CVE-2020-26034

An account-enumeration issue was discovered in Zammad before 3.4.1. The Create User functionality is implemented in a way that would enable an anonymous user to guess valid user email addresses. The application responds differently depending on whether the input supplied was recognized as...

CVE-2020-26035

An issue was discovered in Zammad before 3.4.1. There is Stored XSS via a Tags element in a TIcket...

CVE-2020-26035

Zammad CVE-2020-26035 affects versions before 3.4.1 (Zammad

CVE-2020-29158

CVE-2020-29158 affects Zammad prior to the 3.5.1 release. An agent with Customer permissions within a Group can bypass intended access control to internal Articles through the Ticket detail view, effectively exposing restricted content. The available sources consistently describe an access-contro...

CVE-2020-29158

An issue was discovered in Zammad before 3.5.1. An Agent with Customer permissions in a Group can bypass intended access control on internal Articles via the Ticket detail view...

CVE-2020-29159

CVE-2020-29159 affects Zammad prior to 3.5.1. The vulnerability arises because the default signup Role assigned to newly created users can be a privileged Role if configured by an admin, which was unintended. Public references include Zammad advisories and a related commit; exploitation details, ...

CVE-2020-29159

An issue was discovered in Zammad before 3.5.1. The default signup Role for newly created Users can be a privileged Role, if configured by an admin. This behvaior was unintended...

CVE-2020-29160

CVE-2020-29160 affects Zammad before 3.5.1. A REST API call can modify Ticket Article data and defeat auditing via an access-control flaw, with no authentication required in CVSS terms. Impact is integrity loss (high) and auditing bypass. Remediation stated across sources is to upgrade to Zammad ...

CVE-2020-29160

An issue was discovered in Zammad before 3.5.1. A REST API call allows an attacker to change Ticket Article data in a way that defeats auditing...

Zammad 安全漏洞

Zammad is a Web-based open source helpdesk/customer support system. An access control bypass vulnerability exists in Zammad versions prior to 3.5.1. An Agent with Customer privileges in a group can exploit this vulnerability to bypass access control to internal Articles via the Ticket detail view...

Zammad 跨站脚本漏洞

Zammad is a Web-based open source helpdesk/customer support system. A stored cross-site scripting vulnerability exists in Zammad versions prior to 3.4.1. An attacker can exploit this vulnerability to execute malicious code via the Tags element in TIcket...

Zammad 安全漏洞

Zammad is a Web-based open source helpdesk/customer support system. An account enumeration vulnerability exists in Zammad versions prior to 3.4.1. The vulnerability can be exploited to guess valid user e-mail addresses via the "Create User" feature...

Zammad 安全漏洞

Zammad is a Web-based open source helpdesk/customer support system. An information disclosure vulnerability exists in Zammad versions prior to 3.4.1. The vulnerability can be exploited by an attacker to gain unauthorized access to a knowledge base draft via the global search function...

Zammad 安全漏洞

Zammad is a Web-based open source helpdesk/customer support system. An improper access control vulnerability exists in Zammad versions prior to 3.4.1. An attacker could exploit the vulnerability to access work orders...

Zammad 跨站请求伪造漏洞

Zammad is a suite of ticket management software from the German company Zammad. A cross-site request forgery vulnerability exists in versions prior to Zammad 3.5.1, which stems from a lack of CSRF token checking in the Labeling and Linking REST API endpoints used for additions and deletions. No...

Zammad Security Vulnerability

Zammad is a suite of ticket management software from the German company Zammad. A security vulnerability exists in Zammad versions prior to 3.4.1, where an incorrect authorization check is performed on simulated requests via X-On-Behalf-Of. The authorization check is performed for the actual user...

Zammad 安全漏洞

Zammad is a Web-based open source helpdesk/customer support system. An access control error vulnerability exists in Zammad versions prior to 3.5.1. An attacker can exploit this vulnerability to bypass auditing and change Ticket Article data via REST API calls...

Zammad 授权问题漏洞

Zammad is a Web-based open source helpdesk/customer support system. An SSO endpoint authentication bypass vulnerability exists in Zammad versions prior to 3.4.1. An attacker can exploit this vulnerability by creating a valid authentication session to perform any action in the name of another user...

Zammad Security Vulnerability

Zammad is a suite of ticket management software from the German company Zammad. A security vulnerability exists in versions prior to Zammad 3.5.1 that stems from the fact that the default registration role newly created user can be a privileged role configured by an administrator. This behavior w...

Zammad 代码问题漏洞

Zammad is a Web-based open source helpdesk/customer support system. An information disclosure vulnerability exists in Zammad versions prior to 3.4.1. The vulnerability stems from the way Massenversand's implementation of the SMS configuration interface presents the results of test requests to the...