Zammad
Page 2 of 2 — Zammad CVEs from a corpus of 121, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-26029 | Medium | 6.5 | 2020-12-28 | An issue was discovered in Zammad before 3.4.1. There are wrong authorization checks for impersonation requests via X-On-Behalf-Of. The authorization checks ar… |
CVE-2020-26028 | Medium | 4.9 | 2020-12-28 | An issue was discovered in Zammad before 3.4.1. Admin Users without a ticket.* permission can access Tickets. |
CVE-2020-14214 | Medium | 6.5 | 2020-06-16 | Zammad before 3.3.1, when Domain Based Assignment is enabled, relies on a claimed e-mail address for authorization decisions. An attacker can register a new ac… |
CVE-2020-14213 | Medium | 5.4 | 2020-06-16 | In Zammad before 3.3.1, a Customer has ticket access that should only be available to an Agent (e.g., read internal data, split, or merge). |
CVE-2020-10105 | Medium | 5.3 | 2020-03-05 | An issue was discovered in Zammad 3.0 through 3.2. It returns source code of static resources when submitting an OPTIONS request, rather than a GET request. Di… |
CVE-2020-10104 | Medium | 4.3 | 2020-03-05 | An issue was discovered in Zammad 3.0 through 3.2. After authentication, it transmits sensitive information to the user that may be compromised and used by an… |
CVE-2020-10103 | Medium | 5.4 | 2020-03-05 | An XSS issue was discovered in Zammad 3.0 through 3.2. Malicious code can be provided by a low-privileged user through the File Upload functionality in Zammad… |
CVE-2020-10102 | Medium | 5.3 | 2020-03-05 | An issue was discovered in Zammad 3.0 through 3.2. The Forgot Password functionality is implemented in a way that would enable an anonymous user to guess valid… |
CVE-2020-10101 | High | 7.5 | 2020-03-05 | An issue was discovered in Zammad 3.0 through 3.2. The WebSocket server crashes when messages in non-JSON format are sent by an attacker. The message format is… |
CVE-2020-10100 | Medium | 6.5 | 2020-03-05 | An issue was discovered in Zammad 3.0 through 3.2. It allows for users to view ticket customer details associated with specific customers. However, the applica… |
CVE-2020-10099 | Medium | 5.4 | 2020-03-05 | An XSS issue was discovered in Zammad 3.0 through 3.2. Malicious code can be provided by a low-privileged user through the Ticket functionality in Zammad. The… |
CVE-2020-10098 | Medium | 5.4 | 2020-03-05 | An XSS issue was discovered in Zammad 3.0 through 3.2. Malicious code can be provided by a low-privileged user through the Email functionality. The malicious J… |
CVE-2020-10097 | Medium | 5.3 | 2020-03-05 | An issue was discovered in Zammad 3.0 through 3.2. It may respond with verbose error messages that disclose internal application or infrastructure information… |
CVE-2020-10096 | High | 7.5 | 2020-03-05 | An issue was discovered in Zammad 3.0 through 3.2. It does not prevent caching of confidential data within browser memory. An attacker who either remotely comp… |
CVE-2019-1010018 | Medium | 6.1 | 2019-07-16 | Zammad GmbH Zammad 2.3.0 and earlier is affected by: Cross Site Scripting (XSS) - CWE-80. The impact is: Execute java script code on users browser. The compone… |
CVE-2018-1000154 | Medium | 6.1 | 2018-04-05 | Zammad GmbH Zammad version 2.3.0 and earlier contains a Improper Neutralization of Script-Related HTML Tags in a Web Page (CWE-80) vulnerability in the subject… |
CVE-2017-6081 | High | 8.8 | 2017-03-13 | A CSRF issue was discovered in Zammad before 1.0.4, 1.1.x before 1.1.3, and 1.2.x before 1.2.1. To exploit the vulnerability, an attacker can send cross-domain… |
CVE-2017-6080 | Critical | 9.8 | 2017-03-13 | An issue was discovered in Zammad before 1.0.4, 1.1.x before 1.1.3, and 1.2.x before 1.2.1, caused by lack of a protection mechanism involving HTTP Access-Cont… |
CVE-2017-5621 | Medium | 6.1 | 2017-03-13 | An issue was discovered in Zammad before 1.0.4, 1.1.x before 1.1.3, and 1.2.x before 1.2.1. XSS can be triggered via malicious HTML in a chat message or the co… |
CVE-2017-5620 | Medium | 6.1 | 2017-03-13 | An XSS issue was discovered in Zammad before 1.0.4, 1.1.x before 1.1.3, and 1.2.x before 1.2.1. Attachments are opened in a new tab instead of getting download… |
CVE-2017-5619 | Critical | 9.8 | 2017-03-13 | An issue was discovered in Zammad before 1.0.4, 1.1.x before 1.1.3, and 1.2.x before 1.2.1. Attackers can login with the hashed password itself (e.g., from the… |