CVE-2020-12777

A function in Combodo iTop contains a vulnerability of Broken Access Control, which allows unauthorized attacker to inject command and disclose system information...

CVE-2020-12781

Combodo iTop contains a cross-site request forgery CSRF vulnerability, attackers can execute specific commands via malicious site request forgery...

CVE-2020-12780

A security misconfiguration exists in Combodo iTop, which can expose sensitive information...

CVE-2020-12778

Combodo iTop does not validate inputted parameters, attackers can inject malicious commands and launch XSS attack...

Design/Logic Flaw

Combodo iTop does not validate inputted parameters, attackers can inject malicious commands and launch XSS attack...

Cross site request forgery (csrf)

Combodo iTop contains a cross-site request forgery CSRF vulnerability, attackers can execute specific commands via malicious site request forgery...

Information disclosure

A security misconfiguration exists in Combodo iTop, which can expose sensitive information...

Cross site scripting

Combodo iTop contains a stored Cross-site Scripting vulnerability, which can be attacked by uploading file with malicious script...

Improper access control

A function in Combodo iTop contains a vulnerability of Broken Access Control, which allows unauthorized attacker to inject command and disclose system information...

CVE-2020-12781 Combodo iTop - CSRF

Combodo iTop contains a cross-site request forgery CSRF vulnerability, attackers can execute specific commands via malicious site request forgery...

CVE-2020-12781

CVE-2020-12781 affects Combodo iTop and describes a cross-site request forgery (CSRF) vulnerability. The CVE entry notes that attackers can trigger commands via a malicious site request forgery, with NVD metrics indicating notable impact (CVSS v3.1: High, with Network exposure, no privileges requ...

CVE-2020-12780

CVE-2020-12780 stems from a security misconfiguration in Combodo iTop exposing sensitive information. Connected advisories describe related, concrete iTop flaws affecting multiple versions and modules: XSS in dashlets/dashboard editor (pre-3.0.4/3.1.1), full path disclosure in dashboard config, a...

CVE-2020-12780 Combodo iTop - Security Misconfiguration

A security misconfiguration exists in Combodo iTop, which can expose sensitive information...

CVE-2020-12779 Combodo iTop - Stored XSS

Combodo iTop contains a stored Cross-site Scripting vulnerability, which can be attacked by uploading file with malicious script...

CVE-2020-12777 Combodo iTop - Broken Access Control

A function in Combodo iTop contains a vulnerability of Broken Access Control, which allows unauthorized attacker to inject command and disclose system information...

CVE-2020-12778

CVE-2020-12778 concerns Combodo iTop (IT service management). The initial description states input validation failures allow command injection and XSS. Connected documents elaborate multiple iTop-XSS/credential issues across versions and components: dashboard editor and dashlets can load files/UR...

CVE-2020-12779

CVE-2020-12779 concerns a stored XSS in Combodo iTop via uploading a file containing malicious script. The connected advisories corroborate repeated iTop XSS issues across multiple versions and components (e.g., UI and dashboard-related paths) with affected versions including pre-3.0.4, pre-3.1.1...

CVE-2020-12777

CVE-2020-12777 concerns Combodo iTop: a Broken Access Control vulnerability in a function that can allow an unauthorized attacker to inject commands and disclose system information. Related connected documents describe additional iTop issues (notably XSS and information disclosure) across multipl...

CVE-2020-12778 Combodo iTop - Reflected XSS

Combodo iTop does not validate inputted parameters, attackers can inject malicious commands and launch XSS attack...

PT-2020-13263 · Comodo +1 · Itop +1

Name of the Vulnerable Software and Affected Versions: Combodo iTop affected versions not specified Description: The issue is related to a cross-site request forgery CSRF vulnerability. This means that attackers can execute specific commands by forging requests from a malicious site...