CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| 04/02/2022 |
| CVE-2021-43145 | 높음8.1 | With certain LDAP configurations, Zammad 5.0.1 was found to be vulnerable to unauthorized access with existing user accounts. | 04/02/2022 |
| CVE-2021-42137 | 보통5.3 | An issue was discovered in Zammad before 5.0.1. In some cases, there is improper enforcement of the privilege requirement for viewing a list of tickets that shows title, state, etc. | 11/10/2021 |
| CVE-2021-42091 | 심각9.1 | An issue was discovered in Zammad before 4.1.1. SSRF can occur via GitHub or GitLab integration. | 07/10/2021 |
| CVE-2021-42090 | 심각9.8 | An issue was discovered in Zammad before 4.1.1. The Form functionality allows remote code execution because deserialization is mishandled. | 07/10/2021 |
| CVE-2021-42089 | 높음7.5 | An issue was discovered in Zammad before 4.1.1. The REST API discloses sensitive information. | 07/10/2021 |
| CVE-2021-42088 | 보통6.1 | An issue was discovered in Zammad before 4.1.1. The Chat functionality allows XSS because clipboard data is mishandled. | 07/10/2021 |
| CVE-2021-42087 | 보통4.9 | An issue was discovered in Zammad before 4.1.1. An admin can discover the application secret via the API. | 07/10/2021 |
| CVE-2021-42086 | 높음8.8 | An issue was discovered in Zammad before 4.1.1. An Agent account can modify account data, and gain admin access, via a crafted request. | 07/10/2021 |
| CVE-2021-42085 | 보통5.4 | An issue was discovered in Zammad before 4.1.1. There is stored XSS via a custom Avatar. | 07/10/2021 |
| CVE-2021-42084 | 보통6.5 | An issue was discovered in Zammad before 4.1.1. An attacker with valid agent credentials may send a series of crafted requests that cause an endless loop and thus cause denial of service. | 07/10/2021 |
| CVE-2021-42094 | 심각9.8 | An issue was discovered in Zammad before 4.1.1. Command Injection can occur via custom Packages. | 07/10/2021 |
| CVE-2021-42093 | 높음7.2 | An issue was discovered in Zammad before 4.1.1. An admin can execute code on the server via a crafted request that manipulates triggers. | 07/10/2021 |
| CVE-2021-42092 | 보통5.4 | An issue was discovered in Zammad before 4.1.1. Stored XSS may occur via an Article during addition of an attachment to a Ticket. | 07/10/2021 |
| CVE-2021-35303 | 보통6.1 | Cross Site Scripting (XSS) in Zammad 1.0.x up to 4.0.0 allows remote attackers to execute arbitrary web script or HTML via the User Avatar attribute. | 28/06/2021 |
| CVE-2021-35302 | 보통5.3 | Incorrect Access Control for linked Tickets in Zammad 1.0.x up to 4.0.0 allows remote attackers to obtain sensitive information. | 28/06/2021 |
| CVE-2021-35301 | 보통5.3 | Incorrect Access Control in Zammad 1.0.x up to 4.0.0 allows remote attackers to obtain sensitive information via the Ticket Article detail view. | 28/06/2021 |
| CVE-2021-35300 | 보통4.3 | Text injection/Content Spoofing in 404 page in Zammad 1.0.x up to 4.0.0 could allow remote attackers to manipulate users into visiting the attackers' page. | 28/06/2021 |