Zammad cross-site scripting vulnerability (CNVD-2021-50125)

Zammad is a Web-based open source helpdesk/customer support system. A cross-site scripting vulnerability exists in Zammad. A remote attacker can exploit this vulnerability to execute arbitrary web script or HTML via the "user-avatar" attribute...

Zammad Incorrect Access Control Vulnerability (CNVD-2021-48886)

Zammad is a Web-based open source helpdesk/customer support system. Zammad suffers from an incorrect access control vulnerability. A remote attacker could exploit this vulnerability to obtain sensitive information through email connection configuration probes...

Zammad Incorrect Access Control Vulnerability (CNVD-2021-50123)

Zammad is a Web-based open source helpdesk/customer support system. An incorrect access control vulnerability exists in Zammad. A remote attacker could exploit this vulnerability to obtain sensitive information via the Ticket Article details view...

CVE-2021-35301

Incorrect Access Control in Zammad 1.0.x up to 4.0.0 allows remote attackers to obtain sensitive information via the Ticket Article detail view...

CVE-2021-35303

Cross Site Scripting XSS in Zammad 1.0.x up to 4.0.0 allows remote attackers to execute arbitrary web script or HTML via the User Avatar attribute...

CVE-2021-35301

Incorrect Access Control in Zammad 1.0.x up to 4.0.0 allows remote attackers to obtain sensitive information via the Ticket Article detail view...

CVE-2021-35302

Incorrect Access Control for linked Tickets in Zammad 1.0.x up to 4.0.0 allows remote attackers to obtain sensitive information...

CVE-2021-35302

Incorrect Access Control for linked Tickets in Zammad 1.0.x up to 4.0.0 allows remote attackers to obtain sensitive information...

CVE-2021-35303

Cross Site Scripting XSS in Zammad 1.0.x up to 4.0.0 allows remote attackers to execute arbitrary web script or HTML via the User Avatar attribute...

CVE-2021-35300

Text injection/Content Spoofing in 404 page in Zammad 1.0.x up to 4.0.0 could allow remote attackers to manipulate users into visiting the attackers' page...

CVE-2021-35298

Cross Site Scripting XSS in Zammad 1.0.x up to 4.0.0 allows remote attackers to execute arbitrary web script or HTML via multiple models that contain a 'note' field to store additional information...

CVE-2021-35299

Incorrect Access Control in Zammad 1.0.x up to 4.0.0 allows attackers to obtain sensitive information via email connection configuration probing...

CVE-2021-35298

Cross Site Scripting XSS in Zammad 1.0.x up to 4.0.0 allows remote attackers to execute arbitrary web script or HTML via multiple models that contain a 'note' field to store additional information...

CVE-2021-35299

Incorrect Access Control in Zammad 1.0.x up to 4.0.0 allows attackers to obtain sensitive information via email connection configuration probing...

CVE-2021-35299

Incorrect Access Control in Zammad 1.0.x up to 4.0.0 allows attackers to obtain sensitive information via email connection configuration probing...

Improper access control

Incorrect Access Control for linked Tickets in Zammad 1.0.x up to 4.0.0 allows remote attackers to obtain sensitive information...

CVE-2021-35298

Cross Site Scripting XSS in Zammad 1.0.x up to 4.0.0 allows remote attackers to execute arbitrary web script or HTML via multiple models that contain a 'note' field to store additional information...

Spoofing

Text injection/Content Spoofing in 404 page in Zammad 1.0.x up to 4.0.0 could allow remote attackers to manipulate users into visiting the attackers' page...

CVE-2021-35300

Text injection/Content Spoofing in 404 page in Zammad 1.0.x up to 4.0.0 could allow remote attackers to manipulate users into visiting the attackers' page...

CVE-2021-35301

Incorrect Access Control in Zammad 1.0.x up to 4.0.0 allows remote attackers to obtain sensitive information via the Ticket Article detail view...