210 matches found
GHSA-38C7-23HJ-2WGQ n8n has Webhook Forgery on Zendesk Trigger Node
Impact An attacker who knows the webhook URL of a workflow using the ZendeskTrigger node could send unsigned POST requests and trigger the workflow with arbitrary data. The node does not verify the HMAC-SHA256 signature that Zendesk attaches to every outbound webhook, allowing any party to inject...
CVE-2019-25263
Zendesk SweetHawk Survey 1.6 contains a persistent cross-site scripting vulnerability that allows attackers to inject malicious scripts through support ticket submissions. Attackers can insert XSS payloads like script tags into ticket text that automatically execute when survey pages are loaded b...
CVE-2019-25263 Zendesk App SweetHawk Survey 1.6 - Persistent Cross-Site Scripting
Zendesk SweetHawk Survey 1.6 contains a persistent cross-site scripting vulnerability that allows attackers to inject malicious scripts through support ticket submissions. Attackers can insert XSS payloads like script tags into ticket text that automatically execute when survey pages are loaded b...
CVE-2019-25263
Zendesk SweetHawk Survey 1.6 is affected by a persistent cross-site scripting (XSS) vulnerability. The issue allows attackers to inject malicious scripts through support ticket submissions, with payloads such as script tags that execute when survey pages are loaded by other users. Root cause: ina...
EUVD-2019-19382
Zendesk SweetHawk Survey 1.6 contains a persistent cross-site scripting vulnerability that allows attackers to inject malicious scripts through support ticket submissions. Attackers can insert XSS payloads like script tags into ticket text that automatically execute when survey pages are loaded b...
CVE-2019-25263 Zendesk App SweetHawk Survey 1.6 - Persistent Cross-Site Scripting
Zendesk SweetHawk Survey 1.6 contains a persistent cross-site scripting vulnerability that allows attackers to inject malicious scripts through support ticket submissions. Attackers can insert XSS payloads like script tags into ticket text that automatically execute when survey pages are loaded b...
CVE-2019-25263
Zendesk SweetHawk Survey 1.6 contains a persistent cross-site scripting vulnerability that allows attackers to inject malicious scripts through support ticket submissions. Attackers can insert XSS payloads like script tags into ticket text that automatically execute when survey pages are loaded b...
Zendesk SweetHawk Survey 跨站脚本漏洞
Zendesk SweetHawk Survey is a satisfaction survey plugin developed by Zendesk, a Japanese company. Version 1.6 of Zendesk SweetHawk Survey contains a cross-site scripting vulnerability. This vulnerability stems from a storage-based cross-site scripting issue in the ticket submission feature, whic...
PT-2026-5799
Zendesk SweetHawk Survey 1.6 contains a persistent cross-site scripting vulnerability that allows attackers to inject malicious scripts through support ticket submissions. Attackers can insert XSS payloads like script tags into ticket text that automatically execute when survey pages are loaded b...
A week in security (January 19 – January 25)
Last week on Malwarebytes Labs: Spammers abuse Zendesk to flood inboxes with legitimate-looking emails, but why? Fake LastPass maintenance emails target users Under Armour ransomware breach: data of 72 million customers appears on the dark web Can you use too many LOLBins to drop some RATs?...
Spammers abuse Zendesk to flood inboxes with legitimate-looking emails, but why?
Short answer: we have no idea. People are actively complaining that their mailboxes and queues are being flooded by emails coming from the Zendesk instances of trusted companies like Discord, Riot Games, Dropbox, and many others. Zendesk is a customer service and support software platform that...
CVE-2017-18542
The zendesk-help-center plugin before 1.0.5 for WordPress has multiple XSS issues...
Gainsight Expands Impacted Customer List Following Salesforce Security Alert
Gainsight has disclosed that the recent suspicious activity targeting its applications has affected more customers than previously thought. The company said Salesforce initially provided a list of 3 impacted customers and that it has "expanded to a larger list" as of November 21, 2025. It did not...
MAL-2025-191300 Malicious code in @posthog/zendesk-plugin (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0ee22feb7805e50708b86abe78fb463cafe5f1a3408f41297a18deafa6e110fb The package @posthog/zendesk-plugin was found to contain malicious code. Source: google-open-source-security...
EUVD-2025-199440
Malicious code in @posthog/zendesk-plugin npm...
Email Bombs Exploit Lax Authentication in Zendesk
Cybercriminals are abusing a widespread lack of authentication in the customer service platform Zendesk to flood targeted email inboxes with menacing messages that come from hundreds of Zendesk corporate customers simultaneously. Zendesk is an automated help desk service designed to make it simpl...
EUVD-2015-6856
Malware in sbrugna...
EUVD-2019-0601
Malware in sbrugna...