Itop
by Combodo
Source repositories
CVEs (77)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2021-21406 | 0.00 | — | 0.01 | Jul 21, 2021 | Combodo iTop is an open source, web based IT Service Management tool. In versions prior to 2.7.4, there is a command injection vulnerability in the Setup Wizard when providing Graphviz executable path. The vulnerability is patched in version 2.7.4 and 3.0.0. | |||
| CVE-2020-15221 | 0.00 | — | 0.01 | Jan 13, 2021 | Combodo iTop is a web based IT Service Management tool. In iTop before versions 2.7.2 and 3.0.0, by modifying target browser local storage, an XSS can be generated in the iTop console breadcrumb. This is fixed in versions 2.7.2 and 3.0.0. | |||
| CVE-2020-15220 | 0.00 | — | 0.01 | Jan 13, 2021 | Combodo iTop is a web based IT Service Management tool. In iTop before versions 2.7.2 and 3.0.0, two cookies are created for the same session, which leads to a possibility to steal user session. This is fixed in versions 2.7.2 and 3.0.0. | |||
| CVE-2020-15219 | 0.00 | — | 0.01 | Jan 13, 2021 | Combodo iTop is a web based IT Service Management tool. In iTop before versions 2.7.2 and 3.0.0, when a download error is triggered in the user portal, an SQL query is displayed to the user. This is fixed in versions 2.7.2 and 3.0.0. | |||
| CVE-2020-15218 | 0.00 | — | 0.01 | Jan 13, 2021 | Combodo iTop is a web based IT Service Management tool. In iTop before versions 2.7.2 and 3.0.0, admin pages are cached, so that their content is visible after deconnection by using the browser back button. This is fixed in versions 2.7.2 and 3.0.0. | |||
| CVE-2020-4079 | 0.00 | — | 0.01 | Jan 12, 2021 | Combodo iTop is a web based IT Service Management tool. In iTop before versions 2.7.2 and 2.8.0, when the ajax endpoint for the "excel export" portal functionality is called directly it allows getting data without scope filtering. This allows a user to access data they which… | |||
| CVE-2020-12781 | 0.00 | — | 0.00 | Aug 10, 2020 | Combodo iTop contains a cross-site request forgery (CSRF) vulnerability, attackers can execute specific commands via malicious site request forgery. | |||
| CVE-2020-12780 | 0.00 | — | 0.01 | Aug 10, 2020 | A security misconfiguration exists in Combodo iTop, which can expose sensitive information. | |||
| CVE-2020-12779 | 0.00 | — | 0.01 | Aug 10, 2020 | Combodo iTop contains a stored Cross-site Scripting vulnerability, which can be attacked by uploading file with malicious script. | |||
| CVE-2020-12778 | 0.00 | — | 0.01 | Aug 10, 2020 | Combodo iTop does not validate inputted parameters, attackers can inject malicious commands and launch XSS attack. | |||
| CVE-2020-12777 | 0.00 | — | 0.01 | Aug 10, 2020 | A function in Combodo iTop contains a vulnerability of Broken Access Control, which allows unauthorized attacker to inject command and disclose system information. | |||
| CVE-2020-11696 | 0.00 | — | 0.01 | Jun 5, 2020 | In Combodo iTop a menu shortcut name can be exploited with a stored XSS payload. This is fixed in all iTop packages (community, essential, professional) in version 2.7.0 and iTop essential and iTop professional in version 2.6.4. | |||
| CVE-2020-11697 | 0.00 | — | 0.01 | Jun 5, 2020 | In Combodo iTop, dashboard ids can be exploited with a reflective XSS payload. This is fixed in all iTop packages (community, essential, professional) for version 2.7.0 and in iTop essential and iTop professional packages for version 2.6.4. | |||
| CVE-2019-19821 | 0.00 | — | 0.01 | Mar 16, 2020 | A post-authentication privilege escalation in the web application of Combodo iTop allows regular authenticated users to access information and modify information with administrative privileges by not following the HTTP Location header in server responses. This is fixed in all… | |||
| CVE-2019-13967 | 0.00 | — | 0.01 | Feb 14, 2020 | iTop 2.2.0 through 2.6.0 allows remote attackers to cause a denial of service (application outage) via many requests to launch a compile operation. The requests use the pages/exec.php?exec_env=production&exec_module=itop-hub-connector&exec_page=ajax.php&operation=compile URI.… | |||
| CVE-2019-11215 | 0.00 | — | 0.01 | Feb 14, 2020 | In Combodo iTop 2.2.0 through 2.6.0, if the configuration file is writable, then execution of arbitrary code can be accomplished by calling ajax.dataloader with a maliciously crafted payload. Many conditions can place the configuration file into a writable state: during… | |||
| CVE-2013-0805 | 0.00 | — | 0.02 | Mar 20, 2014 | Multiple cross-site scripting (XSS) vulnerabilities in the search feature in iTop (aka IT Operations Portal) 2.0, 1.2.1, 1.2, and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) text parameter to pages/UI.php or (2) expression parameter to… |
- CVE-2021-21406Jul 21, 2021risk 0.00cvss —epss 0.01
Combodo iTop is an open source, web based IT Service Management tool. In versions prior to 2.7.4, there is a command injection vulnerability in the Setup Wizard when providing Graphviz executable path. The vulnerability is patched in version 2.7.4 and 3.0.0.
- CVE-2020-15221Jan 13, 2021risk 0.00cvss —epss 0.01
Combodo iTop is a web based IT Service Management tool. In iTop before versions 2.7.2 and 3.0.0, by modifying target browser local storage, an XSS can be generated in the iTop console breadcrumb. This is fixed in versions 2.7.2 and 3.0.0.
- CVE-2020-15220Jan 13, 2021risk 0.00cvss —epss 0.01
Combodo iTop is a web based IT Service Management tool. In iTop before versions 2.7.2 and 3.0.0, two cookies are created for the same session, which leads to a possibility to steal user session. This is fixed in versions 2.7.2 and 3.0.0.
- CVE-2020-15219Jan 13, 2021risk 0.00cvss —epss 0.01
Combodo iTop is a web based IT Service Management tool. In iTop before versions 2.7.2 and 3.0.0, when a download error is triggered in the user portal, an SQL query is displayed to the user. This is fixed in versions 2.7.2 and 3.0.0.
- CVE-2020-15218Jan 13, 2021risk 0.00cvss —epss 0.01
Combodo iTop is a web based IT Service Management tool. In iTop before versions 2.7.2 and 3.0.0, admin pages are cached, so that their content is visible after deconnection by using the browser back button. This is fixed in versions 2.7.2 and 3.0.0.
- CVE-2020-4079Jan 12, 2021risk 0.00cvss —epss 0.01
Combodo iTop is a web based IT Service Management tool. In iTop before versions 2.7.2 and 2.8.0, when the ajax endpoint for the "excel export" portal functionality is called directly it allows getting data without scope filtering. This allows a user to access data they which…
- CVE-2020-12781Aug 10, 2020risk 0.00cvss —epss 0.00
Combodo iTop contains a cross-site request forgery (CSRF) vulnerability, attackers can execute specific commands via malicious site request forgery.
- CVE-2020-12780Aug 10, 2020risk 0.00cvss —epss 0.01
A security misconfiguration exists in Combodo iTop, which can expose sensitive information.
- CVE-2020-12779Aug 10, 2020risk 0.00cvss —epss 0.01
Combodo iTop contains a stored Cross-site Scripting vulnerability, which can be attacked by uploading file with malicious script.
- CVE-2020-12778Aug 10, 2020risk 0.00cvss —epss 0.01
Combodo iTop does not validate inputted parameters, attackers can inject malicious commands and launch XSS attack.
- CVE-2020-12777Aug 10, 2020risk 0.00cvss —epss 0.01
A function in Combodo iTop contains a vulnerability of Broken Access Control, which allows unauthorized attacker to inject command and disclose system information.
- CVE-2020-11696Jun 5, 2020risk 0.00cvss —epss 0.01
In Combodo iTop a menu shortcut name can be exploited with a stored XSS payload. This is fixed in all iTop packages (community, essential, professional) in version 2.7.0 and iTop essential and iTop professional in version 2.6.4.
- CVE-2020-11697Jun 5, 2020risk 0.00cvss —epss 0.01
In Combodo iTop, dashboard ids can be exploited with a reflective XSS payload. This is fixed in all iTop packages (community, essential, professional) for version 2.7.0 and in iTop essential and iTop professional packages for version 2.6.4.
- CVE-2019-19821Mar 16, 2020risk 0.00cvss —epss 0.01
A post-authentication privilege escalation in the web application of Combodo iTop allows regular authenticated users to access information and modify information with administrative privileges by not following the HTTP Location header in server responses. This is fixed in all…
- CVE-2019-13967Feb 14, 2020risk 0.00cvss —epss 0.01
iTop 2.2.0 through 2.6.0 allows remote attackers to cause a denial of service (application outage) via many requests to launch a compile operation. The requests use the pages/exec.php?exec_env=production&exec_module=itop-hub-connector&exec_page=ajax.php&operation=compile URI.…
- CVE-2019-11215Feb 14, 2020risk 0.00cvss —epss 0.01
In Combodo iTop 2.2.0 through 2.6.0, if the configuration file is writable, then execution of arbitrary code can be accomplished by calling ajax.dataloader with a maliciously crafted payload. Many conditions can place the configuration file into a writable state: during…
- CVE-2013-0805Mar 20, 2014risk 0.00cvss —epss 0.02
Multiple cross-site scripting (XSS) vulnerabilities in the search feature in iTop (aka IT Operations Portal) 2.0, 1.2.1, 1.2, and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) text parameter to pages/UI.php or (2) expression parameter to…
Page 4 of 4