CVE-2011-5075

CVE-2011-5075 affects Support Incident Tracker SiT! versions 3.45–3.65. The flaw is an information-disclosure via translate.php (save action) that allows remote attackers to reveal the installation path. Connected sources corroborate an installation-path exposure; OpenVAS and RH advisories note b...

CVE-2011-5072

Multiple SQL injection vulnerabilities in Support Incident Tracker aka SiT! before 3.65 allow remote attackers to execute arbitrary SQL commands via the 1 start parameter to portal/kb.php; 2 contractid parameter to contractaddservice.php; 3 id parameter to editescalationpath.php; 4 unlock, 5 lock...

CVE-2011-5072

Support Incident Tracker (SiT!)

CVE-2011-5068

Multiple cross-site request forgery CSRF vulnerabilities in Support Incident Tracker aka SiT! 3.65 allow remote attackers to hijack the authentication of user for requests that delete a user via userdelete.php and other unspecified programs...

Cross site scripting

Cross-site scripting XSS vulnerability in search.php in Support Incident Tracker aka SiT! 3.65 allows remote attackers to inject arbitrary web script or HTML via the searchstring parameter...

Information disclosure

ftpuploadfile.php in Support Incident Tracker aka SiT! 3.65 allows remote authenticated users to obtain sensitive information via the file name, which reveals the installation path in an error message...

Unrestricted file upload

Unrestricted file upload vulnerability in ftpuploadfile.php in Support Incident Tracker aka SiT! 3.65 allows remote authenticated users to execute arbitrary PHP code by uploading a PHP file, then accessing it via a direct request to the file in an unspecified directory...

Design/Logic Flaw

Eval injection vulnerability in config.php in Support Incident Tracker aka SiT! 3.65 allows remote authenticated administrators to execute arbitrary PHP code via the applicationname parameter in a save action...

Information disclosure

moveuploadedfile.php in Support Incident Tracker aka SiT! 3.65 allows remote authenticated users to obtain sensitive information via the file name, which reveals the installation path in an error message...

Unrestricted file upload

Unrestricted file upload vulnerability in incidentattachments.php in Support Incident Tracker aka SiT! 3.65 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in unspecified directory, a...

CVE-2011-5071

Support Incident Tracker (SiT!) is affected by multiple SQL injection vulnerabilities in versions prior to 3.64 (and cited remotely as SiT!

CVE-2011-3830

CVE-2011-3830 affects Support Incident Tracker (SiT!) 3.65, where an XSS flaw exists in search.php via the search_string parameter, enabling remote injection of arbitrary script/HTML. Root cause is insufficient input validation on the search_string field, as reported in the NVD entry. Exploitatio...

CVE-2011-5068

Multiple cross-site request forgery CSRF vulnerabilities in Support Incident Tracker aka SiT! 3.65 allow remote attackers to hijack the authentication of user for requests that delete a user via userdelete.php and other unspecified programs...

CVE-2011-5069

Unrestricted file upload vulnerability in incidentattachments.php in Support Incident Tracker aka SiT! 3.65 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in unspecified directory, a...

CVE-2011-5067

CVE-2011-5067 affects Support Incident Tracker (SiT!) 3.65. The vulnerability is in the move_uploaded_file.php component, where remote authenticated users can disclose the installation path by an error message that includes the file name. The documented impact is partial information disclosure; n...

CVE-2011-5068

CVE-2011-5068 affects Support Incident Tracker (SiT!) version 3.65, with multiple CSRF vulnerabilities that allow remote attackers to hijack a user’s authenticated session for actions such as deleting a user via user_delete.php and other unspecified programs. The connected documents confirm the v...

CVE-2011-5069

CVE-2011-5069 is an Unrestricted file upload vulnerability in Support Incident Tracker (SiT!) 3.65, specifically in incident_attachments.php. The issue allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension and then accessing it via a direct r...

CVE-2011-3833

CVE-2011-3833 affects Support Incident Tracker (SiT!) 3.65, with an Unrestricted file upload in ftp_upload_file.php. The root cause is that remote authenticated users can upload a PHP file and access it via a direct request to that file in an unspecified directory, enabling arbitrary code executi...

CVE-2011-5070

CVE-2011-5070: Several XSS vulnerabilities in Support Incident Tracker (SiT!) 3.65 allow remote attackers to inject arbitrary web script/HTML via (1) incident_attachments.php file name, (2) vectors in link_add.php (origref, linkref, linktype) or the redirect parameter in html_redirect, and (3) tr...

CVE-2011-3831

CVE-2011-3831 affects Support Incident Tracker (SiT!) 3.65. The vulnerability is an SQL injection in incident_attachments.php that allows remote attackers to execute arbitrary SQL commands via an uploaded file with a crafted file name. This is documented across multiple sources (NVD/NVD listing, ...