70 matches found
Combodo iTop 安全漏洞
Combodo iTop is a French company Combodo ITIL-based development and for the daily operation of the IT environment of open source Web applications. The program provides incident management, configuration management and problem management. Combodo iTop version 2.7.4 prior to a security vulnerabilit...
PT-2021-19921 · Comodo +1 · Itop +1
Name of the Vulnerable Software and Affected Versions: Combodo iTop versions prior to 2.7.4 Description: The issue allows a non-admin user to access many class/field values through a GroupBy Dashlet error message. Recommendations: For versions prior to 2.7.4, update to version 2.7.4 or 3.0.0 to...
CVE-2021-32775: Generation of Error Message Containing Sensitive Information
Combodo iTop is a web based IT Service Management tool. In versions prior to 2.7.4, a non admin user can get access to many class/field values through GroupBy Dashlet error message. This issue is fixed in versions 2.7.4 and 3.0.0...
CVE-2018-20172
An issue was discovered in Nagios XI before 5.5.8. The rssurl parameter of rssdashlet/magpierss/scripts/magpieslashbox.php is not filtered, resulting in an XSS vulnerability...
CVE-2018-18250
Icinga Web 2 before 2.6.2 allows parameters that break navigation dashlets, as demonstrated by a single '$' character as the Name of a Navigation item...
DEBIAN-CVE-2018-18249
Icinga Web 2 before 2.6.2 allows injection of PHP ini-file directives via vectors involving environment variables as the channel to send information to the attacker, such as a name=$PATH$APACHERUNDIR$APACHERUNUSER parameter to /icingaweb2/navigation/add or /icingaweb2/dashboard/new-dashlet...
CVE-2018-18250
Icinga Web 2 before 2.6.2 allows parameters that break navigation dashlets, as demonstrated by a single '$' character as the Name of a Navigation item...
CVE-2018-18249: Improper Control of Generation of Code
Icinga Web 2 before 2.6.2 allows injection of PHP ini-file directives via vectors involving environment variables as the channel to send information to the attacker, such as a name=$PATH$APACHERUNDIR$APACHERUNUSER parameter to /icingaweb2/navigation/add or /icingaweb2/dashboard/new-dashlet...
CVE-2014-3244
CVE-2014-3244 concerns an XML external entity (XXE) vulnerability in the RSSDashlet dashlet of SugarCRM prior to 6.5.17. The underlying issue is an XXE in XML requests that allows an attacker to read arbitrary files or potentially execute arbitrary code. Affected product: SugarCRM RSSDashlet comp...
