Vulnerabilities > Zabbix > Zabbix > 1.4.7
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2015-01-02 | CVE-2014-9450 | SQL Injection vulnerability in Zabbix Multiple SQL injection vulnerabilities in chart_bar.php in the frontend in Zabbix before 1.8.22, 2.0.x before 2.0.14, and 2.2.x before 2.2.8 allow remote attackers to execute arbitrary SQL commands via the (1) itemid or (2) periods parameter. | 7.5 |
| 2014-05-08 | CVE-2014-1685 | Security Bypass vulnerability in Zabbix The Frontend in Zabbix before 1.8.20rc2, 2.0.x before 2.0.11rc2, and 2.2.x before 2.2.2rc1 allows remote "Zabbix Admin" users to modify the media of arbitrary users via unspecified vectors. | 5.5 |
| 2014-05-08 | CVE-2014-1682 | Improper Authentication vulnerability in multiple products The API in Zabbix before 1.8.20rc1, 2.0.x before 2.0.11rc1, and 2.2.x before 2.2.2rc1 allows remote authenticated users to spoof arbitrary users via the user name in a user.login request. | 4.0 |
| 2013-12-19 | CVE-2013-6824 | Code Injection vulnerability in Zabbix Zabbix before 1.8.19rc1, 2.0 before 2.0.10rc1, and 2.2 before 2.2.1rc1 allows remote Zabbix servers and proxies to execute arbitrary commands via a newline in a flexible user parameter. | 7.5 |
| 2013-12-14 | CVE-2013-1364 | Improper Authentication vulnerability in Zabbix The user.login function in Zabbix before 1.8.16 and 2.x before 2.0.5rc1 allows remote attackers to override LDAP configuration via the cnf parameter. | 5.0 |
| 2011-11-23 | CVE-2010-5049 | SQL Injection vulnerability in Zabbix SQL injection vulnerability in events.php in Zabbix 1.8.1 and earlier allows remote attackers to execute arbitrary SQL commands via the nav_time parameter. | 7.5 |
| 2011-08-19 | CVE-2011-3265 | Information Exposure vulnerability in Zabbix popup.php in Zabbix before 1.8.7 allows remote attackers to read the contents of arbitrary database tables via a modified srctbl parameter. | 5.0 |
| 2011-08-19 | CVE-2011-3264 | Information Exposure vulnerability in Zabbix Zabbix before 1.8.6 allows remote attackers to obtain sensitive information via an invalid srcfld2 parameter to popup.php, which reveals the installation path in an error message. | 5.0 |
| 2011-08-19 | CVE-2011-3263 | Resource Management Errors vulnerability in Zabbix zabbix_agentd in Zabbix before 1.8.6 and 1.9.x before 1.9.4 allows context-dependent attackers to cause a denial of service (CPU consumption) by executing the vfs.file.cksum command for a special device, as demonstrated by the /dev/urandom device. | 5.0 |
| 2011-08-19 | CVE-2011-2904 | Cross-Site Scripting vulnerability in Zabbix Cross-site scripting (XSS) vulnerability in acknow.php in Zabbix before 1.8.6 allows remote attackers to inject arbitrary web script or HTML via the backurl parameter. | 4.3 |