Vulnerabilities > Zabbix > Medium
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2024-02-09 | CVE-2024-22119 | Cross-site Scripting vulnerability in Zabbix The cause of vulnerability is improper validation of form input field “Name” on Graph page in Items section. | 5.4 |
| 2023-10-12 | CVE-2023-32721 | Cross-site Scripting vulnerability in Zabbix A stored XSS has been found in the Zabbix web application in the Maps element if a URL field is set with spaces before URL. | 5.4 |
| 2023-08-03 | CVE-2023-30958 | Cross-site Scripting vulnerability in Zabbix Frontend A security defect was identified in Foundry Frontend that enabled users to potentially conduct DOM XSS attacks if Foundry's CSP were to be bypassed. This defect was resolved with the release of Foundry Frontend 6.225.0. | 6.1 |
| 2023-07-13 | CVE-2023-29452 | Cross-site Scripting vulnerability in Zabbix Currently, geomap configuration (Administration -> General -> Geographical maps) allows using HTML in the field “Attribution text” when selected “Other” Tile provider. | 5.4 |
| 2023-07-13 | CVE-2023-29454 | Cross-site Scripting vulnerability in Zabbix Frontend Stored or persistent cross-site scripting (XSS) is a type of XSS where the attacker first sends the payload to the web application, then the application saves the payload (e.g., in a database or server-side text files), and finally, the application unintentionally executes the payload for every victim visiting its web pages. | 5.4 |
| 2023-07-13 | CVE-2023-29455 | Cross-site Scripting vulnerability in Zabbix Frontend Reflected XSS attacks, also known as non-persistent attacks, occur when a malicious script is reflected off a web application to the victim's browser. | 6.1 |
| 2023-07-13 | CVE-2023-29456 | Cross-site Scripting vulnerability in Zabbix Frontend URL validation scheme receives input from a user and then parses it to identify its various components. | 5.4 |
| 2023-07-13 | CVE-2023-29457 | Cross-site Scripting vulnerability in Zabbix Frontend Reflected XSS attacks, occur when a malicious script is reflected off a web application to the victim's browser. | 6.1 |
| 2023-07-13 | CVE-2023-29449 | Allocation of Resources Without Limits or Throttling vulnerability in Zabbix JavaScript preprocessing, webhooks and global scripts can cause uncontrolled CPU, memory, and disk I/O utilization. | 4.9 |
| 2022-12-15 | CVE-2022-46768 | Improper Input Validation vulnerability in Zabbix web Service Report Generation and Zabbix-Agent2 Arbitrary file read vulnerability exists in Zabbix Web Service Report Generation, which listens on the port 10053. | 5.9 |