783 matches found
CVE-2021-42093
An issue was discovered in Zammad before 4.1.1. An admin can execute code on the server via a crafted request that manipulates triggers...
Design/Logic Flaw
An issue was discovered in Zammad before 4.1.1. An admin can execute code on the server via a crafted request that manipulates triggers...
Command injection
An issue was discovered in Zammad before 4.1.1. Command Injection can occur via custom Packages...
Cross site scripting
An issue was discovered in Zammad before 4.1.1. Stored XSS may occur via an Article during addition of an attachment to a Ticket...
CVE-2021-42084
CVE-2021-42084 affects Zammad prior to 4.1.1. An attacker with valid agent credentials can send a series of crafted requests that triggers an endless loop, causing a denial of service. Connected sources consistently describe a denial-of-service impact for versions before 4.1.1. The initial docume...
CVE-2021-42084
An issue was discovered in Zammad before 4.1.1. An attacker with valid agent credentials may send a series of crafted requests that cause an endless loop and thus cause denial of service...
CVE-2021-42085
Zammad (web-based help desk) before version 4.1.1 has a stored XSS via the custom Avatar feature. The issue affects versions prior to 4.1.1; exploitation would involve injecting JavaScript through the avatar. Remediation indicated by sources is upgrade to 4.1.1 or later (exact patched version per...
CVE-2021-42085
An issue was discovered in Zammad before 4.1.1. There is stored XSS via a custom Avatar...
CVE-2021-42086
CVE-2021-42086 affects Zammad prior to 4.1.1. An Agent account can modify other account data via a crafted request and gain administrator privileges, leading to elevation of privilege. The vulnerability is described across multiple sources (NVD entry and CNVD/CNNVD/CVE records) as an account‑leve...
CVE-2021-42086
An issue was discovered in Zammad before 4.1.1. An Agent account can modify account data, and gain admin access, via a crafted request...
CVE-2021-42087
CVE-2021-42087 affects Zammad before 4.1.1, allowing an admin to discover the application secret via the API. Public descriptions in multiple sources corroborate that versions prior to 4.1.1 are vulnerable to secret disclosure and sensitive information exposure through the API. Remediation is to ...
CVE-2021-42087
An issue was discovered in Zammad before 4.1.1. An admin can discover the application secret via the API...
CVE-2021-42088
An issue was discovered in Zammad before 4.1.1. The Chat functionality allows XSS because clipboard data is mishandled...
CVE-2021-42088
Zammad vulnerability CVE-2021-42088 affects the chat feature in Zammad versions before 4.1.1. The root cause is mishandling of clipboard data, allowing cross-site scripting (XSS). This affects users of Zammad’s chat functionality, where clipboard content can be injected and executed in the browse...
CVE-2021-42089
Zammad before 4.1.1 is affected by CVE-2021-42089: the REST API discloses sensitive information, enabling information disclosure via the API. Exploitation details are not provided in the supplied documents beyond the REST API exposure and the affected version range (prior to 4.1.1). The issue has...
CVE-2021-42089
An issue was discovered in Zammad before 4.1.1. The REST API discloses sensitive information...
CVE-2021-42090
Zammad before 4.1.1 contains a remote code execution vulnerability due to mishandled deserialization in the Form functionality. The issue allows an attacker to execute arbitrary code on affected systems. Affected product/version: Zammad prior to 4.1.1 (open-source web-based help desk). Root cause...
CVE-2021-42090
An issue was discovered in Zammad before 4.1.1. The Form functionality allows remote code execution because deserialization is mishandled...
CVE-2021-42091
CVE-2021-42091 affects Zammad prior to 4.1.1, where server-side request forgery (SSRF) can occur through GitHub or GitLab integrations. The connected documents confirm the affected software is Zammad and the issue is tied to the GitHub/GitLab integration, with remediation implied by the version 4...