CVE-2021-42092: Improper Neutralization of Input During Web Page Generation

An issue was discovered in Zammad before 4.1.1. Stored XSS may occur via an Article during addition of an attachment to a Ticket...

CVE-2021-42088: Improper Neutralization of Input During Web Page Generation

An issue was discovered in Zammad before 4.1.1. The Chat functionality allows XSS because clipboard data is mishandled...

CVE-2021-42094: Improper Neutralization of Special Elements used in a Command

An issue was discovered in Zammad before 4.1.1. Command Injection can occur via custom Packages...

CVE-2021-42085: Improper Neutralization of Input During Web Page Generation

An issue was discovered in Zammad before 4.1.1. There is stored XSS via a custom Avatar...

CVE-2021-42091: Server-Side Request Forgery (SSRF)

An issue was discovered in Zammad before 4.1.1. SSRF can occur via GitHub or GitLab integration...

PT-2021-23513

Name of the Vulnerable Software and Affected Versions Zammad versions prior to 4.1.1 Description An issue allows an Agent account to modify account data and gain admin access via a crafted request. Recommendations For versions prior to 4.1.1, update to version 4.1.1 or later to resolve the issue...

Zammad 信息泄露漏洞

Zammad is an open source web-based help desk/customer support system. versions prior to Zammad 4.1.1 are vulnerable to information disclosure. An attacker could exploit the vulnerability to obtain sensitive information via the REST API...

Zammad 安全漏洞

Zammad is an open source web-based help desk/customer support system. an elevation of privilege vulnerability exists in versions of Zammad prior to 4.1.1. An attacker could exploit this vulnerability by sending a specially crafted request to modify other agent accounts to be able to log in with...

Zammad 代码问题漏洞

Zammad is a web-based open source help desk/customer support system. server-side request forgery vulnerability exists in GitHub, GitLab integration in versions prior to Zammad 4.1.1. No detailed vulnerability details are currently available...

CVE-2021-42087: Undefined Security Weakness

An issue was discovered in Zammad before 4.1.1. An admin can discover the application secret via the API...

CVE-2021-42093: Undefined Security Weakness

An issue was discovered in Zammad before 4.1.1. An admin can execute code on the server via a crafted request that manipulates triggers...

CVE-2021-42089: Exposure of Sensitive Information to an Unauthorized Actor

An issue was discovered in Zammad before 4.1.1. The REST API discloses sensitive information...

CVE-2021-42090: Deserialization of Untrusted Data

An issue was discovered in Zammad before 4.1.1. The Form functionality allows remote code execution because deserialization is mishandled...

Zammad 安全漏洞

Zammad is an open source web-based help desk/customer support system. a denial of service vulnerability exists in versions of Zammad prior to 4.1.1. An attacker could exploit the vulnerability by sending a series of specially crafted requests to cause an infinite loop, which could lead to a denia...

PT-2021-23516

Name of the Vulnerable Software and Affected Versions Zammad versions prior to 4.1.1 Description An issue was discovered in the REST API, which discloses sensitive information. Recommendations For versions prior to 4.1.1, update to version 4.1.1 or later to resolve the issue...

Zammad 跨站脚本漏洞

Zammad is a Web-based open source help desk/customer support system. An attacker could upload an attachment to a "work order" via an "article", which could be exploited to inject malicious JavaScript code...

Zammad 跨站脚本漏洞

Zammad is a Web-based open source help desk/customer support system. versions prior to Zammad 4.1.1 are vulnerable to a stored cross-site scripting vulnerability. An attacker could exploit the vulnerability to inject malicious JavaScript code via a custom avatar...

Zammad 安全漏洞

Zammad is a Web-based open source help desk/customer support system. remote code execution vulnerability exists in versions of Zammad prior to 4.1.1. An attacker could exploit the vulnerability by sending a specially crafted request to Zammad to execute code on the server...

CVE-2021-42086: Undefined Security Weakness

An issue was discovered in Zammad before 4.1.1. An Agent account can modify account data, and gain admin access, via a crafted request...

Zammad Incorrect Access Control Vulnerability

Zammad is a Web-based open source helpdesk/customer support system. Zammad suffers from a linked work order incorrect access control vulnerability. A remote attacker could exploit this vulnerability to obtain sensitive information...