Malicious code in eslint-plugin-zammad (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-2332 Malicious code in eslint-plugin-zammad (npm)

--- -= Per source details. Do not edit below this line.=-...

CVE-2024-36078

In Zammad before 6.3.1, a Ruby gem bundled by Zammad is installed with world-writable file permissions. This allowed a local attacker on the server to modify the gem's files, injecting arbitrary code into Zammad processes which run with the environment and permissions of the Zammad user...

CVE-2024-36078

In Zammad before 6.3.1, a Ruby gem bundled by Zammad is installed with world-writable file permissions. This allowed a local attacker on the server to modify the gem's files, injecting arbitrary code into Zammad processes which run with the environment and permissions of the Zammad user...

CVE-2024-36078

In Zammad before 6.3.1, a Ruby gem bundled by Zammad is installed with world-writable file permissions. This allowed a local attacker on the server to modify the gem's files, injecting arbitrary code into Zammad processes which run with the environment and permissions of the Zammad user...

CVE-2024-36078

In Zammad before 6.3.1, a Ruby gem bundled by Zammad is installed with world-writable file permissions. This allowed a local attacker on the server to modify the gem's files, injecting arbitrary code into Zammad processes which run with the environment and permissions of the Zammad user...

CVE-2024-36078

In Zammad versions prior to 6.3.1 , a bundled Ruby gem is installed with world-writable file permissions . This misconfiguration allows a local attacker on the server to modify the gem's files and inject arbitrary code into Zammad processes, which execute with the environment and permissions of t...

Zammad 安全漏洞

Zammad is a suite of ticket management software from the German company Zammad. A security vulnerability exists in Zammad versions prior to 6.3.1, which originates from a vulnerability that allows a local attacker to modify the gem file to inject arbitrary code into a process...

PT-2024-26886 · Zammad · Zammad

Name of the Vulnerable Software and Affected Versions: Zammad versions prior to 6.3.1 Description: A Ruby gem bundled by Zammad is installed with world-writable file permissions, allowing a local attacker on the server to modify the gem's files and inject arbitrary code into Zammad processes. The...

CVE-2024-36078: Improper Control of Generation of Code

In Zammad before 6.3.1, a Ruby gem bundled by Zammad is installed with world-writable file permissions. This allowed a local attacker on the server to modify the gem's files, injecting arbitrary code into Zammad processes which run with the environment and permissions of the Zammad user...

CVE-2024-33666

An issue was discovered in Zammad before 6.3.0. Users with customer access to a ticket could have accessed time accounting details of this ticket via the API. This data should be available only to agents...

CVE-2024-33667

An issue was discovered in Zammad before 6.3.0. An authenticated agent could perform a remote Denial of Service attack by calling an endpoint that accepts a generic method name, which was not properly sanitized against an allowlist...

CVE-2024-33668

An issue was discovered in Zammad before 6.3.0. The Zammad Upload Cache uses insecure, partially guessable FormIDs to identify content. An attacker could try to brute force them to upload malicious content to article drafts they have no access to...

Zammad 安全漏洞

Zammad is a suite of ticket management software from the German company Zammad. A security vulnerability exists in Zammad versions prior to 6.3.0 that stems from the Zammad Upload Cache's use of an insecure, partially guessable FormID to identify content, which can be exploited by an attacker to...

Zammad 安全漏洞

Zammad is a suite of ticket management software from the German company Zammad. A security vulnerability exists in Zammad versions prior to 6.3.0, which originates from an authenticated agent that can perform a denial-of-service attack by invoking an endpoint that accepts a common method name...

Zammad 安全漏洞

Zammad is a suite of ticket management software from the German company Zammad. A security vulnerability exists in Zammad versions prior to 6.3.0, which stems from a user with customer access rights to a ticket being able to access the ticket's time statistic details via the API...

CVE-2024-33667: Missing Authorization

An issue was discovered in Zammad before 6.3.0. An authenticated agent could perform a remote Denial of Service attack by calling an endpoint that accepts a generic method name, which was not properly sanitized against an allowlist...

CVE-2024-33666

Zammad versions prior to 6.3.0 are susceptible to an improper access control vulnerability. Users with customer access to a ticket can bypass intended restrictions to access time accounting details via the API, which are restricted to agents . To remediate this, it is recommended to update to ver...

CVE-2024-33668

An issue in Zammad versions prior to 6.3.0 allows for an authorization bypass because the Zammad Upload Cache uses insecure, partially guessable FormIDs to identify content. An attacker could brute force these IDs to upload malicious content to article drafts they do not have access to. To resolv...

CVE-2024-33666

An issue was discovered in Zammad before 6.3.0. Users with customer access to a ticket could have accessed time accounting details of this ticket via the API. This data should be available only to agents...