| ID | CVSS | Sažetak | Zadnje ažurirano | Objavljeno |
|---|---|---|---|---|
| CVE-2020-29249 | 4.3 | CXUUCMS V3 allows class="layui-input" XSS. | 2020-12-29 16:06:00 | 2020-12-27 07:15:00 |
| CVE-2020-29250 | 4.3 | CXUUCMS V3 allows XSS via the first and third input fields to /public/admin.php. | 2020-12-29 16:01:00 | 2020-12-27 07:15:00 |
| CVE-2020-29159 | 4.0 | An issue was discovered in Zammad before 3.5.1. The default signup Role (for newly created Users) can be a privileged Role, if configured by an admin. This behvaior was unintended. | 2020-12-29 15:45:00 | 2020-12-28 08:15:00 |
| CVE-2020-26028 | 4.0 | An issue was discovered in Zammad before 3.4.1. Admin Users without a ticket.* permission can access Tickets. | 2020-12-29 14:49:00 | 2020-12-28 08:15:00 |
| CVE-2020-26029 | 4.0 | An issue was discovered in Zammad before 3.4.1. There are wrong authorization checks for impersonation requests via X-On-Behalf-Of. The authorization checks are performed for the actual user and not the one given in the X-On-Behalf-Of header. | 2020-12-29 14:40:00 | 2020-12-28 08:15:00 |
| CVE-2020-25860 | 7.1 | The install.c module in the Pengutronix RAUC update client prior to version 1.5 has a Time-of-Check Time-of-Use vulnerability, where signature verification on an update file takes place before the file is reopened for installation. An attacker who ca | 2020-12-29 14:36:00 | 2020-12-21 18:15:00 |
| CVE-2020-26030 | 7.5 | An issue was discovered in Zammad before 3.4.1. There is an authentication bypass in the SSO endpoint via a crafted header, when SSO is not configured. An attacker can create a valid and authenticated session that can be used to perform any actions i | 2020-12-29 14:31:00 | 2020-12-28 08:15:00 |
| CVE-2020-26031 | 4.0 | An issue was discovered in Zammad before 3.4.1. The global-search feature leaks Knowledge Base drafts to Knowledge Base readers (who are authenticated but have insufficient permissions). | 2020-12-29 14:29:00 | 2020-12-28 08:15:00 |
| CVE-2020-26032 | 5.0 | An SSRF issue was discovered in Zammad before 3.4.1. The SMS configuration interface for Massenversand is implemented in a way that renders the result of a test request to the User. An attacker can use this to request any URL via a GET request from t | 2020-12-29 14:27:00 | 2020-12-28 08:15:00 |
| CVE-2020-26033 | 5.8 | An issue was discovered in Zammad before 3.4.1. The Tag and Link REST API endpoints (for add and delete) lack a CSRF token check. | 2020-12-29 14:26:00 | 2020-12-28 08:15:00 |
| ID | CVSS | Sažetak | Zadnje ažurirano | Objavljeno |
|---|
Stranica
/39518
Zapisa po stranici: