Memory pointer is in a property of the Ducktape object. This leads to multiple vulnerabilities related to direct memory access and manipulation.
CVSS Score
9.1
EPSS Score
0.007
Published
2023-10-12
A stored XSS has been found in the Zabbix web application in the Maps element if a URL field is set with spaces before URL.
CVSS Score
7.6
EPSS Score
0.007
Published
2023-10-12
Specially crafted string can cause a buffer overrun in the JSON parser library leading to a crash of the Zabbix Server or a Zabbix Proxy.
CVSS Score
4.7
EPSS Score
0.001
Published
2023-07-13
Duktape is an 3rd-party embeddable JavaScript engine, with a focus on portability and compact footprint. When adding too many values in valstack JavaScript will crash. This issue occurs due to bug in Duktape 2.6 which is an 3rd-party solution that we use.
CVSS Score
5.9
EPSS Score
0.001
Published
2023-07-13
JavaScript preprocessing, webhooks and global scripts can cause uncontrolled CPU, memory, and disk I/O utilization. Preprocessing/webhook/global script configuration and testing are only available to Administrative roles (Admin and Superadmin). Administrative privileges should be typically granted to users who need to perform tasks that require more control over the system. The security risk is limited because not all users have this level of access.
CVSS Score
5.9
EPSS Score
0.008
Published
2023-07-13
Page 3