Zammad 日志信息泄露漏洞

Zammad is a Web-based open source helpdesk/customer support system. Zammad suffers from an incorrect access control vulnerability. A remote attacker could exploit this vulnerability to obtain sensitive information through email connection configuration probes...

CVE-2021-35301: Undefined Security Weakness

Incorrect Access Control in Zammad 1.0.x up to 4.0.0 allows remote attackers to obtain sensitive information via the Ticket Article detail view...

CVE-2021-35302: Undefined Security Weakness

Incorrect Access Control for linked Tickets in Zammad 1.0.x up to 4.0.0 allows remote attackers to obtain sensitive information...

CVE-2021-35303: Improper Neutralization of Input During Web Page Generation

Cross Site Scripting XSS in Zammad 1.0.x up to 4.0.0 allows remote attackers to execute arbitrary web script or HTML via the User Avatar attribute...

CVE-2021-35299: Insertion of Sensitive Information into Log File

Incorrect Access Control in Zammad 1.0.x up to 4.0.0 allows attackers to obtain sensitive information via email connection configuration probing...

CVE-2021-35300: Improper Restriction of Rendered UI Layers or Frames

Text injection/Content Spoofing in 404 page in Zammad 1.0.x up to 4.0.0 could allow remote attackers to manipulate users into visiting the attackers' page...

Zammad 安全漏洞

Zammad is a Web-based open source helpdesk/customer support system. An incorrect access control vulnerability exists in Zammad. A remote attacker could exploit this vulnerability to obtain sensitive information via the Ticket Article details view...

CVE-2021-35298: Improper Neutralization of Input During Web Page Generation

Cross Site Scripting XSS in Zammad 1.0.x up to 4.0.0 allows remote attackers to execute arbitrary web script or HTML via multiple models that contain a 'note' field to store additional information...

Zammad 注入漏洞

Zammad is a Web-based open source helpdesk/customer support system. Zammad suffers from a text injection/content spoofing vulnerability. A remote attacker can exploit this vulnerability to trick a user into visiting the attacker's page...

Zammad 跨站脚本漏洞

Zammad is a Web-based open source helpdesk/customer support system. A cross-site scripting vulnerability exists in Zammad. The vulnerability can be exploited by a remote attacker to execute arbitrary web script or HTML via multiple models containing a "comment" field...

Zammad 跨站脚本漏洞

Zammad is a Web-based open source helpdesk/customer support system. A cross-site scripting vulnerability exists in Zammad. A remote attacker can exploit this vulnerability to execute arbitrary web script or HTML via the "user-avatar" attribute...

Zammad 安全漏洞

Zammad is a Web-based open source helpdesk/customer support system. Zammad suffers from a linked work order incorrect access control vulnerability. A remote attacker could exploit this vulnerability to obtain sensitive information...

Zammad Cross-Site Request Forgery Vulnerability (CNVD-2020-75514)

Zammad is a suite of ticket management software from the German company Zammad. A cross-site request forgery vulnerability exists in versions prior to Zammad 3.5.1, which stems from a lack of CSRF token checking in the Labeling and Linking REST API endpoints used for additions and deletions. No...

Zammad Access Control Error Vulnerability

Zammad is a Web-based open source helpdesk/customer support system. An access control error vulnerability exists in Zammad versions prior to 3.5.1. An attacker can exploit this vulnerability to bypass auditing and change Ticket Article data via REST API calls...

Zammad SSO Endpoint Authentication Bypass Vulnerability

Zammad is a Web-based open source helpdesk/customer support system. An SSO endpoint authentication bypass vulnerability exists in Zammad versions prior to 3.4.1. An attacker can exploit this vulnerability by creating a valid authentication session to perform any action in the name of another user...

Zammad Account Enumeration Vulnerability

Zammad is a Web-based open source helpdesk/customer support system. An account enumeration vulnerability exists in Zammad versions prior to 3.4.1. The vulnerability can be exploited to guess valid user e-mail addresses via the "Create User" feature...

Zammad Improper Access Control Vulnerability

Zammad is a Web-based open source helpdesk/customer support system. An improper access control vulnerability exists in Zammad versions prior to 3.4.1. An attacker could exploit the vulnerability to access work orders...

Zammad Information Disclosure Vulnerability (CNVD-2020-75059)

Zammad is a Web-based open source helpdesk/customer support system. An information disclosure vulnerability exists in Zammad versions prior to 3.4.1. The vulnerability can be exploited by an attacker to gain unauthorized access to a knowledge base draft via the global search function...

Zammad Access Control Bypass Vulnerability

Zammad is a Web-based open source helpdesk/customer support system. An access control bypass vulnerability exists in Zammad versions prior to 3.5.1. An Agent with Customer privileges in a group can exploit this vulnerability to bypass access control to internal Articles via the Ticket detail view...

Zammad Information Disclosure Vulnerability (CNVD-2020-75060)

Zammad is a Web-based open source helpdesk/customer support system. An information disclosure vulnerability exists in Zammad versions prior to 3.4.1. The vulnerability stems from the way Massenversand's implementation of the SMS configuration interface presents the results of test requests to the...