CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2020-10105
https://notcve.org/view.php?id=CVE-2020-10105
An issue was discovered in Zammad 3.0 through 3.2. It returns source code of static resources when submitting an OPTIONS request, rather than a GET request. Disclosure of source code allows for an attacker to formulate more precise attacks. Source code was disclosed for the file 404.html (/zammad/public/404.html) Se detectó un problema en Zammad versiones 3.0 hasta 3.2. Devuelve el código fuente de recursos estáticos al enviar una petición OPTIONS, en lugar de una petición GET. • https://zammad.com/news/security-advisory-zaa-2020-09 • CWE-552: Files or Directories Accessible to External Parties •
CVSS: 6.1EPSS: 0%CPEs: 3EXPL: 0CVE-2019-1010018
https://notcve.org/view.php?id=CVE-2019-1010018
Zammad GmbH Zammad 2.3.0 and earlier is affected by: Cross Site Scripting (XSS) - CWE-80. The impact is: Execute java script code on users browser. The component is: web app. The attack vector is: the victim must open a ticket. The fixed version is: 2.3.1, 2.2.2 and 2.1.3. • https://github.com/zammad/zammad/compare/5c983f6...1a9af7d https://github.com/zammad/zammad/compare/ea50d0c...238784d https://github.com/zammad/zammad/issues/1869 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2018-1000154
https://notcve.org/view.php?id=CVE-2018-1000154
Zammad GmbH Zammad version 2.3.0 and earlier contains a Improper Neutralization of Script-Related HTML Tags in a Web Page (CWE-80) vulnerability in the subject of emails which are not html quoted in certain cases. This can result in the embedding and execution of java script code on users browser. This attack appear to be exploitable via the victim openning a ticket. This vulnerability appears to have been fixed in 2.3.1, 2.2.2 and 2.1.3. Las versiones 2.3.0 y anteriores de Zammad GmbH Zammad contienen una vulnerabilidad de neutralización incorrecta de etiquetas HTML relacionadas con scripts en una página web (CWE-80) en el asunto de correos electrónicos que no están entrecomillados por HTML en ciertos casos. • https://github.com/zammad/zammad/issues/1869 https://zammad.com/news/release-2-4 https://zammad.com/news/security-advisory-zaa-2018-01 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.8EPSS: 0%CPEs: 5EXPL: 0CVE-2017-6081
https://notcve.org/view.php?id=CVE-2017-6081
A CSRF issue was discovered in Zammad before 1.0.4, 1.1.x before 1.1.3, and 1.2.x before 1.2.1. To exploit the vulnerability, an attacker can send cross-domain requests directly to the REST API for users with a valid session cookie. Se ha descubierto un problema de CSRF en Zammad en versiones anteriores a 1.0.4, 1.1.x en versiones anteriores a 1.1.3 y 1.2.x en versiones anteriores a 1.2.1. Para explotar esta vulnerabilidad, un atacante puede enviar peticiones entre dominios directamente a la API REST para usuarios con una cookie de sesión válida. • http://www.securityfocus.com/bid/96937 https://zammad.com/de/news/security-advisory-zaa-2017-01 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 6.1EPSS: 0%CPEs: 5EXPL: 0CVE-2017-5620
https://notcve.org/view.php?id=CVE-2017-5620
An XSS issue was discovered in Zammad before 1.0.4, 1.1.x before 1.1.3, and 1.2.x before 1.2.1. Attachments are opened in a new tab instead of getting downloaded. This creates an attack vector of executing code in the domain of the application. Se ha descubierto un problema de XSS en Zammad en versiones anteriores a 1.0.4, 1.1.x en versiones anteriores a 1.1.3 y 1.2.x en versiones anteriores a 1.2.1. Los archivos adjuntos se abren en una nueva pestaña en lugar de descargarse. • http://www.securityfocus.com/bid/96937 https://zammad.com/de/news/security-advisory-zaa-2017-01 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •