PHP Remote File Inclusion in combodo/itop

Description csrf bug Proof of Concept Bellow request is vulnerable to csrf attack history.pushState'', '', '/' input type="hidden" name="class" v...

in combodo/itop

Description csrf bug Proof of Concept bellow request is vulnerable to csrf attack history.pushState'', '', '/' document.forms0.submit;...

CVE-2021-32664

Combodo iTop is an open source web based IT Service Management tool. In affected versions there is a XSS vulnerability on "run query" page when logged as administrator. This has been resolved in versions 2.6.5 and 2.7.5...

CVE-2021-32664

Combodo iTop is an open source web based IT Service Management tool. In affected versions there is a XSS vulnerability on "run query" page when logged as administrator. This has been resolved in versions 2.6.5 and 2.7.5...

Cross site scripting

Combodo iTop is an open source web based IT Service Management tool. In affected versions there is a XSS vulnerability on "run query" page when logged as administrator. This has been resolved in versions 2.6.5 and 2.7.5...

CVE-2021-32664 Reflected XSS in Combodo/iTop

Combodo iTop is an open source web based IT Service Management tool. In affected versions there is a XSS vulnerability on "run query" page when logged as administrator. This has been resolved in versions 2.6.5 and 2.7.5...

CVE-2021-32664

CVE-2021-32664 (Combodo iTop) is an XSS vulnerability on the run query page when authenticated as administrator. The primary description notes affected versions and fixes: it was resolved in iTop versions 2.6.5 and 2.7.5. Connected sources corroborate iTop-specific issues and mitigations across m...

CVE-2021-32663 Unauthorized setup leads to SSRF in Combodo/iTop

iTop is an open source web based IT Service Management tool. In affected versions an attacker can call the system setup without authentication. Given specific parameters this can lead to SSRF. This issue has been resolved in versions 2.6.5 and 2.7.5 and later...

Combodo iTop 代码问题漏洞

Combodo iTop is a French company Combodo ITIL-based development and for the daily operation of the IT environment of open source Web applications. The program provides incident management, configuration management and problem management. A code issue exists in Combodo iTop versions prior to 2.7.5...

Combodo iTop 跨站脚本漏洞

Combodo iTop is a French company Combodo ITIL-based development and for the daily operation of the IT environment of open source Web applications. The program provides incident management, configuration management and problem management. A cross-site scripting vulnerability exists in Combodo iTop...

PT-2021-19842 · Comodo +1 · Itop +1

Name of the Vulnerable Software and Affected Versions: Combodo iTop versions prior to 2.6.5 Combodo iTop versions prior to 2.7.5 Description: The issue is related to a XSS vulnerability on the "run query" page when logged in as an administrator. This vulnerability has been resolved in versions...

Combodo iTop Cross-Site Request Forgery Vulnerability (CNVD-2021-54384)

Combodo iTop is a set of open source web applications developed by Combodo France based on ITIL and used for daily operations in IT environments. The application provides event management, configuration management and issue management. iTop versions prior to Combodo 2.7.4 are vulnerable to...

Combodo iTop Cross-Site Request Forgery Vulnerability (CNVD-2021-54385)

Combodo iTop is a set of open source web applications developed by Combodo France based on ITIL and used for daily operations in IT environments. The application provides event management, configuration management and issue management functions.Combodo iTop versions prior to 2.7.4 are vulnerable ...

CVE-2021-32776

Combodo iTop is a web based IT Service Management tool. In versions prior to 2.7.4, CSRF tokens can be reused by a malicious user, as on Windows servers no cleanup is done on CSRF tokens. This issue is fixed in versions 2.7.4 and 3.0.0...

CVE-2021-32776

Combodo iTop is a web based IT Service Management tool. In versions prior to 2.7.4, CSRF tokens can be reused by a malicious user, as on Windows servers no cleanup is done on CSRF tokens. This issue is fixed in versions 2.7.4 and 3.0.0...

CVE-2021-32775

Combodo iTop is a web based IT Service Management tool. In versions prior to 2.7.4, a non admin user can get access to many class/field values through GroupBy Dashlet error message. This issue is fixed in versions 2.7.4 and 3.0.0...

Cross site request forgery (csrf)

Combodo iTop is a web based IT Service Management tool. In versions prior to 2.7.4, CSRF tokens can be reused by a malicious user, as on Windows servers no cleanup is done on CSRF tokens. This issue is fixed in versions 2.7.4 and 3.0.0...

Design/Logic Flaw

Combodo iTop is a web based IT Service Management tool. In versions prior to 2.7.4, a non admin user can get access to many class/field values through GroupBy Dashlet error message. This issue is fixed in versions 2.7.4 and 3.0.0...

CVE-2021-32776

Combodo iTop has a CSRF token reuse vulnerability in versions before 2.7.4 (and before 3.0.0 in some advisories) due to no cleanup of CSRF tokens on Windows servers. The issue enables CSRF token reuse by a malicious user. It is fixed in iTop 2.7.4 and 3.0.0. Red Hat CPE advisory confirms the CVE-...

CVE-2021-32776 No CSRF form token cleanup on Windows servers

Combodo iTop is a web based IT Service Management tool. In versions prior to 2.7.4, CSRF tokens can be reused by a malicious user, as on Windows servers no cleanup is done on CSRF tokens. This issue is fixed in versions 2.7.4 and 3.0.0...