Design/Logic Flaw

Combodo iTop is a web based IT Service Management tool. In iTop before versions 2.7.2 and 3.0.0, two cookies are created for the same session, which leads to a possibility to steal user session. This is fixed in versions 2.7.2 and 3.0.0...

Design/Logic Flaw

Combodo iTop is a web based IT Service Management tool. In iTop before versions 2.7.2 and 3.0.0, admin pages are cached, so that their content is visible after deconnection by using the browser back button. This is fixed in versions 2.7.2 and 3.0.0...

Design/Logic Flaw

Combodo iTop is a web based IT Service Management tool. In iTop before versions 2.7.2 and 3.0.0, by modifying target browser local storage, an XSS can be generated in the iTop console breadcrumb. This is fixed in versions 2.7.2 and 3.0.0...

CVE-2020-15221 XSS in the breadcrumbs

Combodo iTop is a web based IT Service Management tool. In iTop before versions 2.7.2 and 3.0.0, by modifying target browser local storage, an XSS can be generated in the iTop console breadcrumb. This is fixed in versions 2.7.2 and 3.0.0...

CVE-2020-15221

CVE-2020-15221 : Combodo iTop (web ITSM) is vulnerable to a cross-site scripting (XSS) flaw introduced by manipulating the target browser localStorage, affecting iTop versions prior to 2.7.2 and 3.0.0. The issue is fixed in 2.7.2 and 3.0.0. No exploitation details are provided in the given docume...

CVE-2020-15220

CVE-2020-15220 affects Combodo iTop (open-source IT Service Management platform). In iTop versions prior to 2.7.2 and 3.0.0, two cookies are created for the same session, enabling potential session hijacking. The issue is fixed in version 2.7.2 and in version 3.0.0. Connected sources corroborate ...

CVE-2020-15220 Session fixation

Combodo iTop is a web based IT Service Management tool. In iTop before versions 2.7.2 and 3.0.0, two cookies are created for the same session, which leads to a possibility to steal user session. This is fixed in versions 2.7.2 and 3.0.0...

CVE-2020-15219

Combodo iTop vulnerable component: when a download error occurs in the user portal, an SQL query is exposed to the user. Root cause: error path reveals internal SQL. Affected versions: iTop before 2.7.2 and before 3.0.0. Impact per sources: potential information disclosure of the query; no exploi...

CVE-2020-15219 SQL query displayed on portal error

Combodo iTop is a web based IT Service Management tool. In iTop before versions 2.7.2 and 3.0.0, when a download error is triggered in the user portal, an SQL query is displayed to the user. This is fixed in versions 2.7.2 and 3.0.0...

CVE-2020-15218

Combodo iTop is affected prior to versions 2.7.2 and 3.0.0 where admin pages are cached, allowing content to be visible after a user navigates back. This is fixed in 2.7.2 and 3.0.0. The provided data indicates partial confidentiality impact with a MEDIUM/LOW severity depending on vector, and no ...

CVE-2020-15218 Admin pages are cached and can be embedded

Combodo iTop is a web based IT Service Management tool. In iTop before versions 2.7.2 and 3.0.0, admin pages are cached, so that their content is visible after deconnection by using the browser back button. This is fixed in versions 2.7.2 and 3.0.0...

Combodo iTop SQL注入漏洞

Combodo iTop is a French company Combodo ITIL-based development and for the daily operation of the IT environment of open source Web applications. The program provides incident management, configuration management and problem management. A SQL injection vulnerability exists in Combodo iTop versio...

Combodo iTop 代码问题漏洞

Combodo iTop is a French company Combodo ITIL-based development and for the daily operation of the IT environment of open source Web applications. The program provides incident management, configuration management and problem management functions. An information disclosure vulnerability exists in...

Combodo iTop 代码问题漏洞

Combodo iTop is a French company Combodo ITIL-based development and for the daily operation of the IT environment of open source Web applications. The program provides incident management, configuration management and problem management functions. A code issue vulnerability exists in Combodo iTop...

PT-2021-9738 · Comodo +1 · Combodo Itop +1

Name of the Vulnerable Software and Affected Versions: Combodo iTop versions prior to 2.7.2 Combodo iTop versions prior to 3.0.0 Description: The issue concerns the caching of admin pages in Combodo iTop, allowing their content to be visible after disconnection by using the browser back button...

PT-2021-9739 · Comodo +1 · Itop +1

Name of the Vulnerable Software and Affected Versions: Combodo iTop versions prior to 2.7.2 Combodo iTop versions prior to 3.0.0 Description: The issue concerns a web-based IT Service Management tool. When a download error occurs in the user portal, an SQL query is displayed to the user...

PT-2021-9741 · Comodo +1 · Combodo Itop +1

Name of the Vulnerable Software and Affected Versions: Combodo iTop versions prior to 2.7.2 and 3.0.0 Description: The issue affects Combodo iTop, a web-based IT Service Management tool. By modifying the target browser's local storage, an XSS can be generated in the iTop console breadcrumb...

Combodo iTop 跨站脚本漏洞

Combodo iTop is free software for managing hardware, software and related services. A cross-site scripting vulnerability exists in Combodo iTop versions prior to 2.7.2, 3.0.0. An attacker can exploit this vulnerability by modifying the local storage of the target browser to conduct a cross-site...

CVE-2020-4079

Combodo iTop is a web based IT Service Management tool. In iTop before versions 2.7.2 and 2.8.0, when the ajax endpoint for the "excel export" portal functionality is called directly it allows getting data without scope filtering. This allows a user to access data they which they should not have...

CVE-2020-4079

Combodo iTop is a web based IT Service Management tool. In iTop before versions 2.7.2 and 2.8.0, when the ajax endpoint for the "excel export" portal functionality is called directly it allows getting data without scope filtering. This allows a user to access data they which they should not have...