Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in Support Incident Tracker aka SiT! 3.65 allow remote attackers to hijack the authentication of user for requests that delete a user via userdelete.php and other unspecified programs...

Design/Logic Flaw

Eval injection vulnerability in config.php in Support Incident Tracker aka SiT! 3.65 allows remote authenticated administrators to execute arbitrary PHP code via the applicationname parameter in a save action...

Sql injection

SQL injection vulnerability in incidentattachments.php in Support Incident Tracker aka SiT! 3.65 allows remote attackers to execute arbitrary SQL commands via an uploaded file with a crafted file name...

CVE-2011-5069

Unrestricted file upload vulnerability in incidentattachments.php in Support Incident Tracker aka SiT! 3.65 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in unspecified directory, a...

CVE-2011-5068

Multiple cross-site request forgery CSRF vulnerabilities in Support Incident Tracker aka SiT! 3.65 allow remote attackers to hijack the authentication of user for requests that delete a user via userdelete.php and other unspecified programs...

CVE-2011-5067

moveuploadedfile.php in Support Incident Tracker aka SiT! 3.65 allows remote authenticated users to obtain sensitive information via the file name, which reveals the installation path in an error message...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Support Incident Tracker aka SiT! 3.65 allow remote attackers to inject arbitrary web script or HTML via 1 the file name to incidentattachments.php; 2 unspecified vectors in linkadd.php, possibly involving origref, linkref, linktype parameters,...

Information disclosure

ftpuploadfile.php in Support Incident Tracker aka SiT! 3.65 allows remote authenticated users to obtain sensitive information via the file name, which reveals the installation path in an error message...

CVE-2011-3831

CVE-2011-3831 affects Support Incident Tracker (SiT!) 3.65. The vulnerability is an SQL injection in incident_attachments.php that allows remote attackers to execute arbitrary SQL commands via an uploaded file with a crafted file name. This is documented across multiple sources (NVD/NVD listing, ...

CVE-2011-5067

CVE-2011-5067 affects Support Incident Tracker (SiT!) 3.65. The vulnerability is in the move_uploaded_file.php component, where remote authenticated users can disclose the installation path by an error message that includes the file name. The documented impact is partial information disclosure; n...

CVE-2011-5070

CVE-2011-5070: Several XSS vulnerabilities in Support Incident Tracker (SiT!) 3.65 allow remote attackers to inject arbitrary web script/HTML via (1) incident_attachments.php file name, (2) vectors in link_add.php (origref, linkref, linktype) or the redirect parameter in html_redirect, and (3) tr...

CVE-2011-5071

Multiple SQL injection vulnerabilities in Support Incident Tracker aka SiT! before 3.64 allow remote attackers to execute arbitrary SQL commands via the 1 exc parameter to reportmarketing.php, 2 selected parameter to tasks.php, 3 sites parameter to billableincidents.php, or 4 searchstring paramet...

CVE-2011-5070

Multiple cross-site scripting XSS vulnerabilities in Support Incident Tracker aka SiT! 3.65 allow remote attackers to inject arbitrary web script or HTML via 1 the file name to incidentattachments.php; 2 unspecified vectors in linkadd.php, possibly involving origref, linkref, linktype parameters,...

CVE-2011-3829

CVE-2011-3829 affects Support Incident Tracker (SiT!)

CVE-2011-3833

CVE-2011-3833 affects Support Incident Tracker (SiT!) 3.65, with an Unrestricted file upload in ftp_upload_file.php. The root cause is that remote authenticated users can upload a PHP file and access it via a direct request to that file in an unspecified directory, enabling arbitrary code executi...

CVE-2011-5071

Support Incident Tracker (SiT!) is affected by multiple SQL injection vulnerabilities in versions prior to 3.64 (and cited remotely as SiT!

CVE-2011-3831

SQL injection vulnerability in incidentattachments.php in Support Incident Tracker aka SiT! 3.65 allows remote attackers to execute arbitrary SQL commands via an uploaded file with a crafted file name...

CVE-2011-3833

Unrestricted file upload vulnerability in ftpuploadfile.php in Support Incident Tracker aka SiT! 3.65 allows remote authenticated users to execute arbitrary PHP code by uploading a PHP file, then accessing it via a direct request to the file in an unspecified directory...

CVE-2011-3829

ftpuploadfile.php in Support Incident Tracker aka SiT! 3.65 allows remote authenticated users to obtain sensitive information via the file name, which reveals the installation path in an error message...

CVE-2011-5069

CVE-2011-5069 is an Unrestricted file upload vulnerability in Support Incident Tracker (SiT!) 3.65, specifically in incident_attachments.php. The issue allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension and then accessing it via a direct r...