itop vulnerabilities and exploits

(subscribe to this query)

NA

Multiple cross-site scripting (XSS) vulnerabilities in the search feature in iTop (aka IT Operations Portal) 2.0, 1.2.1, 1.2, and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) text parameter to pages/UI.php or (2) expression parameter to...

Combodo Itop 1.2.1 Combodo Itop 1.2 Combodo Itop 1.0.2 Combodo Itop 0.8 Combodo Itop 0.7.2 Combodo Itop 2.0 Combodo Itop 1.1 Combodo Itop 0.9 Combodo Itop 0.8.1.3 Combodo Itop 1.2.0 Combodo Itop 1.0.1 Combodo Itop 1.0 Combodo Itop 0.7.1 Combodo Itop Combodo Itop 1.1.181 Combodo Itop 0.9.1

6.1

CVSSv3

Combodo iTop does not validate inputted parameters, attackers can inject malicious commands and launch XSS attack....

Combodo Itop Combodo Itop 2.7.01 Github repository available

8.8

CVSSv3

Combodo iTop is a web based IT Service Management tool. In versions prior to 2.7.4, CSRF tokens can be reused by a malicious user, as on Windows servers no cleanup is done on CSRF tokens. This issue is fixed in versions 2.7.4 and 3.0.0....

Combodo Itop Combodo Itop 3.0.0

5.4

CVSSv3

Combodo iTop contains a stored Cross-site Scripting vulnerability, which can be attacked by uploading file with malicious script....

Combodo Itop Combodo Itop 2.7.01 Github repository available

8.8

CVSSv3

Combodo iTop contains a cross-site request forgery (CSRF) vulnerability, attackers can execute specific commands via malicious site request forgery....

Combodo Itop Combodo Itop 2.7.01 Github repository available

7.7

CVSSv3

Combodo iTop is a web based IT Service Management tool. In iTop before versions 2.7.2 and 2.8.0, when the ajax endpoint for the "excel export" portal functionality is called directly it allows getting data without scope filtering. This allows a user to access data they...

Combodo Itop Combodo Itop 2.7.3

6.1

CVSSv3

Combodo iTop is a web based IT Service Management tool. In 3.0.0 beta releases prior to beta6 the `ajax.render.php?operation=wizard_helper` page did not properly escape the user supplied parameters, allowing for a cross site scripting attack vector. Users are advised to upgrade....

Combodo Itop 3.0.0 Combodo Itop

6.1

CVSSv3

Combodo iTop is a web based IT Service Management tool. In versions prior to 3.0.0-beta6 the export CSV page don't properly escape the user supplied parameters, allowing for javascript injection into rendered csv files. Users are advised to upgrade. There are no known...

Combodo Itop 3.0.0 Combodo Itop

7.5

CVSSv3

A function in Combodo iTop contains a vulnerability of Broken Access Control, which allows unauthorized attacker to inject command and disclose system information....

Combodo Itop Combodo Itop 2.7.01 Github repository available

5.4

CVSSv3

Combodo iTop is a web based IT Service Management tool. In iTop before versions 2.7.2 and 3.0.0, by modifying target browser local storage, an XSS can be generated in the iTop console breadcrumb. This is fixed in versions 2.7.2 and 3.0.0....

Combodo Itop Combodo Itop 3.0.0

Get Started

1 2 3 4 NEXT »

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook