.login request.
0
0
Attacker Value
Unknown

CVE-2012-6086

Disclosure Date: January 29, 2014 (last updated October 05, 2023)
libs/zbxmedia/eztexting.c in Zabbix 1.8.x before 1.8.18rc1, 2.0.x before 2.0.8rc1, and 2.1.x before 2.1.2 does not properly set the CURLOPT_SSL_VERIFYHOST option for libcurl, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
0
0
Attacker Value
Unknown

CVE-2013-6824

Disclosure Date: December 19, 2013 (last updated October 05, 2023)
Zabbix before 1.8.19rc1, 2.0 before 2.0.10rc1, and 2.2 before 2.2.1rc1 allows remote Zabbix servers and proxies to execute arbitrary commands via a newline in a flexible user parameter.
0
0
Attacker Value
Unknown

CVE-2013-1364

Disclosure Date: December 14, 2013 (last updated October 05, 2023)
The user.login function in Zabbix before 1.8.16 and 2.x before 2.0.5rc1 allows remote attackers to override LDAP configuration via the cnf parameter.
0
0
Attacker Value
Unknown

CVE-2012-3435

Disclosure Date: August 15, 2012 (last updated October 04, 2023)
SQL injection vulnerability in frontends/php/popup_bitem.php in Zabbix 1.8.15rc1 and earlier, and 2.x before 2.0.2rc1, allows remote attackers to execute arbitrary SQL commands via the itemid parameter.
0
0