CVE-2023-48709

CVE-2023-48709 – iTop formula/CSV export vulnerability : Combodo iTop exports data to CSV/Excel; inputs in exported files may contain malicious formulas. If opened in Excel, this could lead to remote code execution (noted for Excel 2016). Affected versions are iTop prior to the fixed releases. Re...

CVE-2023-47622 iTop vulnerable to XSS vulnerability in dashlet refresh

iTop is an IT service management platform. When dashlet are refreshed, XSS attacks are possible. This vulnerability is fixed in 3.0.4 and 3.1.1...

CVE-2023-47622 iTop vulnerable to XSS vulnerability in dashlet refresh

iTop is an IT service management platform. When dashlet are refreshed, XSS attacks are possible. This vulnerability is fixed in 3.0.4 and 3.1.1...

CVE-2023-47622 iTop vulnerable to XSS vulnerability in dashlet refresh

iTop is an IT service management platform. When dashlet are refreshed, XSS attacks are possible. This vulnerability is fixed in 3.0.4 and 3.1.1...

CVE-2023-38511

iTop is an IT service management platform. Dashboard editor : can load multiple files and URL, and full path disclosure on dashboard config file. This vulnerability is fixed in 3.0.4 and 3.1.1...

CVE-2023-38511 iTop Dashboard editor vulnerable dashboard config file parameter

iTop is an IT service management platform. Dashboard editor : can load multiple files and URL, and full path disclosure on dashboard config file. This vulnerability is fixed in 3.0.4 and 3.1.1...

CVE-2023-38511 iTop Dashboard editor vulnerable dashboard config file parameter

iTop is an IT service management platform. Dashboard editor : can load multiple files and URL, and full path disclosure on dashboard config file. This vulnerability is fixed in 3.0.4 and 3.1.1...

iTop 路径遍历漏洞

iTop is a platform that provides all the resources needed to optimize iTop. A security vulnerability exists in iTop versions 3.0.4 and 3.1.1 that stems from a flaw in the dashboard editor. An attacker exploiting this vulnerability could load multiple files and URLs, as well as expose the full pat...

iTop 安全漏洞

iTop is a platform that provides all the resources needed to optimize iTop. A security vulnerability exists in iTop versions 3.0.4 and 3.1.1 that stems from a cross-site scripting attack that may occur when the dashlet is refreshed...

iTop 跨站脚本漏洞

iTop is a platform that provides all the resources needed to optimize iTop. A security vulnerability exists in iTop versions 2.7.10, 3.0.4, and 3.1.1, which stems from a Dashlet-edited ajax endpoint that can be used to generate cross-site scripting...

WordPress Classified Listing plugin <= 3.0.4 - Cross-Site Request Forgery to Account Takeover via rtcl_update_user_account vulnerability

Cross-Site Request Forgery to Account Takeover via rtclupdateuseraccount vulnerability discovered by Francesco Carlucci in WordPress Plugin Classified Listing versions = 3.0.4...

PT-2024-13462 · Itop +1 · Itop +1

Name of the Vulnerable Software and Affected Versions: iTop versions prior to 3.0.4 iTop versions prior to 3.1.1 Description: iTop is an IT service management platform. When dashlets are refreshed, XSS attacks are possible. Recommendations: For versions prior to 3.0.4, update to version 3.0.4 or...

WordPress Elements kit Elementor addons Plugin <= 3.0.4 is vulnerable to Cross Site Scripting (XSS)

Software Elements kit Elementor addons Type Plugin Vulnerable versions = 3.0.4 Fixed in 3.0.5 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-1239 Patch priority Low CVSS severity Low 6.5 Developer Wpmet PSID def03a5e89bb Credits RandomRoot Required...

WordPress Elements kit Elementor addons Plugin <= 3.0.3 is vulnerable to Cross Site Scripting (XSS)

Software Elements kit Elementor addons Type Plugin Vulnerable versions = 3.0.3 Fixed in 3.0.4 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-6525 Patch priority Low CVSS severity Low 6.5 Developer Wpmet PSID 35435cff32ec Credits Ulyses Saicha Requir...

CVE-2024-1239

The ElementsKit Elementor addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the blog post read more button in all versions up to, and including, 3.0.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

WordPress Plugin ElementsKit Elementor addons security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exists in...

ROS-2-1221

2.1221 Vulnerability in VLC CVE-2019-19721, CVE-2020-6071, CVE-2020-6072, CVE-2020-6073, CVE-2020-6077, CVE-2020-6078, CVE-2020-6079 1. Vulnerability Description: The vulnerability allows a remote user to: - create a customized image file that can cause an out-of-bounds read, - send a specially...

BIT-DISCOURSE-2023-31142 Discourse's general category permissions could be set back to default

Discourse is an open source discussion platform. Prior to version 3.0.4 of the stable branch and version 3.1.0.beta5 of the beta and tests-passed branches, if a site has modified their general category permissions, they could be set back to the default. This issue is patched in version 3.0.4 of t...

BIT-DISCOURSE-2023-32061 Discourse Topic Creation Page Allows iFrame Tag without Restrictions

Discourse is an open source discussion platform. Prior to version 3.0.4 of the stable branch and version 3.1.0.beta5 of the beta and tests-passed branches, the lack of restrictions on the iFrame tag makes it easy for an attacker to exploit the vulnerability and hide subsequent comments from other...

BIT-DISCOURSE-2023-32301 Discourse's canonical url not being used for topic embeddings

Discourse is an open source discussion platform. Prior to version 3.0.4 of the stable branch and version 3.1.0.beta5 of the beta and tests-passed branches, multiple duplicate topics could be created if topic embedding is enabled. This issue is patched in version 3.0.4 of the stable branch and...