Skip to contentZammad vulnerabilities
Newest
- zammadAn issue was discovered in Zammad before 6.3.0. An authenticated agent could perform a remote...CVE-2024-336676.5 Medium
- zammad, zimmad +1 moreAn issue was discovered in Zammad before 6.3.0. Users with customer access to a ticket could have...CVE-2024-336668.6 High
- zammadAn issue was discovered in Zammad before 6.2.0. When listing tickets linked to a knowledge base...CVE-2023-504574.3 Medium
- zammadAn issue was discovered in Zammad before 6.2.0. An attacker can trigger phishing links in...CVE-2023-504565.3 Medium
- zammadAn issue was discovered in Zammad before 6.2.0. Due to lack of rate limiting in the "email...CVE-2023-504557.5 High
- zammadAn issue was discovered in Zammad before 6.2.0. In several subsystems, SSL/TLS was used to...CVE-2023-504545.9 Medium
- zammadAn issue was discovered in Zammad before 6.2.0. It uses the public endpoint /api/v1/signshow for...CVE-2023-504535.3 Medium
- zammadAn issue in Zammad v5.4.0 allows attackers to bypass e-mail verification using an arbitrary...CVE-2023-315976.5 Medium
- zammadZammad 5.3.x (Fixed in 5.4.0) is vulnerable to Incorrect Access Control. An authenticated...CVE-2023-298686.5 Medium
- zammadZammad 5.3.x (Fixed 5.4.0) is vulnerable to Incorrect Access Control. An authenticated attacker...CVE-2023-298676.5 Medium
- zammadInsufficient privilege verification in Zammad v5.3.0 allows an authenticated attacker to perform...CVE-2022-480234.3 Medium
- zammadAn issue in the component /api/v1/mentions of Zammad v5.3.0 allows authenticated attackers with...CVE-2022-480224.3 Medium
- zammadA vulnerability in Zammad v5.3.0 allows attackers to execute arbitrary code or escalate...CVE-2022-480219.8 Critical
- zammadZammad 5.2.1 is vulnerable to Incorrect Access Control. Zammad's asset handling mechanism has...CVE-2022-408166.5 Medium
- zammadZammad 5.2.1 has a fine-grained permission model that allows to configure read-only access to...CVE-2022-408174.3 Medium
- zammadZammad 5.2.0 is vulnerable to privilege escalation. Zammad has a prevention against brute-force...CVE-2022-354909.8 Critical
- zammadIn Zammad 5.2.0, customers who have secondary organizations assigned were able to see all...CVE-2022-354896.5 Medium
- zammadIn Zammad 5.2.0, an attacker could manipulate the rate limiting in the 'forgot password' feature...CVE-2022-354887.5 High
- zammadZammad 5.2.0 suffers from Incorrect Access Control. Zammad did not correctly perform...CVE-2022-354877.5 High
- zammadA lack of password length restriction in Zammad v5.1.0 allows for the creation of extremely long...CVE-2022-297007.5 High
- zammadA lack of rate limiting in the 'forgot password' feature of Zammad v5.1.0 allows attackers to...CVE-2022-297017.5 High
- zammadAn access control issue in Zammad v5.0.3 allows attackers to write entries to the CTI caller log...CVE-2022-273329.1 Critical
- zammadAn access control issue in Zammad v5.0.3 broadcasts administrative configuration changes to all...CVE-2022-273314.3 Medium
- zammadWith certain LDAP configurations, Zammad 5.0.1 was found to be vulnerable to unauthorized access...CVE-2021-431458.1 High
- zammadIn Zammad 5.0.2, agents can configure "out of office" periods and substitute persons. If the...CVE-2021-448865.3 Medium
- zammadAn issue was discovered in Zammad before 5.0.1. In some cases, there is improper enforcement of...CVE-2021-421375.3 Medium
- zammadAn issue was discovered in Zammad before 4.1.1. An attacker with valid agent credentials may send...CVE-2021-420846.5 Medium
- zammadAn issue was discovered in Zammad before 4.1.1. There is stored XSS via a custom Avatar.CVE-2021-420855.4 Medium
- zammadAn issue was discovered in Zammad before 4.1.1. An Agent account can modify account data, and...CVE-2021-420868.8 High
- zammadAn issue was discovered in Zammad before 4.1.1. An admin can discover the application secret via...CVE-2021-420874.9 Medium
- zammadAn issue was discovered in Zammad before 4.1.1. The Chat functionality allows XSS because...CVE-2021-420886.1 Medium
- zammadAn issue was discovered in Zammad before 4.1.1. The REST API discloses sensitive information.CVE-2021-420897.5 High
- zammadAn issue was discovered in Zammad before 4.1.1. The Form functionality allows remote code...CVE-2021-420909.8 Critical
- zammadAn issue was discovered in Zammad before 4.1.1. SSRF can occur via GitHub or GitLab integration.CVE-2021-420919.1 Critical
- zammadAn issue was discovered in Zammad before 4.1.1. Stored XSS may occur via an Article during...CVE-2021-420925.4 Medium
- zammadAn issue was discovered in Zammad before 4.1.1. An admin can execute code on the server via a...CVE-2021-420937.2 High
- zammadAn issue was discovered in Zammad before 4.1.1. Command Injection can occur via custom Packages.CVE-2021-420949.8 Critical
- zammadCross Site Scripting (XSS) in Zammad 1.0.x up to 4.0.0 allows remote attackers to execute...CVE-2021-352986.1 Medium
- zammadIncorrect Access Control in Zammad 1.0.x up to 4.0.0 allows attackers to obtain sensitive...CVE-2021-352997.5 High
- zammadText injection/Content Spoofing in 404 page in Zammad 1.0.x up to 4.0.0 could allow remote...CVE-2021-353004.3 Medium
- zammadIncorrect Access Control in Zammad 1.0.x up to 4.0.0 allows remote attackers to obtain sensitive...CVE-2021-353015.3 Medium
- zammadIncorrect Access Control for linked Tickets in Zammad 1.0.x up to 4.0.0 allows remote attackers...CVE-2021-353025.3 Medium
- zammadCross Site Scripting (XSS) in Zammad 1.0.x up to 4.0.0 allows remote attackers to execute...CVE-2021-353036.1 Medium
- zammadAn issue was discovered in Zammad before 3.4.1. Admin Users without a ticket.* permission can...CVE-2020-260284.9 Medium
- zammadAn issue was discovered in Zammad before 3.4.1. There are wrong authorization checks for...CVE-2020-260296.5 Medium
- zammadAn issue was discovered in Zammad before 3.4.1. There is an authentication bypass in the SSO...CVE-2020-260309.8 Critical
- zammadAn issue was discovered in Zammad before 3.4.1. The global-search feature leaks Knowledge Base...CVE-2020-260314.3 Medium
- zammadAn SSRF issue was discovered in Zammad before 3.4.1. The SMS configuration interface for...CVE-2020-260327.5 High
- zammadAn issue was discovered in Zammad before 3.4.1. The Tag and Link REST API endpoints (for add and...CVE-2020-260335.4 Medium
- zammadAn account-enumeration issue was discovered in Zammad before 3.4.1. The Create User functionality...CVE-2020-260344.3 Medium
- Show moreLoading…