CVE-2020-15220

CVE-2020-15220 affects Combodo iTop (open-source IT Service Management platform). In iTop versions prior to 2.7.2 and 3.0.0, two cookies are created for the same session, enabling potential session hijacking. The issue is fixed in version 2.7.2 and in version 3.0.0. Connected sources corroborate ...

CVE-2020-15220 Session fixation

Combodo iTop is a web based IT Service Management tool. In iTop before versions 2.7.2 and 3.0.0, two cookies are created for the same session, which leads to a possibility to steal user session. This is fixed in versions 2.7.2 and 3.0.0...

CVE-2020-15218

Combodo iTop is affected prior to versions 2.7.2 and 3.0.0 where admin pages are cached, allowing content to be visible after a user navigates back. This is fixed in 2.7.2 and 3.0.0. The provided data indicates partial confidentiality impact with a MEDIUM/LOW severity depending on vector, and no ...

CVE-2020-15218 Admin pages are cached and can be embedded

Combodo iTop is a web based IT Service Management tool. In iTop before versions 2.7.2 and 3.0.0, admin pages are cached, so that their content is visible after deconnection by using the browser back button. This is fixed in versions 2.7.2 and 3.0.0...

CVE-2020-4079

Combodo iTop is a web based IT Service Management tool. In iTop before versions 2.7.2 and 2.8.0, when the ajax endpoint for the "excel export" portal functionality is called directly it allows getting data without scope filtering. This allows a user to access data they which they should not have...

CVE-2020-4079

Combodo iTop is a web based IT Service Management tool. In iTop before versions 2.7.2 and 2.8.0, when the ajax endpoint for the "excel export" portal functionality is called directly it allows getting data without scope filtering. This allows a user to access data they which they should not have...

CVE-2020-4079 Information disclosure vulnerability in iTop

Combodo iTop is a web based IT Service Management tool. In iTop before versions 2.7.2 and 2.8.0, when the ajax endpoint for the "excel export" portal functionality is called directly it allows getting data without scope filtering. This allows a user to access data they which they should not have...

Where maritime cyber checklists fail

The coming IMO cyber security regulations are a step in the right direction towards vessel security, but the impracticality of assessing the cyber security of a ship, together with a huge skills shortage, leads classification societies towards checklist based assessments. Having seen some of thes...

Post-Riot, the Capitol Hill IT Staff Faces a Security Mess

Wednesday's insurrection could have exposed congressional data and devices in ways that have yet to be appreciated...

SolarWinds Web Help Desk Cross-Site Scripting Vulnerability (CNVD-2021-01997)

Solarwinds Web Help Desk is a suite of help desk and asset management software from Solarwinds USA. The software supports centralized knowledge base, IT asset management, project and task management, and more. A cross-site scripting vulnerability exists in SolarWinds Web Help Desk 12.7.0 that...

Fired Healthcare Exec Stalls Critical PPE Shipment for Months

The FBI has announced that Christopher Dobbins pleaded guilty and was sentenced to a year in prison for breaching and temporarily disabling the Stradis Healthcare shipping system using a secret account, after being fired weeks earlier. Last March, as doctors reported having to ration and reuse...

Funke Media Group suffers nationwide ransomware attack in Germany

On December 22, Germany’s third largest publisher fell victim to a cyberattack that affected systems in offices all around the country. The Funke Media Group publishes dozens of newspapers, like Berliner Morgenpost, Hamburger Abendblatt, and Bergedorfer Zeitung, as well as magazines, several loca...

SolarWinds Web Help Desk HTML Injection Vulnerability

SolarWinds Web Help Desk is a web-based help desk work order and IT asset management software. An HTML injection vulnerability exists in SolarWinds Web Help Desk 12.7.0. The vulnerability can be exploited to conduct an HTML injection attack via a Comment in a Help Request work order...

SolarWinds Web Help Desk 注入漏洞

SolarWinds Web Help Desk is a web-based help desk work order and IT asset management software. An HTML injection vulnerability exists in SolarWinds Web Help Desk 12.7.0. The vulnerability can be exploited to conduct an HTML injection attack via a Comment in a Help Request work order...

PT-2021-7969 · Xpdf +1 · Xpdf +1

Name of the Vulnerable Software and Affected Versions: xpdf version 4.02 Description: The issue is related to an infinite recursion in the Catalog::findDestInTree function, which can cause a denial of service. This function is part of the xpdf software, used for viewing PDF files. The recursion i...

Telemed Poll Uncovers Biggest Risks and Best Practices

Healthcare organizations have gone virtual during the COVID-19 pandemic, just like the rest of us – with the use of telehealth services becoming the go-to format for med checks, routine consultations and therapist visits. But how safe are these services when it comes to patient data? In an...

Code42 Incydr Series: Bringing Shadow IT into the light with Code42 Incydr

Shadow IT is hardly a hidden threat to security professionals. Gartner was warning, way back in 2016, that 1 in 3 successful attacks experienced by enterprises would come from the use of unsanctioned apps by 2020. Code42’s Data Exposure Report just about proves Gartner’s prediction, showing that...

[IT 管理者向け] CVSS を読み解いて脆弱性をより正しく理解する

新しいバージョンのセキュリティ更新プログラムについては下記の関連ブログもご覧ください。 「新しいセキュ...

Facebook links activities of OceanLotus hackers to IT firm in Vietnam

By Deeba Ahmed The social network has barred Vietnamese APT32 and a Bangladeshi group of hackers from using its platforms for their malicious purposes. This is a post from HackRead.com Read the original post: Facebook links activities of OceanLotus hackers to IT firm in Vietnam...

Governance Considerations for Democratizing Your Organization's Data in 2021

With the continuing rise of IoT devices, mobile networks, and digital channels, companies face a lot of pressure to generate meaningful and actionable insights from the wealth of data they capture. Gartner Research lists data democratization as one of the top strategic technology trends to watch...