CVE-2021-42092

An issue was discovered in Zammad before 4.1.1. Stored XSS may occur via an Article during addition of an attachment to a Ticket...

CVE-2021-42092

The CVE-2021-42092 issue affects Zammad prior to 4.1.1, where a Stored XSS can be triggered when attaching a file to a Ticket via an Article. The root cause is input validation/escaping during attachment handling that allows injected JavaScript to be stored and later executed in the context of th...

CVE-2021-42093

Zammad (before 4.1.1) is affected by CVE-2021-42093. An administrative-triggered, crafted request can manipulate triggers to execute code on the server, enabling remote code execution. The vulnerability is documented in multiple sources (e.g., CNVD/CNNVD and NVD) with the remediation being upgrad...

CVE-2021-42093

An issue was discovered in Zammad before 4.1.1. An admin can execute code on the server via a crafted request that manipulates triggers...

CVE-2021-42094

CVE-2021-42094 affects Zammad before 4.1.1. A command injection can occur via custom Packages. The connected documents confirm the affected software (Zammad) and the vulnerable condition (pre-4.1.1) but do not provide detailed root-cause internals. Impact is described as command execution with hi...

CVE-2021-42094

An issue was discovered in Zammad before 4.1.1. Command Injection can occur via custom Packages...

Zammad 安全漏洞

Zammad is a ticket management software from Zammad, a German company. versions prior to Zammad 4.1.1 have security vulnerabilities that allow attackers to discover application secrets and obtain sensitive information through the API...

Zammad 跨站脚本漏洞

Zammad is an open source web-based help desk/customer support system. a cross-site scripting vulnerability exists in the chat feature in versions of Zammad prior to 4.1.1. The vulnerability stems from improper handling of clipboard data. An attacker could exploit the vulnerability to execute...

Zammad 代码问题漏洞

Zammad is an open source web-based help desk/customer support system. a remote code execution vulnerability exists in the Form functionality of Zammad versions prior to 4.1.1. The vulnerability stems from improper handling of deserialization. An attacker could exploit the vulnerability to execute...

Zammad 命令注入漏洞

Zammad is a web-based open source help desk/customer support system. a command injection vulnerability exists in versions of Zammad prior to 4.1.1. An attacker could exploit the vulnerability to inject commands via custom packages...

Zammad 安全漏洞

Zammad is an open source web-based help desk/customer support system. an elevation of privilege vulnerability exists in versions of Zammad prior to 4.1.1. An attacker could exploit this vulnerability by sending a specially crafted request to modify other agent accounts to be able to log in with...

Zammad 信息泄露漏洞

Zammad is an open source web-based help desk/customer support system. versions prior to Zammad 4.1.1 are vulnerable to information disclosure. An attacker could exploit the vulnerability to obtain sensitive information via the REST API...

Zammad 代码问题漏洞

Zammad is a web-based open source help desk/customer support system. server-side request forgery vulnerability exists in GitHub, GitLab integration in versions prior to Zammad 4.1.1. No detailed vulnerability details are currently available...

Zammad 跨站脚本漏洞

Zammad is a Web-based open source help desk/customer support system. An attacker could upload an attachment to a "work order" via an "article", which could be exploited to inject malicious JavaScript code...

Zammad 跨站脚本漏洞

Zammad is a Web-based open source help desk/customer support system. versions prior to Zammad 4.1.1 are vulnerable to a stored cross-site scripting vulnerability. An attacker could exploit the vulnerability to inject malicious JavaScript code via a custom avatar...

Zammad 安全漏洞

Zammad is a Web-based open source help desk/customer support system. remote code execution vulnerability exists in versions of Zammad prior to 4.1.1. An attacker could exploit the vulnerability by sending a specially crafted request to Zammad to execute code on the server...

Zammad 安全漏洞

Zammad is an open source web-based help desk/customer support system. a denial of service vulnerability exists in versions of Zammad prior to 4.1.1. An attacker could exploit the vulnerability by sending a series of specially crafted requests to cause an infinite loop, which could lead to a denia...

Zammad Incorrect Access Control Vulnerability

Zammad is a Web-based open source helpdesk/customer support system. Zammad suffers from a linked work order incorrect access control vulnerability. A remote attacker could exploit this vulnerability to obtain sensitive information...

Zammad Text Injection/Content Spoofing Vulnerability

Zammad is a Web-based open source helpdesk/customer support system. Zammad suffers from a text injection/content spoofing vulnerability. A remote attacker can exploit this vulnerability to trick a user into visiting the attacker's page...

Zammad cross-site scripting vulnerability (CNVD-2021-48885)

Zammad is a Web-based open source helpdesk/customer support system. A cross-site scripting vulnerability exists in Zammad. The vulnerability can be exploited by a remote attacker to execute arbitrary web script or HTML via multiple models containing a "comment" field...