Vulnerabilities > Zabbix > Zabbix > 1.1.6
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2015-01-02 | CVE-2014-9450 | SQL Injection vulnerability in Zabbix Multiple SQL injection vulnerabilities in chart_bar.php in the frontend in Zabbix before 1.8.22, 2.0.x before 2.0.14, and 2.2.x before 2.2.8 allow remote attackers to execute arbitrary SQL commands via the (1) itemid or (2) periods parameter. | 7.5 |
| 2014-05-08 | CVE-2014-1685 | Security Bypass vulnerability in Zabbix The Frontend in Zabbix before 1.8.20rc2, 2.0.x before 2.0.11rc2, and 2.2.x before 2.2.2rc1 allows remote "Zabbix Admin" users to modify the media of arbitrary users via unspecified vectors. | 5.5 |
| 2014-05-08 | CVE-2014-1682 | Improper Authentication vulnerability in multiple products The API in Zabbix before 1.8.20rc1, 2.0.x before 2.0.11rc1, and 2.2.x before 2.2.2rc1 allows remote authenticated users to spoof arbitrary users via the user name in a user.login request. | 4.0 |
| 2013-12-19 | CVE-2013-6824 | Code Injection vulnerability in Zabbix Zabbix before 1.8.19rc1, 2.0 before 2.0.10rc1, and 2.2 before 2.2.1rc1 allows remote Zabbix servers and proxies to execute arbitrary commands via a newline in a flexible user parameter. | 7.5 |
| 2013-12-14 | CVE-2013-1364 | Improper Authentication vulnerability in Zabbix The user.login function in Zabbix before 1.8.16 and 2.x before 2.0.5rc1 allows remote attackers to override LDAP configuration via the cnf parameter. | 5.0 |
| 2012-08-15 | CVE-2012-3435 | SQL Injection vulnerability in Zabbix SQL injection vulnerability in frontends/php/popup_bitem.php in Zabbix 1.8.15rc1 and earlier, and 2.x before 2.0.2rc1, allows remote attackers to execute arbitrary SQL commands via the itemid parameter. | 7.5 |
| 2011-12-29 | CVE-2011-5027 | Cross-Site Scripting vulnerability in Zabbix Cross-site scripting (XSS) vulnerability in ZABBIX before 1.8.10 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to the profiler. | 4.3 |
| 2011-12-29 | CVE-2011-4615 | Cross-Site Scripting vulnerability in Zabbix Multiple cross-site scripting (XSS) vulnerabilities in Zabbix before 1.8.10 allow remote attackers to inject arbitrary web script or HTML via the gname parameter (aka host groups name) to (1) hostgroups.php and (2) usergrps.php, the update action to (3) hosts.php and (4) scripts.php, and (5) maintenance.php. | 4.3 |
| 2011-11-23 | CVE-2010-5049 | SQL Injection vulnerability in Zabbix SQL injection vulnerability in events.php in Zabbix 1.8.1 and earlier allows remote attackers to execute arbitrary SQL commands via the nav_time parameter. | 7.5 |
| 2011-08-19 | CVE-2011-3265 | Information Exposure vulnerability in Zabbix popup.php in Zabbix before 1.8.7 allows remote attackers to read the contents of arbitrary database tables via a modified srctbl parameter. | 5.0 |