Itop
by Combodo
CVEs (68)
| CVE | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2020-15218 | 0.00 | — | 0.00 | Jan 13, 2021 | Combodo iTop is a web based IT Service Management tool. In iTop before versions 2.7.2 and 3.0.0, admin pages are cached, so that their content is visible after deconnection by using the browser back button. This is fixed in versions 2.7.2 and 3.0.0. | ||
| CVE-2020-4079 | 0.00 | — | 0.00 | Jan 12, 2021 | Combodo iTop is a web based IT Service Management tool. In iTop before versions 2.7.2 and 2.8.0, when the ajax endpoint for the "excel export" portal functionality is called directly it allows getting data without scope filtering. This allows a user to access data they which they should not have access to. This is fixed in versions 2.7.2 and 3.0.0. | ||
| CVE-2020-12781 | 0.00 | — | 0.00 | Aug 10, 2020 | Combodo iTop contains a cross-site request forgery (CSRF) vulnerability, attackers can execute specific commands via malicious site request forgery. | ||
| CVE-2020-12780 | 0.00 | — | 0.00 | Aug 10, 2020 | A security misconfiguration exists in Combodo iTop, which can expose sensitive information. | ||
| CVE-2020-12779 | 0.00 | — | 0.00 | Aug 10, 2020 | Combodo iTop contains a stored Cross-site Scripting vulnerability, which can be attacked by uploading file with malicious script. | ||
| CVE-2020-12778 | 0.00 | — | 0.00 | Aug 10, 2020 | Combodo iTop does not validate inputted parameters, attackers can inject malicious commands and launch XSS attack. | ||
| CVE-2020-12777 | 0.00 | — | 0.00 | Aug 10, 2020 | A function in Combodo iTop contains a vulnerability of Broken Access Control, which allows unauthorized attacker to inject command and disclose system information. | ||
| CVE-2013-0805 | 0.00 | — | 0.00 | Mar 20, 2014 | Multiple cross-site scripting (XSS) vulnerabilities in the search feature in iTop (aka IT Operations Portal) 2.0, 1.2.1, 1.2, and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) text parameter to pages/UI.php or (2) expression parameter to pages/run_query.php. NOTE: some of these details are obtained from third party information. |
- CVE-2020-15218Jan 13, 2021risk 0.00cvss —epss 0.00
Combodo iTop is a web based IT Service Management tool. In iTop before versions 2.7.2 and 3.0.0, admin pages are cached, so that their content is visible after deconnection by using the browser back button. This is fixed in versions 2.7.2 and 3.0.0.
- CVE-2020-4079Jan 12, 2021risk 0.00cvss —epss 0.00
Combodo iTop is a web based IT Service Management tool. In iTop before versions 2.7.2 and 2.8.0, when the ajax endpoint for the "excel export" portal functionality is called directly it allows getting data without scope filtering. This allows a user to access data they which they should not have access to. This is fixed in versions 2.7.2 and 3.0.0.
- CVE-2020-12781Aug 10, 2020risk 0.00cvss —epss 0.00
Combodo iTop contains a cross-site request forgery (CSRF) vulnerability, attackers can execute specific commands via malicious site request forgery.
- CVE-2020-12780Aug 10, 2020risk 0.00cvss —epss 0.00
A security misconfiguration exists in Combodo iTop, which can expose sensitive information.
- CVE-2020-12779Aug 10, 2020risk 0.00cvss —epss 0.00
Combodo iTop contains a stored Cross-site Scripting vulnerability, which can be attacked by uploading file with malicious script.
- CVE-2020-12778Aug 10, 2020risk 0.00cvss —epss 0.00
Combodo iTop does not validate inputted parameters, attackers can inject malicious commands and launch XSS attack.
- CVE-2020-12777Aug 10, 2020risk 0.00cvss —epss 0.00
A function in Combodo iTop contains a vulnerability of Broken Access Control, which allows unauthorized attacker to inject command and disclose system information.
- CVE-2013-0805Mar 20, 2014risk 0.00cvss —epss 0.00
Multiple cross-site scripting (XSS) vulnerabilities in the search feature in iTop (aka IT Operations Portal) 2.0, 1.2.1, 1.2, and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) text parameter to pages/UI.php or (2) expression parameter to pages/run_query.php. NOTE: some of these details are obtained from third party information.
Page 4 of 4