Zammad 安全漏洞

Zammad is a suite of ticket management software from the German company Zammad. Zammad suffers from an information disclosure vulnerability that stems from the use of the public endpoint /api/v1/signshow as its login screen, which returns internal configuration data for user object attributes. An...

Zammad 安全漏洞

Zammad is a suite of ticket management software from the German company Zammad. A trust management issue vulnerability exists in Zammad that stems from the fact that SSL/TLS is used in multiple subsystems to establish connections to external services without properly validating the hostname and...

Zammad Security Vulnerability

Zammad is a suite of ticket management software from the German company Zammad. A security vulnerability exists in Zammad versions prior to 6.2.0 that stems from an attacker's ability to trigger a phishing link in a generated notification email via a carefully crafted first or last name...

CVE-2023-50456

An issue was discovered in Zammad before 6.2.0. An attacker can trigger phishing links in generated notification emails via a crafted first or last name...

PT-2023-31559 · Zammad · Zammad

Name of the Vulnerable Software and Affected Versions: Zammad versions prior to 6.2.0 Description: An issue was discovered due to a lack of rate limiting in the "email address verification" feature. This allows an attacker to send many requests for a known address, causing Denial Of Service by...

CVE-2023-29868

Zammad 5.3.x Fixed in 5.4.0 is vulnerable to Incorrect Access Control. An authenticated attacker with agent and customer roles could perform unauthorized changes on articles where they only have customer permissions...

Zammad 安全漏洞

Zammad is a Web-based open source help desk. Zammad suffers from an Access Control Error vulnerability that can be exploited by a remote attacker to submit a special request that can obtain sensitive information...

CVE-2022-48021

A vulnerability in Zammad v5.3.0 allows attackers to execute arbitrary code or escalate privileges via a crafted message sent to the server...

Zammad 安全漏洞

Zammad is a suite of ticket management software from the German company Zammad. A security vulnerability exists in Zammad version v5.3.0, which stems from insufficient privilege validation, and can be exploited by an attacker to make changes to the labels of its customers' tickets using the Zamma...

CVE-2022-40816

Zammad 5.2.1 is vulnerable to Incorrect Access Control. Zammad's asset handling mechanism has logic to ensure that customer users are not able to see personal information of other users. This logic was not effective when used through a web socket connection, so that a logged-in attacker would be...

Zammad 安全漏洞

Zammad is a suite of ticket management software from the German company Zammad. A security vulnerability exists in Zammad version 5.2.1, which stems from a fine-grained permission model that allows configuring read-only access to work orders, however, agents are still able to incorrectly perform...

Zammad 安全漏洞

Zammad is a suite of ticket management software from the German company Zammad. A security vulnerability exists in Zammad version 5.2.0, which stems from a flaw in its login credentials brute force feature that causes an attacker to bypass the feature's limitations before attempting a certain...

Zammad 安全漏洞

Zammad is a suite of ticket management software from the German company Zammad. A security vulnerability exists in Zammad version 5.2.0 that stems from the ability of a user assigned to a secondary organization to see the entire organization instead of just the organization to which they are...

CVE-2021-42087

An issue was discovered in Zammad before 4.1.1. An admin can discover the application secret via the API...

CVE-2021-42090

An issue was discovered in Zammad before 4.1.1. The Form functionality allows remote code execution because deserialization is mishandled...

Zammad cross-site scripting vulnerability (CNVD-2021-50125)

Zammad is a Web-based open source helpdesk/customer support system. A cross-site scripting vulnerability exists in Zammad. A remote attacker can exploit this vulnerability to execute arbitrary web script or HTML via the "user-avatar" attribute...

Zammad Access Control Bypass Vulnerability

Zammad is a Web-based open source helpdesk/customer support system. An access control bypass vulnerability exists in Zammad versions prior to 3.5.1. An Agent with Customer privileges in a group can exploit this vulnerability to bypass access control to internal Articles via the Ticket detail view...

Zammad 安全漏洞

Zammad is a Web-based open source helpdesk/customer support system. An information disclosure vulnerability exists in Zammad versions prior to 3.4.1. The vulnerability can be exploited by an attacker to gain unauthorized access to a knowledge base draft via the global search function...

Zammad Security Vulnerability

Zammad is a suite of ticket management software from the German company Zammad. A security vulnerability exists in Zammad versions prior to 3.4.1, where an incorrect authorization check is performed on simulated requests via X-On-Behalf-Of. The authorization check is performed for the actual user...

Zammad Security Vulnerability

Zammad is a suite of ticket management software from the German company Zammad. A security vulnerability exists in versions prior to Zammad 3.5.1 that stems from the fact that the default registration role newly created user can be a privileged role configured by an administrator. This behavior w...