Description

Enhancesoft osTicket before 1.10.2 allows remote attackers to reset arbitrary passwords (when an associated e-mail address is known) by leveraging guest access and guessing a 6-digit number.

Remediation

References

CVE-2018-7195

Related Vulnerabilities

MySQL CVE-2012-0102 Vulnerability (CVE-2012-0102)

PHP Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability (CVE-2010-3064)

Joomla Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2018-15880)

WebLogic Server-Side Request Forgery (SSRF) Vulnerability (CVE-2020-11987)

WordPress Plugin FV Flowplayer Video Player Cross-Site Scripting (6.6.4)

Severity

High

Classification

CVE-2018-7195 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Missing Update Known Vulnerabilities