1268 matches found
PT-2021-23555
Name of the Vulnerable Software and Affected Versions Zammad versions prior to 5.0.1 Description An issue was discovered in Zammad where there is improper enforcement of the privilege requirement for viewing a list of tickets that shows title, state, etc. This issue can occur in certain cases...
CVE-2021-42137: Incorrect Authorization
An issue was discovered in Zammad before 5.0.1. In some cases, there is improper enforcement of the privilege requirement for viewing a list of tickets that shows title, state, etc...
Zammad Cross-Site Scripting Vulnerability (CNVD-2021-81950)
Zammad is a Web-based open source help desk/customer support system. versions prior to Zammad 4.1.1 are vulnerable to a stored cross-site scripting vulnerability. An attacker could exploit the vulnerability to inject malicious JavaScript code via a custom avatar...
Zammad Denial of Service Vulnerability (CNVD-2021-81949)
Zammad is an open source web-based help desk/customer support system. a denial of service vulnerability exists in versions of Zammad prior to 4.1.1. An attacker could exploit the vulnerability by sending a series of specially crafted requests to cause an infinite loop, which could lead to a denia...
Zammad Command Injection Vulnerability
Zammad is a web-based open source help desk/customer support system. a command injection vulnerability exists in versions of Zammad prior to 4.1.1. An attacker could exploit the vulnerability to inject commands via custom packages...
Zammad Cross-Site Scripting Vulnerability (CNVD-2021-81956)
Zammad is a Web-based open source help desk/customer support system. An attacker could upload an attachment to a "work order" via an "article", which could be exploited to inject malicious JavaScript code...
Zammad Remote Code Execution Vulnerability
Zammad is a Web-based open source help desk/customer support system. remote code execution vulnerability exists in versions of Zammad prior to 4.1.1. An attacker could exploit the vulnerability by sending a specially crafted request to Zammad to execute code on the server...
Zammad server-side request forgery vulnerability
Zammad is a web-based open source help desk/customer support system. server-side request forgery vulnerability exists in GitHub, GitLab integration in versions prior to Zammad 4.1.1. No detailed vulnerability details are currently available...
Zammad Information Disclosure Vulnerability (CNVD-2021-81953)
Zammad is an open source web-based help desk/customer support system. versions prior to Zammad 4.1.1 are vulnerable to information disclosure. An attacker could exploit the vulnerability to obtain sensitive information via the REST API...
Zammad Cross-Site Scripting Vulnerability (CNVD-2021-81952)
Zammad is an open source web-based help desk/customer support system. a cross-site scripting vulnerability exists in the chat feature in versions of Zammad prior to 4.1.1. The vulnerability stems from improper handling of clipboard data. An attacker could exploit the vulnerability to execute...
Zammad Elevation of Privilege Vulnerability
Zammad is an open source web-based help desk/customer support system. an elevation of privilege vulnerability exists in versions of Zammad prior to 4.1.1. An attacker could exploit this vulnerability by sending a specially crafted request to modify other agent accounts to be able to log in with...
Zammad Remote Code Execution Vulnerability (CNVD-2021-81954)
Zammad is an open source web-based help desk/customer support system. a remote code execution vulnerability exists in the Form functionality of Zammad versions prior to 4.1.1. The vulnerability stems from improper handling of deserialization. An attacker could exploit the vulnerability to execute...
CVE-2021-42084
An issue was discovered in Zammad before 4.1.1. An attacker with valid agent credentials may send a series of crafted requests that cause an endless loop and thus cause denial of service...
CVE-2021-42085
An issue was discovered in Zammad before 4.1.1. There is stored XSS via a custom Avatar...
CVE-2021-42087
An issue was discovered in Zammad before 4.1.1. An admin can discover the application secret via the API...
CVE-2021-42088
An issue was discovered in Zammad before 4.1.1. The Chat functionality allows XSS because clipboard data is mishandled...
CVE-2021-42089
An issue was discovered in Zammad before 4.1.1. The REST API discloses sensitive information...
CVE-2021-42091
An issue was discovered in Zammad before 4.1.1. SSRF can occur via GitHub or GitLab integration...
