Vulnerabilities > Zammad

DATE CVE VULNERABILITY TITLE RISK
2022-04-27 CVE-2022-27331 Exposure of Resource to Wrong Sphere vulnerability in Zammad
An access control issue in Zammad v5.0.3 broadcasts administrative configuration changes to all users who have an active application instance, including settings that should only be visible to authenticated users.
network
low complexity
zammad CWE-668
4.0
2022-04-27 CVE-2022-27332 Exposure of Resource to Wrong Sphere vulnerability in Zammad
An access control issue in Zammad v5.0.3 allows attackers to write entries to the CTI caller log without authentication.
network
zammad CWE-668
5.8
2022-04-27 CVE-2022-29700 Weak Password Requirements vulnerability in Zammad 5.1.0
A lack of password length restriction in Zammad v5.1.0 allows for the creation of extremely long passwords which can cause a Denial of Service (DoS) during password verification.
network
low complexity
zammad CWE-521
5.0
2022-04-27 CVE-2022-29701 Allocation of Resources Without Limits or Throttling vulnerability in Zammad 5.1.0
A lack of rate limiting in the 'forgot password' feature of Zammad v5.1.0 allows attackers to send an excessive amount of reset requests for a legitimate user, leading to a possible Denial of Service (DoS) via a large amount of generated e-mail messages.
network
low complexity
zammad CWE-770
5.0
2022-02-04 CVE-2021-43145 Incorrect Authorization vulnerability in Zammad 5.0.1
With certain LDAP configurations, Zammad 5.0.1 was found to be vulnerable to unauthorized access with existing user accounts.
network
low complexity
zammad CWE-863
5.5
2022-02-04 CVE-2021-44886 Exposure of Resource to Wrong Sphere vulnerability in Zammad 5.0.2
In Zammad 5.0.2, agents can configure "out of office" periods and substitute persons.
network
low complexity
zammad CWE-668
5.0
2021-10-11 CVE-2021-42137 Improper Privilege Management vulnerability in Zammad
An issue was discovered in Zammad before 5.0.1.
network
low complexity
zammad CWE-269
5.0
2021-10-07 CVE-2021-42084 Infinite Loop vulnerability in Zammad
An issue was discovered in Zammad before 4.1.1.
network
low complexity
zammad CWE-835
4.0
2021-10-07 CVE-2021-42085 Cross-site Scripting vulnerability in Zammad
An issue was discovered in Zammad before 4.1.1.
network
zammad CWE-79
3.5
2021-10-07 CVE-2021-42086 Improper Privilege Management vulnerability in Zammad
An issue was discovered in Zammad before 4.1.1.
network
low complexity
zammad CWE-269
6.5