Cross site scripting

Cross-site scripting XSS vulnerability in /ajax.php/form/help-topic in Enhancesoft osTicket before 1.10.2 allows remote attackers to inject arbitrary web script or HTML via the "message" parameter...

CVE-2018-7194

Integer format vulnerability in the ticket number generator in Enhancesoft osTicket before 1.10.2 allows remote attackers to cause a denial-of-service preventing the creation of new tickets via a large number of digits in the ticket number format setting...

CVE-2018-7192

Cross-site scripting XSS vulnerability in /ajax.php/form/help-topic in Enhancesoft osTicket before 1.10.2 allows remote attackers to inject arbitrary web script or HTML via the "message" parameter...

CVE-2018-7193

Cross-site scripting XSS vulnerability in /scp/directory.php in Enhancesoft osTicket before 1.10.2 allows remote attackers to inject arbitrary web script or HTML via the "order" parameter...

CVE-2018-7196

Cross-site scripting XSS vulnerability in /scp/index.php in Enhancesoft osTicket before 1.10.2 allows remote attackers to inject arbitrary web script or HTML via the "sort" parameter...

CVE-2018-7196

Summary: CVE-2018-7196 is a cross-site scripting (XSS) vulnerability in osTicket before 1.10.2, exploitable via the sort parameter in /scp/index.php. Affected product/version: osTicket prior to 1.10.2. Root cause / vector: Malicious input to the sort parameter allows injection of arbitrary JavaSc...

CVE-2018-7195

CVE-2018-7195 concerns Enhancesoft osTicket before 1.10.2. The issue allows a remote attacker to reset arbitrary passwords (when an associated e‑mail address is known) by exploiting guest access and guessing a 6‑digit number. Public sources in the connected documents consistently describe this as...

CVE-2018-7192

osTicket

CVE-2018-7194

Integer format vulnerability in the ticket number generator in Enhancesoft osTicket before 1.10.2 allows remote attackers to cause a denial-of-service preventing the creation of new tickets via a large number of digits in the ticket number format setting...

CVE-2018-7192

Cross-site scripting XSS vulnerability in /ajax.php/form/help-topic in Enhancesoft osTicket before 1.10.2 allows remote attackers to inject arbitrary web script or HTML via the "message" parameter...

CVE-2018-7195

Enhancesoft osTicket before 1.10.2 allows remote attackers to reset arbitrary passwords when an associated e-mail address is known by leveraging guest access and guessing a 6-digit number...

CVE-2018-7194

CVE-2018-7194 affects Enhancesoft osTicket up to version 1.10.1. The vulnerability is an integer format issue in the ticket number generator that allows a remote attacker to trigger a denial of service by sending a ticket creation request with a very large number of digits in the ticket number fo...

Enhancesoft osTicket Session Fixation Vulnerability

Enhancesoft osTicket is a free and lightweight PHP-based question return system from Enhancesoft, USA. The system supports e-mail queries and more. A session fixation vulnerability exists in Enhancesoft osTicket. An attacker can vulnerability hijack a session to perform unauthorized access...

Enhancesoft osTicket Unauthorized Access Vulnerability

Enhancesoft osTicket is a free and lightweight PHP-based question return system from Enhancesoft, USA. The system supports e-mail queries and more. An unauthorized access vulnerability exists in Enhancesoft osTicket. An attacker can bypass the authentication mechanism and gain unauthorized access...

Enhancesoft osTicket Arbitrary File Upload Vulnerability

Enhancesoft osTicket is a free and lightweight PHP-based question return system from Enhancesoft, USA. The system supports e-mail queries and more. An arbitrary file upload vulnerability exists in Enhancesoft osTicket. An attacker can exploit the vulnerability to upload and execute arbitrary...