https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 08 Oct 2026 08:10:26 +0000 https://cve.radiocsirt.org/vuln/bdu:2023-01681 bdu:2023-01681 https://cve.radiocsirt.org/vuln/bdu:2023-01681 https://cve.radiocsirt.org/vuln/euvd-2026-25741 EUVD-2026-25741 https://cve.radiocsirt.org/vuln/euvd-2026-25741 https://cve.radiocsirt.org/vuln/fkie_cve-2021-27927 <p>In Zabbix from 4.0.x before 4.0.28rc1, 5.0.0alpha1 before 5.0.10rc1, 5.2.x before 5.2.6rc1, and 5.4.0alpha1 before 5.4.0beta2, the CControllerAuthenticationUpdate controller lacks a CSRF protection mechanism. The code inside this controller calls diableSIDValidation inside the init() method. An attacker doesn&#39;t have to know Zabbix user login credentials, but has to know the correct Zabbix URL and contact information of an existing user with sufficient privileges.</p> <p>In Zabbix from 4.0.x before 4.0.28rc1, 5.0.0alpha1 before 5.0.10rc1, 5.2.x before 5.2.6rc1, and 5.4.0alpha1 before 5.4.0beta2, the CControllerAuthenticationUpdate controller lacks a CSRF protection mechanism. The code inside this controller calls diableSIDValidation inside the init() method. An attacker doesn&#39;t have to know Zabbix user login credentials, but has to know the correct Zabbix URL and contact information of an existing user with sufficient privileges.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2021-27927 https://cve.radiocsirt.org/vuln/ghsa-3mh6-r7m6-r42x <p>In Zabbix before 4.0.28rc1, 5.x before 5.0.8rc1, 5.1.x and 5.2.x before 5.2.4rc1, and 5.3.x and 5.4.x before 5.4.0alpha1, the CControllerAuthenticationUpdate controller lacks a CSRF protection mechanism. The code inside this controller calls diableSIDValidation inside the init() method.</p> <p>In Zabbix before 4.0.28rc1, 5.x before 5.0.8rc1, 5.1.x and 5.2.x before 5.2.4rc1, and 5.3.x and 5.4.x before 5.4.0alpha1, the CControllerAuthenticationUpdate controller lacks a CSRF protection mechanism. The code inside this controller calls diableSIDValidation inside the init() method.</p> https://cve.radiocsirt.org/vuln/ghsa-3mh6-r7m6-r42x https://cve.radiocsirt.org/vuln/gsd-2021-27927 gsd-2021-27927 https://cve.radiocsirt.org/vuln/gsd-2021-27927 https://cve.radiocsirt.org/vuln/opensuse-su-2022:0036-1 <p>Security update for zabbix</p> <p>Security update for zabbix</p> https://cve.radiocsirt.org/vuln/opensuse-su-2022:0036-1 https://cve.radiocsirt.org/vuln/suse-su-2021:0990-1 <p>Security update for zabbix</p> <p>Security update for zabbix</p> https://cve.radiocsirt.org/vuln/suse-su-2021:0990-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2021-27927 <p><strong>Affected:</strong> Ubuntu:Pro:20.04:LTS: zabbix</p> <p>In Zabbix from 4.0.x before 4.0.28rc1, 5.0.0alpha1 before 5.0.10rc1, 5.2.x before 5.2.6rc1, and 5.4.0alpha1 before 5.4.0beta2, the CControllerAuthenticationUpdate controller lacks a CSRF protection mechanism. The code inside this controller calls diableSIDValidation inside the init() method. An attacker doesn&#39;t have to know Zabbix user login credentials, but has to know the correct Zabbix URL and contact information of an existing user with sufficient privileges.</p> <p><strong>Affected:</strong> Ubuntu:Pro:20.04:LTS: zabbix</p> <p>In Zabbix from 4.0.x before 4.0.28rc1, 5.0.0alpha1 before 5.0.10rc1, 5.2.x before 5.2.6rc1, and 5.4.0alpha1 before 5.4.0beta2, the CControllerAuthenticationUpdate controller lacks a CSRF protection mechanism. The code inside this controller calls diableSIDValidation inside the init() method. An attacker doesn&#39;t have to know Zabbix user login credentials, but has to know the correct Zabbix URL and contact information of an existing user with sufficient privileges.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2021-27927