Filtered by vendor Zammad
Subscriptions
Filtered by product Zammad
Subscriptions
Total
72 CVE
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2021-42084 | 1 Zammad | 1 Zammad | 2024-08-04 | 6.5 Medium |
| An issue was discovered in Zammad before 4.1.1. An attacker with valid agent credentials may send a series of crafted requests that cause an endless loop and thus cause denial of service. | ||||
| CVE-2021-42086 | 1 Zammad | 1 Zammad | 2024-08-04 | 8.8 High |
| An issue was discovered in Zammad before 4.1.1. An Agent account can modify account data, and gain admin access, via a crafted request. | ||||
| CVE-2021-42092 | 1 Zammad | 1 Zammad | 2024-08-04 | 5.4 Medium |
| An issue was discovered in Zammad before 4.1.1. Stored XSS may occur via an Article during addition of an attachment to a Ticket. | ||||
| CVE-2021-42093 | 1 Zammad | 1 Zammad | 2024-08-04 | 7.2 High |
| An issue was discovered in Zammad before 4.1.1. An admin can execute code on the server via a crafted request that manipulates triggers. | ||||
| CVE-2021-42089 | 1 Zammad | 1 Zammad | 2024-08-04 | 7.5 High |
| An issue was discovered in Zammad before 4.1.1. The REST API discloses sensitive information. | ||||
| CVE-2021-35300 | 1 Zammad | 1 Zammad | 2024-08-04 | 4.3 Medium |
| Text injection/Content Spoofing in 404 page in Zammad 1.0.x up to 4.0.0 could allow remote attackers to manipulate users into visiting the attackers' page. | ||||
| CVE-2021-35302 | 1 Zammad | 1 Zammad | 2024-08-04 | 5.3 Medium |
| Incorrect Access Control for linked Tickets in Zammad 1.0.x up to 4.0.0 allows remote attackers to obtain sensitive information. | ||||
| CVE-2021-35299 | 1 Zammad | 1 Zammad | 2024-08-04 | 7.5 High |
| Incorrect Access Control in Zammad 1.0.x up to 4.0.0 allows attackers to obtain sensitive information via email connection configuration probing. | ||||
| CVE-2021-35298 | 1 Zammad | 1 Zammad | 2024-08-04 | 6.1 Medium |
| Cross Site Scripting (XSS) in Zammad 1.0.x up to 4.0.0 allows remote attackers to execute arbitrary web script or HTML via multiple models that contain a 'note' field to store additional information. | ||||
| CVE-2021-35303 | 1 Zammad | 1 Zammad | 2024-08-04 | 6.1 Medium |
| Cross Site Scripting (XSS) in Zammad 1.0.x up to 4.0.0 allows remote attackers to execute arbitrary web script or HTML via the User Avatar attribute. | ||||
| CVE-2021-35301 | 1 Zammad | 1 Zammad | 2024-08-04 | 5.3 Medium |
| Incorrect Access Control in Zammad 1.0.x up to 4.0.0 allows remote attackers to obtain sensitive information via the Ticket Article detail view. | ||||
| CVE-2022-48021 | 1 Zammad | 1 Zammad | 2024-08-03 | 9.8 Critical |
| A vulnerability in Zammad v5.3.0 allows attackers to execute arbitrary code or escalate privileges via a crafted message sent to the server. | ||||
| CVE-2022-48023 | 1 Zammad | 1 Zammad | 2024-08-03 | 4.3 Medium |
| Insufficient privilege verification in Zammad v5.3.0 allows an authenticated attacker to perform changes on the tags of their customer tickets using the Zammad API. This is now corrected in v5.3.1 so that only agents with write permissions may change ticket tags. | ||||
| CVE-2022-48022 | 1 Zammad | 1 Zammad | 2024-08-03 | 4.3 Medium |
| An issue in the component /api/v1/mentions of Zammad v5.3.0 allows authenticated attackers with agent permissions to view information about tickets they are not authorized to see. | ||||
| CVE-2022-40816 | 1 Zammad | 1 Zammad | 2024-08-03 | 6.5 Medium |
| Zammad 5.2.1 is vulnerable to Incorrect Access Control. Zammad's asset handling mechanism has logic to ensure that customer users are not able to see personal information of other users. This logic was not effective when used through a web socket connection, so that a logged-in attacker would be able to fetch personal data of other users by querying the Zammad API. This issue is fixed in , 5.2.2. | ||||
| CVE-2022-40817 | 1 Zammad | 1 Zammad | 2024-08-03 | 4.3 Medium |
| Zammad 5.2.1 has a fine-grained permission model that allows to configure read-only access to tickets. However, agents were still wrongly able to perform some operations on such tickets, like adding and removing links, tags. and related answers. This issue has been fixed in 5.2.2. | ||||
| CVE-2022-35490 | 1 Zammad | 1 Zammad | 2024-08-03 | 9.8 Critical |
| Zammad 5.2.0 is vulnerable to privilege escalation. Zammad has a prevention against brute-force attacks trying to guess login credentials. After a configurable amount of attempts, users are invalidated and logins prevented. An attacker might work around this prevention, enabling them to send more than the configured amount of requests before the user invalidation takes place. | ||||
| CVE-2022-35488 | 1 Zammad | 1 Zammad | 2024-08-03 | 7.5 High |
| In Zammad 5.2.0, an attacker could manipulate the rate limiting in the 'forgot password' feature of Zammad, and thereby send many requests for a known account to cause Denial Of Service by many generated emails which would also spam the victim. | ||||
| CVE-2022-35489 | 1 Zammad | 1 Zammad | 2024-08-03 | 6.5 Medium |
| In Zammad 5.2.0, customers who have secondary organizations assigned were able to see all organizations of the system rather than only those to which they are assigned. | ||||
| CVE-2022-35487 | 1 Zammad | 1 Zammad | 2024-08-03 | 7.5 High |
| Zammad 5.2.0 suffers from Incorrect Access Control. Zammad did not correctly perform authorization on certain attachment endpoints. This could be abused by an unauthenticated attacker to gain access to attachments, such as emails or attached files. | ||||