Serena TeamTrack 6.1.1 allows remote attackers to obtain sensitive information such as user names versions and database information and conduct cross-site scripting (XSS) attacks via a direct request to tmtrack.dll with modified LoginPage and Template parameters.