sit! support incident tracker 3.64 - Multiple Vulnerabilities

No description provided by source. Advisory Details: High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in SiT! Support Incident Tracker, which can be exploited to perform SQL injection, cross-site scripting, cross-site request forgery attacks. 1 Input passed via th...

Oracle Linux 5 : kernel (ELSA-2008-0612)

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2008-0612 advisory. - tty add NULL pointer checks Aristeu Rozanski 453425 453154 CVE-2008-2812 - net sctp: make sure sctpaddr does not overflow David S. Miller 452482 4524...

Scientific Linux Security Update : kernel on SL4.x i386/x86_64

These updated packages fix the following security issue : - a possible kernel memory leak was found in the Linux kernel Simple Internet Transition SIT INET6 implementation. This could allow a local unprivileged user to cause a denial of service. CVE-2008-2136, Important As well, these updated...

CVE-2012-2235

Cross-site scripting XSS vulnerability in Support Incident Tracker SiT! 3.65 and earlier allows remote attackers to inject arbitrary web script or HTML via the id parameter to index.php, which is not properly handled in an error message...

Cross site scripting

Cross-site scripting XSS vulnerability in Support Incident Tracker SiT! 3.65 and earlier allows remote attackers to inject arbitrary web script or HTML via the id parameter to index.php, which is not properly handled in an error message...

CVE-2012-2235

Cross-site scripting XSS vulnerability in Support Incident Tracker SiT! 3.65 and earlier allows remote attackers to inject arbitrary web script or HTML via the id parameter to index.php, which is not properly handled in an error message...

CVE-2012-2235

SiT! (Support Incident Tracker) is affected by a cross-site scripting (XSS) vulnerability in versions up to 3.65, triggered by the id parameter passed to index.php. The issue arises because the parameter is processed in an error message without proper sanitization, enabling remote attackers to in...

SuSE 10 Security Update : Linux kernel (ZYPP Patch Number 5370)

This kernel update fixes quite a number of security problems : - A remote attacker could crash the IPSec/IPv6 stack by sending a bad ESP packet. This requires the host to be able to receive such packets default filtered by the firewall. CVE-2007-6282 - A problem in SIT IPv6 tunnel handling could ...

sit! support incident tracker 3.64 - Multiple Vulnerabilities

Advisory Details: High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in SiT! Support Incident Tracker, which can be exploited to perform SQL injection, cross-site scripting, cross-site request forgery attacks. 1 Input passed via the "start" GET parameter to...

SiT! Support Incident Tracker 3.64 Multiple Vulnerabilities

Exploit for php platform in category web applications High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in SiT! Support Incident Tracker, which can be exploited to perform SQL injection, cross-site scripting, cross-site request forgery attacks. 1 Input passed via t...

CVE-2011-5072

Multiple SQL injection vulnerabilities in Support Incident Tracker aka SiT! before 3.65 allow remote attackers to execute arbitrary SQL commands via the 1 start parameter to portal/kb.php; 2 contractid parameter to contractaddservice.php; 3 id parameter to editescalationpath.php; 4 unlock, 5 lock...

CVE-2011-5074

Multiple cross-site request forgery CSRF vulnerabilities in Support Incident Tracker aka SiT! before 3.65 allow remote attackers to hijack the authentication of administrators for requests that change administrator email, add a new administrator, or insert arbitrary script via 1 userprofileedit.p...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Support Incident Tracker aka SiT! before 3.65 allow remote attackers to inject arbitrary web script or HTML via the 1 mode parameter to contactsupport.php; 2 contractid parameter to contractaddservice.php; 3 user parameter to editbackupusers.ph...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in Support Incident Tracker aka SiT! before 3.65 allow remote attackers to hijack the authentication of administrators for requests that change administrator email, add a new administrator, or insert arbitrary script via 1 userprofileedit.p...

Sql injection

Multiple SQL injection vulnerabilities in Support Incident Tracker aka SiT! before 3.65 allow remote attackers to execute arbitrary SQL commands via the 1 start parameter to portal/kb.php; 2 contractid parameter to contractaddservice.php; 3 id parameter to editescalationpath.php; 4 unlock, 5 lock...

CVE-2011-4337

The CVE affects Support Incident Tracker (SiT!) versions 3.45–3.65, where translate.php contains a static code injection flaw. An attacker can supply a crafted lang parameter to inject arbitrary PHP code into an executable language file within the i18n directory. The provided documents do not spe...

CVE-2011-5074

CVE-2011-5074 refers to multiple cross-site request forgery (CSRF) vulnerabilities in Support Incident Tracker (SiT!)

CVE-2011-5073

CVE-2011-5073 affects Support Incident Tracker (SiT!) prior to 3.65. It contains multiple cross-site scripting (XSS) vulnerabilities that allow remote attackers to inject arbitrary HTML/JavaScript via numerous parameters (e.g., mode, contractid, user, id, Referer, startdate/enddate, etc.) and cer...

CVE-2011-5074

Multiple cross-site request forgery CSRF vulnerabilities in Support Incident Tracker aka SiT! before 3.65 allow remote attackers to hijack the authentication of administrators for requests that change administrator email, add a new administrator, or insert arbitrary script via 1 userprofileedit.p...

CVE-2011-5075

CVE-2011-5075 affects Support Incident Tracker SiT! versions 3.45–3.65. The flaw is an information-disclosure via translate.php (save action) that allows remote attackers to reveal the installation path. Connected sources corroborate an installation-path exposure; OpenVAS and RH advisories note b...