Vulnerabilities > Zabbix > Medium

DATE CVE VULNERABILITY TITLE RISK
2024-02-09 CVE-2024-22119 Cross-site Scripting vulnerability in Zabbix
The cause of vulnerability is improper validation of form input field “Name” on Graph page in Items section.
network
low complexity
zabbix CWE-79
5.4
2023-10-12 CVE-2023-32721 Cross-site Scripting vulnerability in Zabbix
A stored XSS has been found in the Zabbix web application in the Maps element if a URL field is set with spaces before URL.
network
low complexity
zabbix CWE-79
5.4
2023-08-03 CVE-2023-30958 Cross-site Scripting vulnerability in Zabbix Frontend
A security defect was identified in Foundry Frontend that enabled users to potentially conduct DOM XSS attacks if Foundry's CSP were to be bypassed. This defect was resolved with the release of Foundry Frontend 6.225.0.
network
low complexity
zabbix CWE-79
6.1
2023-07-13 CVE-2023-29452 Cross-site Scripting vulnerability in Zabbix
Currently, geomap configuration (Administration -> General -> Geographical maps) allows using HTML in the field “Attribution text” when selected “Other” Tile provider.
network
low complexity
zabbix CWE-79
5.4
2023-07-13 CVE-2023-29454 Cross-site Scripting vulnerability in Zabbix Frontend
Stored or persistent cross-site scripting (XSS) is a type of XSS where the attacker first sends the payload to the web application, then the application saves the payload (e.g., in a database or server-side text files), and finally, the application unintentionally executes the payload for every victim visiting its web pages.
network
low complexity
zabbix CWE-79
5.4
2023-07-13 CVE-2023-29455 Cross-site Scripting vulnerability in Zabbix Frontend
Reflected XSS attacks, also known as non-persistent attacks, occur when a malicious script is reflected off a web application to the victim's browser.
network
low complexity
zabbix CWE-79
6.1
2023-07-13 CVE-2023-29456 Cross-site Scripting vulnerability in Zabbix Frontend
URL validation scheme receives input from a user and then parses it to identify its various components.
network
low complexity
zabbix CWE-79
5.4
2023-07-13 CVE-2023-29457 Cross-site Scripting vulnerability in Zabbix Frontend
Reflected XSS attacks, occur when a malicious script is reflected off a web application to the victim's browser.
network
low complexity
zabbix CWE-79
6.1
2023-07-13 CVE-2023-29449 Allocation of Resources Without Limits or Throttling vulnerability in Zabbix
JavaScript preprocessing, webhooks and global scripts can cause uncontrolled CPU, memory, and disk I/O utilization.
network
low complexity
zabbix CWE-770
4.9
2022-09-14 CVE-2022-40626 Cross-site Scripting vulnerability in multiple products
An unauthenticated user can create a link with reflected Javascript code inside the backurl parameter and send it to other authenticated users in order to create a fake account with predefined login, password and role in Zabbix Frontend.
network
low complexity
zabbix fedoraproject CWE-79
6.1