CVE-2021-42087

An issue was discovered in Zammad before 4.1.1. An admin can discover the application secret via the API...

CVE-2021-42088

An issue was discovered in Zammad before 4.1.1. The Chat functionality allows XSS because clipboard data is mishandled...

CVE-2021-42088

Zammad vulnerability CVE-2021-42088 affects the chat feature in Zammad versions before 4.1.1. The root cause is mishandling of clipboard data, allowing cross-site scripting (XSS). This affects users of Zammad’s chat functionality, where clipboard content can be injected and executed in the browse...

CVE-2021-42089

Zammad before 4.1.1 is affected by CVE-2021-42089: the REST API discloses sensitive information, enabling information disclosure via the API. Exploitation details are not provided in the supplied documents beyond the REST API exposure and the affected version range (prior to 4.1.1). The issue has...

CVE-2021-42089

An issue was discovered in Zammad before 4.1.1. The REST API discloses sensitive information...

CVE-2021-42090

An issue was discovered in Zammad before 4.1.1. The Form functionality allows remote code execution because deserialization is mishandled...

CVE-2021-42090

Zammad before 4.1.1 contains a remote code execution vulnerability due to mishandled deserialization in the Form functionality. The issue allows an attacker to execute arbitrary code on affected systems. Affected product/version: Zammad prior to 4.1.1 (open-source web-based help desk). Root cause...

CVE-2021-42091

CVE-2021-42091 affects Zammad prior to 4.1.1, where server-side request forgery (SSRF) can occur through GitHub or GitLab integrations. The connected documents confirm the affected software is Zammad and the issue is tied to the GitHub/GitLab integration, with remediation implied by the version 4...

CVE-2021-42091

An issue was discovered in Zammad before 4.1.1. SSRF can occur via GitHub or GitLab integration...

CVE-2021-42092

An issue was discovered in Zammad before 4.1.1. Stored XSS may occur via an Article during addition of an attachment to a Ticket...

CVE-2021-42092

The CVE-2021-42092 issue affects Zammad prior to 4.1.1, where a Stored XSS can be triggered when attaching a file to a Ticket via an Article. The root cause is input validation/escaping during attachment handling that allows injected JavaScript to be stored and later executed in the context of th...

CVE-2021-42093

Zammad (before 4.1.1) is affected by CVE-2021-42093. An administrative-triggered, crafted request can manipulate triggers to execute code on the server, enabling remote code execution. The vulnerability is documented in multiple sources (e.g., CNVD/CNNVD and NVD) with the remediation being upgrad...

CVE-2021-42093

An issue was discovered in Zammad before 4.1.1. An admin can execute code on the server via a crafted request that manipulates triggers...

CVE-2021-42094

CVE-2021-42094 affects Zammad before 4.1.1. A command injection can occur via custom Packages. The connected documents confirm the affected software (Zammad) and the vulnerable condition (pre-4.1.1) but do not provide detailed root-cause internals. Impact is described as command execution with hi...

CVE-2021-42094

An issue was discovered in Zammad before 4.1.1. Command Injection can occur via custom Packages...

Zammad 代码问题漏洞

Zammad is an open source web-based help desk/customer support system. a remote code execution vulnerability exists in the Form functionality of Zammad versions prior to 4.1.1. The vulnerability stems from improper handling of deserialization. An attacker could exploit the vulnerability to execute...

Zammad 跨站脚本漏洞

Zammad is an open source web-based help desk/customer support system. a cross-site scripting vulnerability exists in the chat feature in versions of Zammad prior to 4.1.1. The vulnerability stems from improper handling of clipboard data. An attacker could exploit the vulnerability to execute...

Zammad 命令注入漏洞

Zammad is a web-based open source help desk/customer support system. a command injection vulnerability exists in versions of Zammad prior to 4.1.1. An attacker could exploit the vulnerability to inject commands via custom packages...

Zammad 安全漏洞

Zammad is a ticket management software from Zammad, a German company. versions prior to Zammad 4.1.1 have security vulnerabilities that allow attackers to discover application secrets and obtain sensitive information through the API...

CVE-2021-42088: Improper Neutralization of Input During Web Page Generation

An issue was discovered in Zammad before 4.1.1. The Chat functionality allows XSS because clipboard data is mishandled...