Combodo

Itop

81 Schwachstellen gefunden.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
6.1

CVE-2024-31448

  • EPSS 0.83%
  • Veröffentlicht 05.11.2024 00:15:03
  • Zuletzt bearbeitet 06.11.2024 14:31:08

Combodo iTop is a simple, web based IT Service Management tool. By filling malicious code in a CSV content, an Cross-site Scripting (XSS) attack can be performed when importing this content. This issue has been fixed in versions 3.1.2 and 3.2.0. All ...

9.8

CVE-2023-48710

  • EPSS 0.43%
  • Veröffentlicht 15.04.2024 18:15:09
  • Zuletzt bearbeitet 06.02.2025 21:03:10

iTop is an IT service management platform. Files from the `env-production` folder can be retrieved even though they should have restricted access. Hopefully, there is no sensitive files stored in that folder natively, but there could be from a thir...

8

CVE-2023-48709

  • EPSS 4.43%
  • Veröffentlicht 15.04.2024 18:15:08
  • Zuletzt bearbeitet 06.02.2025 21:02:53

iTop is an IT service management platform. When exporting data from backoffice or portal in CSV or Excel files, users' inputs may include malicious formulas that may be imported into Excel. As Excel 2016 does **not** prevent Remote Code Execution by...

6.1

CVE-2023-47626

  • EPSS 0.71%
  • Veröffentlicht 15.04.2024 18:15:08
  • Zuletzt bearbeitet 06.02.2025 21:00:28

iTop is an IT service management platform. When displaying/editing the user's personal tokens, XSS attacks are possible. This vulnerability is fixed in 3.1.1.

6.1

CVE-2023-47622

  • EPSS 0.71%
  • Veröffentlicht 15.04.2024 18:15:08
  • Zuletzt bearbeitet 06.02.2025 21:00:13

iTop is an IT service management platform. When dashlet are refreshed, XSS attacks are possible. This vulnerability is fixed in 3.0.4 and 3.1.1.

5.4

CVE-2023-47123

  • EPSS 0.72%
  • Veröffentlicht 15.04.2024 18:15:08
  • Zuletzt bearbeitet 06.02.2025 20:59:58

iTop is an IT service management platform. By filling malicious code in an object friendlyname / complementary name, an XSS attack can be performed when this object will displayed as an n:n relation item in another object. This vulnerability is fixe...

5.4

CVE-2023-45808

  • EPSS 0.28%
  • Veröffentlicht 15.04.2024 18:15:08
  • Zuletzt bearbeitet 06.02.2025 20:58:02

iTop is an IT service management platform. When creating or updating an object, extkey values aren't checked to be in the current user silo. In other words, by forging an http request, the user can create objects pointing to out of silo objects (for...

5.4

CVE-2023-44396

  • EPSS 0.84%
  • Veröffentlicht 15.04.2024 18:15:07
  • Zuletzt bearbeitet 06.02.2025 20:56:16

iTop is an IT service management platform. Dashlet edits ajax endpoints can be used to produce XSS. Fixed in iTop 2.7.10, 3.0.4, and 3.1.1.

5.4

CVE-2023-43790

  • EPSS 0.78%
  • Veröffentlicht 15.04.2024 17:15:07
  • Zuletzt bearbeitet 06.02.2025 20:56:06

iTop is an IT service management platform. By manipulating HTTP queries, a user can inject malicious content in the fields used for the object friendlyname value. This vulnerability is fixed in 3.1.1 and 3.2.0.

4.3

CVE-2023-38511

Exploit
  • EPSS 0.62%
  • Veröffentlicht 15.04.2024 17:15:06
  • Zuletzt bearbeitet 06.02.2025 20:55:41

iTop is an IT service management platform. Dashboard editor : can load multiple files and URL, and full path disclosure on dashboard config file. This vulnerability is fixed in 3.0.4 and 3.1.1.