Rezultati pretraživanja za 'Proizvođač: zammad'
| ID | CVSS | Sažetak | Zadnje ažurirano | Objavljeno |
|---|---|---|---|---|
| CVE-2026-34724 | 7.2 | Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.1, a server-side template injection vulnerability which leads to RCE via AI Agent exists. Impact is limited to environments where an attacker can control or influence t | 2026-04-17 15:04:05 | 2026-04-08 19:25:22 |
| CVE-2026-34782 | 4.3 | Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.1 and 6.5.4, the REST endpoint POST /api/v1/ai_assistance/text_tools/:id was not checking if a user is privileged to use the text tool, resulting in being able to use it | 2026-04-17 14:58:19 | 2026-04-08 19:25:22 |
| CVE-2023-50456 | 5.3 | An issue was discovered in Zammad before 6.2.0. An attacker can trigger phishing links in generated notification emails via a crafted first or last name. | 2025-05-27 16:15:30 | 2023-12-10 19:15:07 |
| CVE-2022-40817 | 4.3 | Zammad 5.2.1 has a fine-grained permission model that allows to configure read-only access to tickets. However, agents were still wrongly able to perform some operations on such tickets, like adding and removing links, tags. and related answers. This | 2025-05-21 15:16:01 | 2022-09-27 23:15:16 |
| CVE-2022-40816 | 6.5 | Zammad 5.2.1 is vulnerable to Incorrect Access Control. Zammad's asset handling mechanism has logic to ensure that customer users are not able to see personal information of other users. This logic was not effective when used through a web socket con | 2025-05-21 15:16:00 | 2022-09-27 23:15:16 |
| CVE-2024-33666 | 8.6 | An issue was discovered in Zammad before 6.3.0. Users with customer access to a ticket could have accessed time accounting details of this ticket via the API. This data should be available only to agents. | 2025-04-15 16:40:08 | 2024-04-26 01:15:46 |
| CVE-2024-33667 | 6.5 | An issue was discovered in Zammad before 6.3.0. An authenticated agent could perform a remote Denial of Service attack by calling an endpoint that accepts a generic method name, which was not properly sanitized against an allowlist. | 2025-04-15 16:39:26 | 2024-04-26 01:15:46 |
| CVE-2024-33668 | 9.1 | An issue was discovered in Zammad before 6.3.0. The Zammad Upload Cache uses insecure, partially guessable FormIDs to identify content. An attacker could try to brute force them to upload malicious content to article drafts they have no access to. | 2025-04-15 16:38:55 | 2024-04-26 01:15:46 |
| CVE-2024-36078 | 6.7 | In Zammad before 6.3.1, a Ruby gem bundled by Zammad is installed with world-writable file permissions. This allowed a local attacker on the server to modify the gem's files, injecting arbitrary code into Zammad processes (which run with the environm | 2025-04-15 16:38:03 | 2024-05-19 20:15:08 |
| CVE-2024-55578 | 4.3 | Zammad before 6.4.1 places sensitive data (such as auth_microsoft_office365_credentials and application_secret) in log files. | 2025-04-15 16:37:30 | 2024-12-09 03:15:04 |
| ID | CVSS | Sažetak | Zadnje ažurirano | Objavljeno |
|---|
Stranica
/10
Zapisa po stranici: