5 matches found
CVE-2017-18486
Jitbit Helpdesk before 9.0.3 allows remote attackers to escalate privileges because of mishandling of the User/AutoLogin userHash parameter. By inspecting the token value provided in a password reset link, a user can leverage a weak PRNG to recover the shared secret used by the server for remote...
CVE-2019-18486
CVE-2019-18486 entry is rejected/not used per the Initial Description.
CVE-2017-18486
Jitbit Helpdesk (before 9.0.3) is affected by an authentication flaw tied to mishandling of the User/AutoLogin userHash parameter. Tokens in a password-reset flow can be studied to reveal a weak PRNG-derived shared secret used for remote authentication, enabling an attacker to forge tokens for an...
CVE-2018-18486
PHPSHE 1.7 is affected by a SQL injection in the admin.php?mod=user&act=del script, exploitable via the user_id[] parameter. The vulnerability permits remote attackers to execute arbitrary SQL commands. This is documented across multiple sources (e.g., CNVD-2018-21603, NVD CVE-2018-18486). No rem...