Spoofing

Text injection/Content Spoofing in 404 page in Zammad 1.0.x up to 4.0.0 could allow remote attackers to manipulate users into visiting the attackers' page...

Improper access control

Incorrect Access Control in Zammad 1.0.x up to 4.0.0 allows remote attackers to obtain sensitive information via the Ticket Article detail view...

CVE-2021-35300

Text injection/Content Spoofing in 404 page in Zammad 1.0.x up to 4.0.0 could allow remote attackers to manipulate users into visiting the attackers' page...

Cross site scripting

Cross Site Scripting XSS in Zammad 1.0.x up to 4.0.0 allows remote attackers to execute arbitrary web script or HTML via the User Avatar attribute...

CVE-2021-35303

Cross Site Scripting XSS in Zammad 1.0.x up to 4.0.0 allows remote attackers to execute arbitrary web script or HTML via the User Avatar attribute...

Improper access control

Incorrect Access Control in Zammad 1.0.x up to 4.0.0 allows attackers to obtain sensitive information via email connection configuration probing...

Cross site scripting

Cross Site Scripting XSS in Zammad 1.0.x up to 4.0.0 allows remote attackers to execute arbitrary web script or HTML via multiple models that contain a 'note' field to store additional information...

CVE-2021-35298

Cross Site Scripting XSS in Zammad 1.0.x up to 4.0.0 allows remote attackers to execute arbitrary web script or HTML via multiple models that contain a 'note' field to store additional information...

CVE-2021-35298

CVE-2021-35298 describes a cross-site scripting (XSS) vulnerability in Zammad versions 1.0.x up to 4.0.0. The issue allows remote attackers to execute arbitrary web script or HTML through multiple models that contain a 'note' field used to store additional information. The connected documents sub...

CVE-2021-35299

Incorrect Access Control in Zammad 1.0.x up to 4.0.0 allows attackers to obtain sensitive information via email connection configuration probing...

CVE-2021-35299

Zammad’s CVE-2021-35299 describes an Incorrect Access Control in Zammad 1.0.x up to 4.0.0 that allows a remote attacker to obtain sensitive information through email connection configuration probing. The affected component is the application’s access control around email configuration data; the r...

CVE-2021-35300

Text injection/Content Spoofing in 404 page in Zammad 1.0.x up to 4.0.0 could allow remote attackers to manipulate users into visiting the attackers' page...

CVE-2021-35300

Technical details (affected product, versions, root cause, and remediation) are not publicly provided in the supplied connected documents for CVE-2021-35300; monitor for updates.

CVE-2021-35301

CVE-2021-35301 affects Zammad 1.0.x up to 4.0.0 and is an incorrect access control vulnerability that allows remote attackers to obtain sensitive information via the Ticket Article detail view. Publicly cited sources reiterate the issue but do not publish specific technical details (e.g., vulnera...

CVE-2021-35301

Incorrect Access Control in Zammad 1.0.x up to 4.0.0 allows remote attackers to obtain sensitive information via the Ticket Article detail view...

CVE-2021-35302

CVE-2021-35302 affects Zammad (web-based helpdesk) with an incorrect access control in linked tickets, from Zammad 1.0.x up to 4.0.0. This vulnerability allows remote attackers to obtain sensitive information. No exploitation details or patch/version-specific fixes are provided in the connected d...

CVE-2021-35302

Incorrect Access Control for linked Tickets in Zammad 1.0.x up to 4.0.0 allows remote attackers to obtain sensitive information...

CVE-2021-35303

CVE-2021-35303 describes a cross-site scripting (XSS) flaw in Zammad, affecting versions 1.0.x through 4.0.0. The vulnerability allows a remote attacker to execute arbitrary web script or HTML by abusing the User Avatar attribute. The root cause is an input/output handling flaw in how the avatar ...

CVE-2021-35303

Cross Site Scripting XSS in Zammad 1.0.x up to 4.0.0 allows remote attackers to execute arbitrary web script or HTML via the User Avatar attribute...

Zammad 日志信息泄露漏洞

Zammad is a Web-based open source helpdesk/customer support system. Zammad suffers from an incorrect access control vulnerability. A remote attacker could exploit this vulnerability to obtain sensitive information through email connection configuration probes...