Zabbix Flaws Allow Monitored Hosts to Hijack Admin Dashboards

Zabbix released security patches for three vulnerabilities: two high-severity stored XSS issues in the Frontend (Host Navigator and Item History widgets) enabling execution of attacker-supplied JavaScript by administrators, and a medium-severity injection flaw in Agent 2's Oracle plugin that can redirect connections to attacker-controlled servers and leak Oracle credentials; fixed versions and mitigations are listed.