CVE 検索
公開されているすべての CVE とオープンソースのセキュリティアドバイザリ（NVD、OSV、GitHub）を、CVSS、EPSS、実際に悪用されているか（CISA KEV）とともに掲載しています。数時間ごとに更新されます。スキャンでは、検出した技術とこれらを照合します。
公開されているすべての CVE とオープンソースのセキュリティアドバイザリ（NVD、OSV、GitHub）を、CVSS、EPSS、実際に悪用されているか（CISA KEV）とともに掲載しています。数時間ごとに更新されます。スキャンでは、検出した技術とこれらを照合します。
| CVE-2021-43145 | 高8.1 | With certain LDAP configurations, Zammad 5.0.1 was found to be vulnerable to unauthorized access with existing user accounts. | 04/02/2022 |
| CVE-2021-42137 | 中5.3 | An issue was discovered in Zammad before 5.0.1. In some cases, there is improper enforcement of the privilege requirement for viewing a list of tickets that shows title, state, etc. | 11/10/2021 |
| CVE-2021-42091 | 緊急9.1 | An issue was discovered in Zammad before 4.1.1. SSRF can occur via GitHub or GitLab integration. | 07/10/2021 |
| CVE-2021-42090 | 緊急9.8 | An issue was discovered in Zammad before 4.1.1. The Form functionality allows remote code execution because deserialization is mishandled. | 07/10/2021 |
| CVE-2021-42089 | 高7.5 | An issue was discovered in Zammad before 4.1.1. The REST API discloses sensitive information. | 07/10/2021 |
| CVE-2021-42088 | 中6.1 | An issue was discovered in Zammad before 4.1.1. The Chat functionality allows XSS because clipboard data is mishandled. | 07/10/2021 |
| CVE-2021-42087 | 中4.9 | An issue was discovered in Zammad before 4.1.1. An admin can discover the application secret via the API. | 07/10/2021 |
| CVE-2021-42086 | 高8.8 | An issue was discovered in Zammad before 4.1.1. An Agent account can modify account data, and gain admin access, via a crafted request. | 07/10/2021 |
| CVE-2021-42085 | 中5.4 | An issue was discovered in Zammad before 4.1.1. There is stored XSS via a custom Avatar. | 07/10/2021 |
| CVE-2021-42084 | 中6.5 | An issue was discovered in Zammad before 4.1.1. An attacker with valid agent credentials may send a series of crafted requests that cause an endless loop and thus cause denial of service. | 07/10/2021 |
| CVE-2021-42094 | 緊急9.8 | An issue was discovered in Zammad before 4.1.1. Command Injection can occur via custom Packages. | 07/10/2021 |
| CVE-2021-42093 | 高7.2 | An issue was discovered in Zammad before 4.1.1. An admin can execute code on the server via a crafted request that manipulates triggers. | 07/10/2021 |
| CVE-2021-42092 | 中5.4 | An issue was discovered in Zammad before 4.1.1. Stored XSS may occur via an Article during addition of an attachment to a Ticket. | 07/10/2021 |
| CVE-2021-35303 | 中6.1 | Cross Site Scripting (XSS) in Zammad 1.0.x up to 4.0.0 allows remote attackers to execute arbitrary web script or HTML via the User Avatar attribute. | 28/06/2021 |
| CVE-2021-35302 | 中5.3 | Incorrect Access Control for linked Tickets in Zammad 1.0.x up to 4.0.0 allows remote attackers to obtain sensitive information. | 28/06/2021 |
| CVE-2021-35301 | 中5.3 | Incorrect Access Control in Zammad 1.0.x up to 4.0.0 allows remote attackers to obtain sensitive information via the Ticket Article detail view. | 28/06/2021 |
| CVE-2021-35300 | 中4.3 | Text injection/Content Spoofing in 404 page in Zammad 1.0.x up to 4.0.0 could allow remote attackers to manipulate users into visiting the attackers' page. | 28/06/2021 |