Vulnerabilities (CVE)

Join the Common Vulnerabilities and Exposures (CVE) community and start to get notified about new vulnerabilities.

Filtered by vendor Zammad Subscribe
Filtered by product Zammad
Total 63 CVE
CVE Vendors Products Updated CVSS v2 CVSS v3
CVE-2021-44886 1 Zammad 1 Zammad 2022-02-09 5.0 MEDIUM 5.3 MEDIUM
In Zammad 5.0.2, agents can configure "out of office" periods and substitute persons. If the substitute persons didn't have the same permissions as the original agent, they could receive ticket notifications for tickets that they have no access to.
CVE-2021-42094 1 Zammad 1 Zammad 2021-10-14 7.5 HIGH 9.8 CRITICAL
An issue was discovered in Zammad before 4.1.1. Command Injection can occur via custom Packages.
CVE-2021-42093 1 Zammad 1 Zammad 2021-10-14 6.5 MEDIUM 7.2 HIGH
An issue was discovered in Zammad before 4.1.1. An admin can execute code on the server via a crafted request that manipulates triggers.
CVE-2021-42092 1 Zammad 1 Zammad 2021-10-14 3.5 LOW 5.4 MEDIUM
An issue was discovered in Zammad before 4.1.1. Stored XSS may occur via an Article during addition of an attachment to a Ticket.
CVE-2021-42084 1 Zammad 1 Zammad 2021-10-14 4.0 MEDIUM 6.5 MEDIUM
An issue was discovered in Zammad before 4.1.1. An attacker with valid agent credentials may send a series of crafted requests that cause an endless loop and thus cause denial of service.
CVE-2021-42091 1 Zammad 1 Zammad 2021-10-14 6.4 MEDIUM 9.1 CRITICAL
An issue was discovered in Zammad before 4.1.1. SSRF can occur via GitHub or GitLab integration.
CVE-2021-42090 1 Zammad 1 Zammad 2021-10-14 7.5 HIGH 9.8 CRITICAL
An issue was discovered in Zammad before 4.1.1. The Form functionality allows remote code execution because deserialization is mishandled.
CVE-2021-42089 1 Zammad 1 Zammad 2021-10-14 5.0 MEDIUM 7.5 HIGH
An issue was discovered in Zammad before 4.1.1. The REST API discloses sensitive information.
CVE-2021-42088 1 Zammad 1 Zammad 2021-10-13 4.3 MEDIUM 6.1 MEDIUM
An issue was discovered in Zammad before 4.1.1. The Chat functionality allows XSS because clipboard data is mishandled.
CVE-2021-42085 1 Zammad 1 Zammad 2021-10-13 3.5 LOW 5.4 MEDIUM
An issue was discovered in Zammad before 4.1.1. There is stored XSS via a custom Avatar.
CVE-2020-29160 1 Zammad 1 Zammad 2021-07-21 5.0 MEDIUM 7.5 HIGH
An issue was discovered in Zammad before 3.5.1. A REST API call allows an attacker to change Ticket Article data in a way that defeats auditing.
CVE-2020-29158 1 Zammad 1 Zammad 2021-07-21 4.0 MEDIUM 4.3 MEDIUM
An issue was discovered in Zammad before 3.5.1. An Agent with Customer permissions in a Group can bypass intended access control on internal Articles via the Ticket detail view.
CVE-2020-10105 1 Zammad 1 Zammad 2021-07-21 5.0 MEDIUM 5.3 MEDIUM
An issue was discovered in Zammad 3.0 through 3.2. It returns source code of static resources when submitting an OPTIONS request, rather than a GET request. Disclosure of source code allows for an attacker to formulate more precise attacks. Source code was disclosed for the file 404.html (/zammad/public/404.html)
CVE-2020-14214 1 Zammad 1 Zammad 2021-07-21 5.8 MEDIUM 6.5 MEDIUM
Zammad before 3.3.1, when Domain Based Assignment is enabled, relies on a claimed e-mail address for authorization decisions. An attacker can register a new account that will have access to all tickets of an arbitrary Organization.
CVE-2020-10101 1 Zammad 1 Zammad 2021-07-21 5.0 MEDIUM 7.5 HIGH
An issue was discovered in Zammad 3.0 through 3.2. The WebSocket server crashes when messages in non-JSON format are sent by an attacker. The message format is not properly checked and parsing errors not handled. This leads to a crash of the service process.
CVE-2020-10100 1 Zammad 1 Zammad 2021-07-21 4.0 MEDIUM 6.5 MEDIUM
An issue was discovered in Zammad 3.0 through 3.2. It allows for users to view ticket customer details associated with specific customers. However, the application does not properly implement access controls related to this functionality. As such, users of one company are able to access ticket data from other companies. Due to the multi-tenant nature of this application, users who can access ticket details from one organization to the next allows for users to exfiltrate potentially sensitive data of other companies.
CVE-2021-35300 1 Zammad 1 Zammad 2021-07-02 4.3 MEDIUM 4.3 MEDIUM
Text injection/Content Spoofing in 404 page in Zammad 1.0.x up to 4.0.0 could allow remote attackers to manipulate users into visiting the attackers' page.
CVE-2021-35303 1 Zammad 1 Zammad 2021-07-02 4.3 MEDIUM 6.1 MEDIUM
Cross Site Scripting (XSS) in Zammad 1.0.x up to 4.0.0 allows remote attackers to execute arbitrary web script or HTML via the User Avatar attribute.
CVE-2021-35298 1 Zammad 1 Zammad 2021-07-01 4.3 MEDIUM 6.1 MEDIUM
Cross Site Scripting (XSS) in Zammad 1.0.x up to 4.0.0 allows remote attackers to execute arbitrary web script or HTML via multiple models that contain a 'note' field to store additional information.
CVE-2020-26034 1 Zammad 1 Zammad 2020-12-30 4.0 MEDIUM 4.3 MEDIUM
An account-enumeration issue was discovered in Zammad before 3.4.1. The Create User functionality is implemented in a way that would enable an anonymous user to guess valid user email addresses. The application responds differently depending on whether the input supplied was recognized as associated with a valid user.