CVE-2025-24022

iTop is an web based IT Service Management tool. Prior to versions 2.7.12, 3.1.3, and 3.2.1, server code execution is possible through the frontend of iTop's portal. This is fixed in versions 2.7.12, 3.1.3 and 3.2.1...

CVE-2024-52601

iTop is an web based IT Service Management tool. Prior to versions 2.7.12, 3.1.3, and 3.2.1, anyone with an account having portal access can have read access to objects they're not allowed to see by querying an unprotected route. Versions 2.7.12, 3.1.3, and 3.2.1 contain a fix for the issue...

CVE-2025-24969

CVE-2025-24969 affects iTop, a web-based IT service management tool. The vulnerability is present in versions prior to 3.2.1, where a portal user can view other contacts’ pictures by changing the picture ID in the URL. Version 3.2.1 includes a patch for this issue. The documented impact is privac...

CVE-2025-24969 iTop portal user can see any other contact's picture

iTop is an web based IT Service Management tool. Prior to version 3.2.1, a portal user can see any other contacts picture by changing the picture ID in the URL. Version 3.2.1 contains a patch for the issue...

CVE-2025-24785 iTop dashboard vulnerable to denial of service

iTop is an web based IT Service Management tool. In version 3.2.0, an attacker may send a URL to the server to trigger a PHP error. The next user trying to load this dashboard would encounter a crashed start page. Version 3.2.1 fixes the issue by checking the provided layoutclass before saving th...

CVE-2025-24022

CVE-2025-24022 affects the iTop web-based IT Service Management tool. The vulnerability allows server-side code execution via the portal frontend in affected versions prior to 2.7.12, 3.1.3, and 3.2.1. It is fixed in those same release lines (2.7.12, 3.1.3, 3.2.1). These details come from multipl...

CVE-2025-24022 iTop server vulnerable to portal code injection

iTop is an web based IT Service Management tool. Prior to versions 2.7.12, 3.1.3, and 3.2.1, server code execution is possible through the frontend of iTop's portal. This is fixed in versions 2.7.12, 3.1.3 and 3.2.1...

CVE-2025-24021 iTop doesn't have mass assignment of fields in the portal form

iTop is an web based IT Service Management tool. Prior to versions 2.7.12, 3.1.3, and 3.2.1, anyone with an account having portal access can set value to object fields when they're not supposed to. Versions 2.7.12, 3.1.3, and 3.2.1 contain a fix for the issue...

CVE-2025-24021

CVE-2025-24021 affects iTop (web-based IT Service Management). Prior to fixes, any account with portal access could set values on object fields that should not be modifiable. Affected versions: 2.7.11 or earlier? The initial docs list vulnerable versions as 2.7.12, 3.1.3, and 3.2.1 that contain f...

CVE-2025-24021 iTop doesn't have mass assignment of fields in the portal form

iTop is an web based IT Service Management tool. Prior to versions 2.7.12, 3.1.3, and 3.2.1, anyone with an account having portal access can set value to object fields when they're not supposed to. Versions 2.7.12, 3.1.3, and 3.2.1 contain a fix for the issue...

CVE-2024-56157 iTop vulnerable to Self XSS in CSV Import

iTop is an web based IT Service Management tool. Prior to versions 3.1.3 and 3.2.1, by filling malicious code in a CSV content, a cross-site scripting attack can be performed when importing this content. The issue is fixed in versions 3.1.3 and 3.2.1. As a workaround, check CSV content before...

CVE-2024-52601 iTop portal Insecure Direct Object Reference vulnerability

iTop is an web based IT Service Management tool. Prior to versions 2.7.12, 3.1.3, and 3.2.1, anyone with an account having portal access can have read access to objects they're not allowed to see by querying an unprotected route. Versions 2.7.12, 3.1.3, and 3.2.1 contain a fix for the issue...

CVE-2024-52601 iTop portal Insecure Direct Object Reference vulnerability

iTop is an web based IT Service Management tool. Prior to versions 2.7.12, 3.1.3, and 3.2.1, anyone with an account having portal access can have read access to objects they're not allowed to see by querying an unprotected route. Versions 2.7.12, 3.1.3, and 3.2.1 contain a fix for the issue...

North Korean IT Workers Are Being Exposed on a Massive Scale

Security researchers are publishing 1,000 email addresses they claim are linked to North Korean IT worker scams that infiltrated Western companies—along with photos of men allegedly involved in the schemes...

PT-2025-21168 · Itop · Itop

Name of the Vulnerable Software and Affected Versions: iTop versions prior to 2.7.12 iTop versions prior to 3.1.3 iTop versions prior to 3.2.1 Description: The issue affects iTop, a web-based IT Service Management tool. Prior to versions 2.7.12, 3.1.3, and 3.2.1, anyone with an account having...

PT-2025-21171 · Itop · Itop

Name of the Vulnerable Software and Affected Versions: iTop versions prior to 2.7.12 iTop versions 3.0.0 through 3.1.3 iTop versions 3.2.0 through 3.2.1 Description: iTop is a web-based IT Service Management tool. Server code execution is possible through the frontend of iTop's portal. This issue...

The vulnerability of the IT service management tool Ivanti Neurons for ITSM relates to the bypassing of the authentication process, allowing an intruder to gain unauthorized access to the system with administrator privileges.

The vulnerability of the IT service management tool Ivanti Neurons for ITSM is related to the bypassing of the authentication process. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to the system with administrator privileges...

New SEO Poisoning Campaign Targeting IT Admins With Malware

Varonis reveals attackers are using SEO poisoning to trick IT admins into downloading malware, alongside a critical root…...

The IT help desk kindly requests you read this newsletter

Welcome to this week's edition of the Threat Source newsletter. Authority bias is one of the many things that shape how we think. Taking the advice of someone with recognized authority is often far easier and usually leads to a better outcome than spending time and effort in researching the...

Malicious code in superhero-turnip (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5d69e2637a3683b1221571a71874774c0abaa62cd5804c7e846ab5eff6477ee2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...