Remote Code Execution via CSRF in iTop

High-Tech Bridge Security Research Lab discovered a Remote Code Execution vulnerability in iTop that is exploitable via Cross-Site Request Forgery flaw that is also present in the application. The vulnerability exists due to absence of validation of HTTP request origin in...

iTop 2.1.0-2127 Cross Site Scripting Vulnerability

iTop version 2.1.0-2127 suffers from a cross site scripting vulnerability. Product: iTop Vendor: Combodo SARL Vulnerable Versions: 2.1.0-2127 and probably prior Tested Version: 2.1.0-2127 Advisory Publication: July 29, 2015 without technical details Vendor Notification: July 29, 2015 Vendor Patch...

iTop 2.1.0-2127 Cross Site Scripting

Advisory ID: HTB23268 Product: iTop Vendor: Combodo SARL Vulnerable Versions: 2.1.0-2127 and probably prior Tested Version: 2.1.0-2127 Advisory Publication: July 29, 2015 without technical details Vendor Notification: July 29, 2015 Vendor Patch: July 30, 2015 Public Disclosure: September 23, 2015...

Reflected Cross-Site Scripting (XSS) in iTop

High-Tech Bridge Security Research Lab discovered vulnerability in iTop, which can be exploited to perform Cross-Site Scripting XSS attacks against web application users. iTop is a critical application, which is used to cover the entire set of ITIL processes. Successful attack on this web...

TeemIp - IP Address Management Solution

All network administrators do recognize how important it is to have a well managed IP space: a comprehensive and up to date inventory of all subnets and IPs used in a network as well as clear and simple processes to request, change or release IPs are underlying key factors for a trouble free...

CVE-2013-0805

Multiple cross-site scripting XSS vulnerabilities in the search feature in iTop aka IT Operations Portal 2.0, 1.2.1, 1.2, and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 text parameter to pages/UI.php or 2 expression parameter to pages/runquery.php. NOTE: some ...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in the search feature in iTop aka IT Operations Portal 2.0, 1.2.1, 1.2, and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 text parameter to pages/UI.php or 2 expression parameter to pages/runquery.php. NOTE: some ...

CVE-2013-0805

Multiple cross-site scripting XSS vulnerabilities in the search feature in iTop aka IT Operations Portal 2.0, 1.2.1, 1.2, and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 text parameter to pages/UI.php or 2 expression parameter to pages/runquery.php. NOTE: some ...

CVE-2013-0805

CVE-2013-0805 covers multiple cross-site scripting (XSS) flaws in the iTop (IT Operations Portal) search feature. The vulnerabilities allow remote attackers to inject arbitrary HTML/script via the text parameter to pages/UI.php or the expression parameter to pages/run_query.php. Affected versions...

PT-2014-2463

Name of the Vulnerable Software and Affected Versions iTop versions 2.0, 1.2.1, 1.2, and earlier Description The issue concerns multiple cross-site scripting XSS vulnerabilities in the search feature. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML. Specificall...

CVE-2013-0805: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in the search feature in iTop aka IT Operations Portal 2.0, 1.2.1, 1.2, and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 text parameter to pages/UI.php or 2 expression parameter to pages/runquery.php. NOTE: some ...

CVE-2013-0805 / CSNC-2013-001

COMPASS SECURITY ADVISORY http://www.csnc.ch/ CVE ID : CVE-2013-0805 CSNC ID: CSNC-2013-001 Product: iTop Vendor: Combodo Subject: Cross-site Scripting - XSS Risk: High Effect: Remotely exploitable Author: Stephan Rickauer stephan.rickauer at csnc.ch Date: January 23rd 2013 Introduction:...

TC-SA-2011-02: Multiple web-vulnerabilities in iTop version 1.1.181

TC-SA-2011-02: Multiple web-vulnerabilities in iTop version 1.1.181 Published: 2011/11/16 Version 1.0 Affected products: iTop version 1.1.181, 1.2.0-RC-282 maybe earlier versions as well http://sourceforge.net/projects/itop/ References: CVE-2011-4275 - Multiple web-vulnerabilities in iTop...

CVE-2011-4275

Multiple cross-site scripting XSS vulnerabilities in iTop aka IT Operations Portal 1.1.181 and 1.2.0-RC-282 allow remote attackers to inject arbitrary web script or HTML via 1 a crafted company name, 2 a crafted database server name, 3 a crafted CSV file, 4 a crafted copy-and-paste action, 5 the...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in iTop aka IT Operations Portal 1.1.181 and 1.2.0-RC-282 allow remote attackers to inject arbitrary web script or HTML via 1 a crafted company name, 2 a crafted database server name, 3 a crafted CSV file, 4 a crafted copy-and-paste action, 5 the...

CVE-2011-4275

Multiple cross-site scripting XSS vulnerabilities in iTop aka IT Operations Portal 1.1.181 and 1.2.0-RC-282 allow remote attackers to inject arbitrary web script or HTML via 1 a crafted company name, 2 a crafted database server name, 3 a crafted CSV file, 4 a crafted copy-and-paste action, 5 the...

CVE-2011-4275

The iTop (IT Operations Portal) service management tool, versions 1.1.181 and 1.2.0-RC-282 , is vulnerable to multiple cross-site scripting (XSS) flaws. These vulnerabilities arise from improper input sanitization, allowing remote attackers to inject arbitrary web scripts or HTML. Specifically, t...

PT-2011-4922

Name of the Vulnerable Software and Affected Versions iTop versions 1.1.181 through 1.2.0-RC-282 Description The issue allows remote attackers to inject arbitrary web script or HTML, potentially leading to cross-site scripting XSS attacks. This can be achieved through various means, including: - ...

CVE-2011-4275: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in iTop aka IT Operations Portal 1.1.181 and 1.2.0-RC-282 allow remote attackers to inject arbitrary web script or HTML via 1 a crafted company name, 2 a crafted database server name, 3 a crafted CSV file, 4 a crafted copy-and-paste action, 5 the...

iTop 1.1.181 Cross Site Scripting

TC-SA-2011-02: Multiple web-vulnerabilities in iTop version 1.1.181 Published: 2011/11/16 Version 1.0 Affected products: iTop version 1.1.181, 1.2.0-RC-282 maybe earlier versions as well http://sourceforge.net/projects/itop/ References: CVE-2011-4275 - Multiple web-vulnerabilities in iTop...