CVE-2024-48938

Znuny before LTS 6.5.1 through 6.5.10 and 7.0.1 through 7.0.16 allows DoS/ReDos via email. Parsing the content of emails where HTML code is copied from Microsoft Word could lead to high CPU usage and block the parsing process...

CVE-2024-48938

Znuny vulnerable versions: 6.5.1–6.5.10 and 7.0.1–7.0.16. Root cause: DoS/ReDoS via parsing email content when HTML is copied from Microsoft Word, leading to high CPU usage and blocking the parsing process. Impact: potential denial of service. Exploitation details are not provided in the connecte...

PT-2024-24615 · Znuny +1 · Znuny +2

Name of the Vulnerable Software and Affected Versions: Znuny LTS versions 6.5.1 through 6.5.7 Znuny versions 7.0.1 through 7.0.16 Description: An issue was discovered where a logged-in agent is able to inject SQL in the draft form ID parameter of an AJAX request. Recommendations: For Znuny LTS...

CVE-2024-32493

CVE-2024-32493 affects Znuny LTS 6.5.1–6.5.7 and Znuny 7.0.1–7.0.16. A logged-in agent can inject SQL via the draft_form_id parameter in an AJAX request, indicating an authenticated SQL injection in the affected workflows. Red Hat/Ubuntu OSV, NVD, and other advisories corroborate the vulnerabilit...

CVE-2024-32493

An issue was discovered in Znuny LTS 6.5.1 through 6.5.7 and Znuny 7.0.1 through 7.0.16 where a logged-in agent is able to inject SQL in the draft form ID parameter of an AJAX request...

PT-2024-24613 · Znuny +1 · Znuny +1

Name of the Vulnerable Software and Affected Versions: Znuny versions 6.0.31 through 6.5.7 Znuny versions 7.0.1 through 7.0.16 Description: An issue allows a logged-in user to upload a file to an arbitrary writable location by traversing paths via a manipulated AJAX request. If this location is...