CVE-2017-6081

A CSRF issue was discovered in Zammad before 1.0.4, 1.1.x before 1.1.3, and 1.2.x before 1.2.1. To exploit the vulnerability, an attacker can send cross-domain requests directly to the REST API for users with a valid session cookie...

CVE-2017-6080

CVE-2017-6080 affects Zammad versions prior to 1.0.4, 1.1.x before 1.1.3, and 1.2.x before 1.2.1. Root cause: missing protection via HTTP Access-Control headers. Attack surface: cross-domain requests to the REST API for users with a valid session cookie, enabling disclosure of results. Impact ran...

CVE-2017-5619

An issue was discovered in Zammad before 1.0.4, 1.1.x before 1.1.3, and 1.2.x before 1.2.1. Attackers can login with the hashed password itself e.g., from the DB instead of the valid password string...

CVE-2017-5619

CVE-2017-5619 affects Zammad prior to 1.0.4, 1.1.x prior to 1.1.3, and 1.2.x prior to 1.2.1. The vulnerability allows an attacker to authenticate by using a hashed password retrieved from the database instead of a valid password string, effectively bypassing normal authentication. The available c...