CVE-2023-50455

An issue was discovered in Zammad before 6.2.0. Due to lack of rate limiting in the "email address verification" feature, an attacker could send many requests for a known address to cause Denial Of Service generation of many emails, which would also spam the victim...

CVE-2023-50453

Summary: CVE-2023-50453 affects Zammad prior to version 6.2.0. The login screen uses the public endpoint /api/v1/signshow, which returns internal configuration data of user object attributes (e.g., selectable values) that should not be visible publicly. What’s affected: Zammad before 6.2.0; the v...

CVE-2023-50457

An issue was discovered in Zammad before 6.2.0. When listing tickets linked to a knowledge base answer, or knowledge base answers of a ticket, a user could see entries for which they lack permissions...

CVE-2023-50454

An issue was discovered in Zammad before 6.2.0. In several subsystems, SSL/TLS was used to establish connections to external services without proper validation of hostname and certificate authority. This is exploitable by man-in-the-middle attackers...

CVE-2023-50456

An issue was discovered in Zammad before 6.2.0. An attacker can trigger phishing links in generated notification emails via a crafted first or last name...

CVE-2023-50455

An issue was discovered in Zammad before 6.2.0. Due to lack of rate limiting in the "email address verification" feature, an attacker could send many requests for a known address to cause Denial Of Service generation of many emails, which would also spam the victim...

PT-2023-31557 · Zammad · Zammad

Name of the Vulnerable Software and Affected Versions: Zammad versions prior to 6.2.0 Description: An issue was discovered in Zammad where it uses the public endpoint "/api/v1/signshow" for its login screen. This endpoint returns internal configuration data of user object attributes, such as...

CVE-2023-50457

CVE-2023-50457 affects Zammad

Zammad 安全漏洞

Zammad is a suite of ticket management software from the German company Zammad. An access control error vulnerability exists in Zammad, which stems from a lack of rate limiting in the email address verification function, and can be exploited by an attacker to potentially send many requests to a...

CVE-2023-50454

An issue was discovered in Zammad before 6.2.0. In several subsystems, SSL/TLS was used to establish connections to external services without proper validation of hostname and certificate authority. This is exploitable by man-in-the-middle attackers...

CVE-2023-50453

An issue was discovered in Zammad before 6.2.0. It uses the public endpoint /api/v1/signshow for its login screen. This endpoint returns internal configuration data of user object attributes, such as selectable values, which should not be visible to the public...

CVE-2023-50455

Zammad before 6.2.0 is affected by a rate-limiting vulnerability in the email address verification feature. The lack of rate limiting allows an attacker to issue many requests for a known address, leading to Denial of Service via generation of a large number of emails (which could spam the recipi...

CVE-2023-50456

An issue was discovered in Zammad before 6.2.0. An attacker can trigger phishing links in generated notification emails via a crafted first or last name...

PT-2023-31559 · Zammad · Zammad

Name of the Vulnerable Software and Affected Versions: Zammad versions prior to 6.2.0 Description: An issue was discovered due to a lack of rate limiting in the "email address verification" feature. This allows an attacker to send many requests for a known address, causing Denial Of Service by...

CVE-2023-50456

An issue in Zammad prior to version 6.2.0 allows an attacker to trigger phishing links in generated notification emails by supplying crafted first or last names. Affected software is the Zammad ticketing system (pre-6.2.0). The underlying flaw is exploited via notification email content, enabling...

CVE-2023-50454

Summary: CVE-2023-50454 affects Zammad prior to 6.2.0. In several subsystems, SSL/TLS connections to external services are established without proper validation of hostname and certificate authority, enabling MITM attacks. The issue is documented across multiple feeds (including Red Hat, CNVD, NV...

Zammad Security Vulnerability

Zammad is a suite of ticket management software from the German company Zammad. A security vulnerability exists in versions of Zammad prior to 6.2.0 that stems from the fact that when listing a ticket with a knowledge base answer or a link to a knowledge base answer for a ticket, users may see...

CVE-2023-50457

An issue was discovered in Zammad before 6.2.0. When listing tickets linked to a knowledge base answer, or knowledge base answers of a ticket, a user could see entries for which they lack permissions...

CVE-2023-50453

An issue was discovered in Zammad before 6.2.0. It uses the public endpoint /api/v1/signshow for its login screen. This endpoint returns internal configuration data of user object attributes, such as selectable values, which should not be visible to the public...

CVE-2023-50455

An issue was discovered in Zammad before 6.2.0. Due to lack of rate limiting in the "email address verification" feature, an attacker could send many requests for a known address to cause Denial Of Service generation of many emails, which would also spam the victim...