Lucene search
K
Database
Vendors
Products
Timeline
Vulnerabilities
Perimeter Scanner
Scanning
Projects
Scanner
Agent Scanning
API Scanning
Manual Audit
Email
Webhook
Resources
Documents
Blog
Glossary
FAQ
Plugins
Pricing
Contacts
About Us
Partners
Branding Guideline
Settings
Sign in
CombodoItop

26 matches found

CVE
CVE•added 2020/02/14 6:15 p.m.•105 views

CVE-2019-11215

In Combodo iTop 2.2.0 through 2.6.0, if the configuration file is writable, then execution of arbitrary code can be accomplished by calling ajax.dataloader with a maliciously crafted payload. Many conditions can place the configuration file into a writable state: during installation; during upgrade...

8.1CVSS8.1AI score0.00463EPSS
CVE
CVE•added 2022/04/05 7:15 p.m.•100 views

CVE-2022-24780

Combodo iTop is a web based IT Service Management tool. In versions prior to 2.7.6 and 3.0.0, users of the iTop user portal can send TWIG code to the server by forging specific http queries, and execute arbitrary code on the server using http server user privileges. This issue is fixed in versions ...

8.8CVSS8.7AI score0.16493EPSS
CVE
CVE•added 2022/04/05 3:15 p.m.•77 views

CVE-2021-41245

Combodo iTop is a web based IT Service Management tool. In versions prior to 2.7.6 and 3.0.0, CSRF tokens generated by privUITransactionFile aren't properly checked. Versions 2.7.6 and 3.0.0 contain a patch for this issue. As a workaround, use the session implementation by adding in the iTop config...

8.1CVSS7.2AI score0.00125EPSS
CVE
CVE•added 2022/04/21 5:15 p.m.•77 views

CVE-2022-24870

Combodo iTop is a web based IT Service Management tool. In 3.0.0 beta releases prior to 3.0.0 beta3 a malicious script can be injected in tooltips using iTop customization mechanism. This provides a stored cross site scripting attack vector to authorized users of the system. Users are advised to up...

8.7CVSS5.7AI score0.00403EPSS
CVE
CVE•added 2023/10/25 6:17 p.m.•57 views

CVE-2023-34447

iTop is an open source, web-based IT service management platform. Prior to versions 3.0.4 and 3.1.0, on pages/UI.php, cross site scripting is possible. This issue is fixed in versions 3.0.4 and 3.1.0.

8.8CVSS6.9AI score0.01181EPSS
CVE
CVE•added 2024/11/05 12:15 a.m.•50 views

CVE-2023-34444

Combodo iTop is a simple, web based IT Service Management tool. When displaying pages/ajax.searchform.php XSS are possible for scripts outside of script tags. This issue has been fixed in versions 2.7.9, 3.0.4, 3.1.0. All users are advised to upgrade. There are no known workarounds for this vulnera...

8.8CVSS7.2AI score0.00171EPSS
CVE
CVE•added 2021/07/21 9:15 p.m.•49 views

CVE-2021-32776

Combodo iTop is a web based IT Service Management tool. In versions prior to 2.7.4, CSRF tokens can be reused by a malicious user, as on Windows servers no cleanup is done on CSRF tokens. This issue is fixed in versions 2.7.4 and 3.0.0.

8.8CVSS7.4AI score0.00144EPSS
CVE
CVE•added 2024/04/15 6:15 p.m.•45 views

CVE-2023-47626

iTop is an IT service management platform. When displaying/editing the user's personal tokens, XSS attacks are possible. This vulnerability is fixed in 3.1.1.

8.8CVSS5.9AI score0.00687EPSS
CVE
CVE•added 2024/11/05 7:15 p.m.•45 views

CVE-2024-51740

Combodo iTop is a simple, web based IT Service Management tool. This vulnerability can be used to create HTTP requests on behalf of the server, from a low privileged user. The user portal form manager has been fixed to only instantiate classes derived from it. This issue has been addressed in versi...

8.8CVSS4.9AI score0.00147EPSS
CVE
CVE•added 2020/08/10 3:15 a.m.•44 views

CVE-2020-12781

Combodo iTop contains a cross-site request forgery (CSRF) vulnerability, attackers can execute specific commands via malicious site request forgery.

8.8CVSS7.3AI score0.00131EPSS
CVE
CVE•added 2024/11/05 12:15 a.m.•44 views

CVE-2024-31998

Combodo iTop is a simple, web based IT Service Management tool. A CSRF can be performed on CSV import simulation. This issue has been fixed in versions 3.1.2 and 3.2.0. All users are advised to upgrade. There are no known workarounds for this vulnerability.

8.8CVSS8.7AI score0.00091EPSS
CVE
CVE•added 2020/03/16 6:15 p.m.•43 views

CVE-2019-19821

A post-authentication privilege escalation in the web application of Combodo iTop allows regular authenticated users to access information and modify information with administrative privileges by not following the HTTP Location header in server responses. This is fixed in all iTop packages (communi...

8.1CVSS7.9AI score0.00487EPSS
CVE
CVE•added 2024/04/15 6:15 p.m.•43 views

CVE-2023-48709

iTop is an IT service management platform. When exporting data from backoffice or portal in CSV or Excel files, users' inputs may include malicious formulas that may be imported into Excel. As Excel 2016 does not prevent Remote Code Execution by default, uninformed users may become victims. This vu...

8CVSS8AI score0.03312EPSS
CVE
CVE•added 2024/11/05 12:15 a.m.•42 views

CVE-2024-31448

Combodo iTop is a simple, web based IT Service Management tool. By filling malicious code in a CSV content, an Cross-site Scripting (XSS) attack can be performed when importing this content. This issue has been fixed in versions 3.1.2 and 3.2.0. All users are advised to upgrade. Users unable to upg...

8.8CVSS7AI score0.00171EPSS
CVE
CVE•added 2024/11/05 12:15 a.m.•41 views

CVE-2023-34445

Combodo iTop is a simple, web based IT Service Management tool. When displaying pages/ajax.render.php XSS are possible for scripts outside of script tags. This issue has been fixed in versions 2.7.9, 3.0.4, 3.1.0. All users are advised to upgrade. There are no known workarounds for this vulnerabili...

8.8CVSS7.2AI score0.00171EPSS
CVE
CVE•added 2024/11/08 11:15 p.m.•40 views

CVE-2024-52000

Combodo iTop is a simple, web based IT Service Management tool. Affected versions are subject to a reflected Cross-site Scripting (XSS) exploit by way of editing a request's payload which can lead to malicious javascript execution. This issue has been addressed in version 3.2.0 via systematic escap...

8.1CVSS7.8AI score0.00166EPSS
CVE
CVE•added 2024/11/08 11:15 p.m.•40 views

CVE-2024-52002

Combodo iTop is a simple, web based IT Service Management tool. Several url endpoints are subject to a Cross-Site Request Forgery (CSRF) vulnerability. Please refer to the linked GHSA for the complete list. This issue has been addressed in version 3.2.0 and all users are advised to upgrade. There a...

8.8CVSS7.7AI score0.01353EPSS
CVE
CVE•added 2024/04/15 6:15 p.m.•39 views

CVE-2023-47123

iTop is an IT service management platform. By filling malicious code in an object friendlyname / complementary name, an XSS attack can be performed when this object will displayed as an n:n relation item in another object. This vulnerability is fixed in 3.1.1 and 3.2.0.

8.7CVSS6.1AI score0.00533EPSS
CVE
CVE•added 2024/04/15 6:15 p.m.•39 views

CVE-2023-47622

iTop is an IT service management platform. When dashlet are refreshed, XSS attacks are possible. This vulnerability is fixed in 3.0.4 and 3.1.1.

8.8CVSS5.9AI score0.00526EPSS
CVE
CVE•added 2024/11/05 12:15 a.m.•37 views

CVE-2023-34443

Combodo iTop is a simple, web based IT Service Management tool. When displaying page Run queries Cross-site Scripting (XSS) are possible for scripts outside of script tags. This has been fixed in versions 2.7.9, 3.0.4, 3.1.0. All users are advised to upgrade. There are no known workarounds for this...

8.8CVSS7AI score0.00088EPSS
CVE
CVE•added 2021/07/21 3:15 p.m.•35 views

CVE-2021-21406

Combodo iTop is an open source, web based IT Service Management tool. In versions prior to 2.7.4, there is a command injection vulnerability in the Setup Wizard when providing Graphviz executable path. The vulnerability is patched in version 2.7.4 and 3.0.0.

8.8CVSS7.3AI score0.00575EPSS
CVE
CVE•added 2021/10/19 6:15 p.m.•35 views

CVE-2021-32663

iTop is an open source web based IT Service Management tool. In affected versions an attacker can call the system setup without authentication. Given specific parameters this can lead to SSRF. This issue has been resolved in versions 2.6.5 and 2.7.5 and later

8.7CVSS7.7AI score0.00316EPSS
CVE
CVE•added 2021/07/21 4:15 p.m.•32 views

CVE-2021-21407

Combodo iTop is an open source, web based IT Service Management tool. Prior to version 2.7.4, the CSRF token validation can be bypassed through iTop portal via a tricky browser procedure. The vulnerability is patched in version 2.7.4 and 3.0.0.

8CVSS6.7AI score0.00152EPSS
CVE
CVE•added 2021/10/19 6:15 p.m.•30 views

CVE-2021-32664

Combodo iTop is an open source web based IT Service Management tool. In affected versions there is a XSS vulnerability on "run query" page when logged as administrator. This has been resolved in versions 2.6.5 and 2.7.5.

8.1CVSS5.3AI score0.00423EPSS
CVE
CVE•added 2025/05/14 3:15 p.m.•27 views

CVE-2025-24022

iTop is an web based IT Service Management tool. Prior to versions 2.7.12, 3.1.3, and 3.2.1, server code execution is possible through the frontend of iTop's portal. This is fixed in versions 2.7.12, 3.1.3 and 3.2.1.

8.5CVSS7.6AI score0.00107EPSS
CVE
CVE•added 2023/10/25 6:17 p.m.•25 views

CVE-2023-34446

iTop is an open source, web-based IT service management platform. Prior to versions 3.0.4 and 3.1.0, when displaying pages/preferences.php, cross site scripting is possible. This issue is fixed in versions 3.0.4 and 3.1.0.

8.8CVSS6.9AI score0.0078EPSS