Skip to content
OpenAdvisories

Vendor

Combodo

88 known vulnerabilities.

Products

iTop 88
All Critical High Medium Low Exploited only Public exploit

51 results · Clear filters · Feed

  • High 7.4
    CVE-2022-39216

    Combodo iTop's weak password reset token leads to account takeover

    Combodo iTop is an open source, web-based IT service management platform. Prior to versions 2.7.8 and 3.0.2-1, the reset password token is generated without any randomness parameter. This may lead to account takeover. The issue is fixed in versions 2.7.8 and …

    Combodo iTop
  • High 8.7
    CVE-2022-24870

    Stored Cross-site Scripting in Combodo iTop

    Combodo iTop is a web based IT Service Management tool. In 3.0.0 beta releases prior to 3.0.0 beta3 a malicious script can be injected in tooltips using iTop customization mechanism. This provides a stored cross site scripting attack vector to authorized user…

    Combodo iTop
  • High 8.8
    CVE-2022-24780 Public exploit

    Code Injection in Combodo iTop

    Combodo iTop is a web based IT Service Management tool. In versions prior to 2.7.6 and 3.0.0, users of the iTop user portal can send TWIG code to the server by forging specific http queries, and execute arbitrary code on the server using http server user priv…

    Combodo iTop
  • High 8.1
    CVE-2021-32664

    Reflected XSS in Combodo/iTop

    Combodo iTop is an open source web based IT Service Management tool. In affected versions there is a XSS vulnerability on "run query" page when logged as administrator. This has been resolved in versions 2.6.5 and 2.7.5.

    Combodo iTop
  • High 8.7
    CVE-2021-32663

    Unauthorized setup leads to SSRF in Combodo/iTop

    iTop is an open source web based IT Service Management tool. In affected versions an attacker can call the system setup without authentication. Given specific parameters this can lead to SSRF. This issue has been resolved in versions 2.6.5 and 2.7.5 and later

    Combodo iTop
  • High 7.7
    CVE-2021-32775

    Any user can see any fields (including mailbox password) with GroupBy Dashlet

    Combodo iTop is a web based IT Service Management tool. In versions prior to 2.7.4, a non admin user can get access to many class/field values through GroupBy Dashlet error message. This issue is fixed in versions 2.7.4 and 3.0.0.

    Combodo iTop
  • High 8.0
    CVE-2021-21407

    Portal : the CSRF token isn't validated

    Combodo iTop is an open source, web based IT Service Management tool. Prior to version 2.7.4, the CSRF token validation can be bypassed through iTop portal via a tricky browser procedure. The vulnerability is patched in version 2.7.4 and 3.0.0.

    Combodo iTop
  • High 7.7
    CVE-2020-4079

    Information disclosure vulnerability in iTop

    Combodo iTop is a web based IT Service Management tool. In iTop before versions 2.7.2 and 2.8.0, when the ajax endpoint for the "excel export" portal functionality is called directly it allows getting data without scope filtering. This allows a user to access…

    Combodo iTop
  • High 7.5
    CVE-2020-12780

    Combodo iTop - Security Misconfiguration

    A security misconfiguration exists in Combodo iTop, which can expose sensitive information.

    Combodo iTop
  • High 7.4
    CVE-2020-12778

    Combodo iTop - Reflected XSS

    Combodo iTop does not validate inputted parameters, attackers can inject malicious commands and launch XSS attack.

    Combodo iTop
  • High 7.5
    CVE-2020-12777

    Combodo iTop - Broken Access Control

    A function in Combodo iTop contains a vulnerability of Broken Access Control, which allows unauthorized attacker to inject command and disclose system information.

    Combodo iTop