Host and event action script regex validation can be bypassed in certain situations, leading to potential command injection

Host and event action script input is validated with a regex (set by the administrator), but the validation runs in multiline mode. If ^ and $ anchors are used in user input validation, an injected newline lets authenticated users bypass the check and inject shell commands.

N/A

OS命令中使用的特殊元素转义处理不恰当(OS命令注入)

Zabbix 安全漏洞

Zabbix是Zabbix公司的一套开源的监控系统。该系统支持网络监控、服务器监控、云监控和应用监控等。 Zabbix存在安全漏洞，该漏洞源于多行模式下正则表达式验证不当，可能导致经过身份验证的用户绕过检查并注入shell命令。

N/A

N/A