CVE-2020-9300

The Access Control issues include allowing a regular user to view a restricted incident, user role escalation to admin, users adding themselves as a participant in a restricted incident, and users able to view restricted incidents via the search feature. If your install has followed the secure...

CVE-2020-15308

Support Incident Tracker aka SiT! or SiTracker 3.67 p2 allows post-authentication SQL injection via the siteedit.php typeid or site parameter, the searchincidentsadvanced.php searchtitle parameter, or the reportqbe.php criteriafield parameter...

CVE-2020-15308

Support Incident Tracker aka SiT! or SiTracker 3.67 p2 allows post-authentication SQL injection via the siteedit.php typeid or site parameter, the searchincidentsadvanced.php searchtitle parameter, or the reportqbe.php criteriafield parameter...

PT-2020-14346

Name of the Vulnerable Software and Affected Versions Support Incident Tracker aka SiT! or SiTracker version 3.67 p2 Description The issue allows post-authentication SQL injection via several parameters, including typeid or site in "site edit.php", search title in "search incidents advanced.php",...

Cross site scripting

In Support Incident Tracker SiT! 3.67, the searchid parameter in the searchincidentsadvanced.php page is affected by XSS...

Support Incident Tracker Cross-Site Scripting Vulnerability (CNVD-2020-04719)

Support Incident Tracker SiT! is a PHP and MySQL based technical support phone/email tracking system. A cross-site scripting vulnerability exists in the 'searchid' parameter of the searchincidentsadvanced.php page in SiT! version 3.67, which stems from the lack of proper validation of client-side...