Lucene search
K
Database
Vendors
Products
Timeline
Vulnerabilities
Perimeter Scanner
Scanning
Projects
Scanner
Agent Scanning
API Scanning
Manual Audit
Email
Webhook
Resources
Documents
Blog
Glossary
FAQ
Plugins
Pricing
Contacts
About Us
Partners
Branding Guideline
Settings
Sign in
CombodoItop

12 matches found

CVE
CVE•added 2020/06/05 10:15 p.m.•120 views

CVE-2020-11696

In Combodo iTop a menu shortcut name can be exploited with a stored XSS payload. This is fixed in all iTop packages (community, essential, professional) in version 2.7.0 and iTop essential and iTop professional in version 2.6.4.

6.1CVSS5.8AI score0.00359EPSS
CVE
CVE•added 2020/06/05 9:15 p.m.•116 views

CVE-2020-11697

In Combodo iTop, dashboard ids can be exploited with a reflective XSS payload. This is fixed in all iTop packages (community, essential, professional) for version 2.7.0 and in iTop essential and iTop professional packages for version 2.6.4.

6.1CVSS5.9AI score0.00359EPSS
CVE
CVE•added 2020/02/14 10:15 p.m.•114 views

CVE-2019-13967

iTop 2.2.0 through 2.6.0 allows remote attackers to cause a denial of service (application outage) via many requests to launch a compile operation. The requests use the pages/exec.php?exec_env=production&exec_module=itop-hub-connector&exec_page=ajax.php&operation=compile URI. This only affects the ...

7.5CVSS7.4AI score0.00716EPSS
CVE
CVE•added 2020/02/14 10:15 p.m.•110 views

CVE-2019-13966

In iTop through 2.6.0, an XSS payload can be delivered in certain fields (such as icon) of the XML file used to build the dashboard. This is similar to CVE-2015-6544 (which is only about the dashboard title).

6.1CVSS5.8AI score0.51077EPSS
CVE
CVE•added 2020/02/14 10:15 p.m.•106 views

CVE-2019-13965

Because of a lack of sanitization around error messages, multiple Reflective XSS issues exist in iTop through 2.6.0 via the param_file parameter to webservices/export.php, webservices/cron.php, or env-production/itop-backup/backup.php. By default, any XSS sent to the administrator can be transforme...

6.1CVSS6.3AI score0.03996EPSS
CVE
CVE•added 2020/02/14 6:15 p.m.•105 views

CVE-2019-11215

In Combodo iTop 2.2.0 through 2.6.0, if the configuration file is writable, then execution of arbitrary code can be accomplished by calling ajax.dataloader with a maliciously crafted payload. Many conditions can place the configuration file into a writable state: during installation; during upgrade...

8.1CVSS8.1AI score0.00463EPSS
CVE
CVE•added 2020/08/10 3:15 a.m.•53 views

CVE-2020-12777

A function in Combodo iTop contains a vulnerability of Broken Access Control, which allows unauthorized attacker to inject command and disclose system information.

7.5CVSS7.5AI score0.00316EPSS
CVE
CVE•added 2020/08/10 3:15 a.m.•47 views

CVE-2020-12780

A security misconfiguration exists in Combodo iTop, which can expose sensitive information.

7.5CVSS7.5AI score0.0028EPSS
CVE
CVE•added 2020/08/10 3:15 a.m.•44 views

CVE-2020-12778

Combodo iTop does not validate inputted parameters, attackers can inject malicious commands and launch XSS attack.

7.4CVSS6.4AI score0.00311EPSS
CVE
CVE•added 2020/08/10 3:15 a.m.•44 views

CVE-2020-12781

Combodo iTop contains a cross-site request forgery (CSRF) vulnerability, attackers can execute specific commands via malicious site request forgery.

8.8CVSS7.3AI score0.00131EPSS
CVE
CVE•added 2020/03/16 6:15 p.m.•43 views

CVE-2019-19821

A post-authentication privilege escalation in the web application of Combodo iTop allows regular authenticated users to access information and modify information with administrative privileges by not following the HTTP Location header in server responses. This is fixed in all iTop packages (communi...

8.1CVSS7.9AI score0.00487EPSS
CVE
CVE•added 2020/08/10 3:15 a.m.•39 views

CVE-2020-12779

Combodo iTop contains a stored Cross-site Scripting vulnerability, which can be attacked by uploading file with malicious script.

6.8CVSS5.5AI score0.00282EPSS