Most recent entries from all https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 16 Oct 2026 12:09:20 +0000 cnvd-2022-66765 https://cve.radiocsirt.org/vuln/cnvd-2022-66765 cnvd-2022-66765 https://cve.radiocsirt.org/vuln/cnvd-2022-66765 EUVD-2026-240655 https://cve.radiocsirt.org/vuln/euvd-2026-240655 EUVD-2026-240655 https://cve.radiocsirt.org/vuln/euvd-2026-240655 fkie_cve-2022-40816 https://cve.radiocsirt.org/vuln/fkie_cve-2022-40816 <p>Zammad 5.2.1 is vulnerable to Incorrect Access Control. Zammad&#39;s asset handling mechanism has logic to ensure that customer users are not able to see personal information of other users. This logic was not effective when used through a web socket connection, so that a logged-in attacker would be able to fetch personal data of other users by querying the Zammad API. This issue is fixed in , 5.2.2.</p> <p>Zammad 5.2.1 is vulnerable to Incorrect Access Control. Zammad&#39;s asset handling mechanism has logic to ensure that customer users are not able to see personal information of other users. This logic was not effective when used through a web socket connection, so that a logged-in attacker would be able to fetch personal data of other users by querying the Zammad API. This issue is fixed in , 5.2.2.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2022-40816 GHSA-gwqr-42v8-7m7q https://cve.radiocsirt.org/vuln/ghsa-gwqr-42v8-7m7q <p>Zammad 5.2.1 is vulnerable to Incorrect Access Control. Zammad&#39;s asset handling mechanism has logic to ensure that customer users are not able to see personal information of other users. This logic was not effective when used through a web socket connection, so that a logged-in attacker would be able to fetch personal data of other users by querying the Zammad API. This issue is fixed in , 5.2.2.</p> <p>Zammad 5.2.1 is vulnerable to Incorrect Access Control. Zammad&#39;s asset handling mechanism has logic to ensure that customer users are not able to see personal information of other users. This logic was not effective when used through a web socket connection, so that a logged-in attacker would be able to fetch personal data of other users by querying the Zammad API. This issue is fixed in , 5.2.2.</p> https://cve.radiocsirt.org/vuln/ghsa-gwqr-42v8-7m7q gsd-2022-40816 https://cve.radiocsirt.org/vuln/gsd-2022-40816 gsd-2022-40816 https://cve.radiocsirt.org/vuln/gsd-2022-40816