Zendesk's vulnerability profile centers on its customer-engagement and support platform, with disclosures clustering around its encryption vault, API layers, and authentication components. The recurring weakness classes involve input validation, cross-site scripting, and improper authentication-attempt handling, reflecting the attack surface of web-facing service integrations and credential-handling mechanisms. Current exploitation activity and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Zendesk over time
Signals from CVEs in this vendor scope (3 CVEs).
3 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2021-36750HIGH ENC DataVault before 7.2 and VaultAPI v67 mishandle key derivation, making it easier for attackers to determine the passwords of all DataVault users (across USB drives sold under m | Dec 22, 2021 | 8.1 | 33 | NO | NO |
CVE-2018-20857HIGH Zendesk Samlr before 2.6.2 allows an XML nodes comment attack such as a name_id node with [email protected] followed by <!---->. and then the attacker's domain name. | Jul 26, 2019 | 7.5 | 24 | NO | NO |
Cross-site scripting (XSS) vulnerability in the Zendesk Feedback Tab module 7.x-1.x before 7.x-1.1 for Drupal allows remote administrators with the "Configure Zendesk Feedback Tab" | Sep 11, 2015 | 2.6 | 12 | NO | NO |
Signals from CVEs in this vendor scope (3 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Zendesk.
Media articles that mention a CVE ID that affects a product developed by Zendesk — matched by CVE ID, not by vendor name.