Filtered by vendor Combodo
Subscribe
Search
Total
14 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2023-47489 | 1 Combodo | 1 Itop | 2024-01-11 | N/A | 7.8 HIGH |
| CSV injection in export as csv in Combodo iTop v.3.1.0-2-11973 allows a local attacker to execute arbitrary code via a crafted script to the export-v2.php and ajax.render.php components. | |||||
| CVE-2022-24780 | 1 Combodo | 1 Itop | 2022-05-23 | 6.5 MEDIUM | 8.8 HIGH |
| Combodo iTop is a web based IT Service Management tool. In versions prior to 2.7.6 and 3.0.0, users of the iTop user portal can send TWIG code to the server by forging specific http queries, and execute arbitrary code on the server using http server user privileges. This issue is fixed in versions 2.7.6 and 3.0.0. There are currently no known workarounds. | |||||
| CVE-2020-12780 | 1 Combodo | 1 Itop | 2022-04-28 | 5.0 MEDIUM | 7.5 HIGH |
| A security misconfiguration exists in Combodo iTop, which can expose sensitive information. | |||||
| CVE-2021-32663 | 1 Combodo | 1 Itop | 2021-10-22 | 5.0 MEDIUM | 7.5 HIGH |
| iTop is an open source web based IT Service Management tool. In affected versions an attacker can call the system setup without authentication. Given specific parameters this can lead to SSRF. This issue has been resolved in versions 2.6.5 and 2.7.5 and later | |||||
| CVE-2021-32776 | 1 Combodo | 1 Itop | 2021-07-30 | 6.8 MEDIUM | 8.8 HIGH |
| Combodo iTop is a web based IT Service Management tool. In versions prior to 2.7.4, CSRF tokens can be reused by a malicious user, as on Windows servers no cleanup is done on CSRF tokens. This issue is fixed in versions 2.7.4 and 3.0.0. | |||||
| CVE-2021-21406 | 1 Combodo | 1 Itop | 2021-07-30 | 6.5 MEDIUM | 8.8 HIGH |
| Combodo iTop is an open source, web based IT Service Management tool. In versions prior to 2.7.4, there is a command injection vulnerability in the Setup Wizard when providing Graphviz executable path. The vulnerability is patched in version 2.7.4 and 3.0.0. | |||||
| CVE-2020-4079 | 1 Combodo | 1 Itop | 2021-01-14 | 4.0 MEDIUM | 7.7 HIGH |
| Combodo iTop is a web based IT Service Management tool. In iTop before versions 2.7.2 and 2.8.0, when the ajax endpoint for the "excel export" portal functionality is called directly it allows getting data without scope filtering. This allows a user to access data they which they should not have access to. This is fixed in versions 2.7.2 and 3.0.0. | |||||
| CVE-2020-12781 | 1 Combodo | 1 Itop | 2020-09-25 | 6.8 MEDIUM | 8.8 HIGH |
| Combodo iTop contains a cross-site request forgery (CSRF) vulnerability, attackers can execute specific commands via malicious site request forgery. | |||||
| CVE-2020-12777 | 1 Combodo | 1 Itop | 2020-09-25 | 5.0 MEDIUM | 7.5 HIGH |
| A function in Combodo iTop contains a vulnerability of Broken Access Control, which allows unauthorized attacker to inject command and disclose system information. | |||||
| CVE-2019-19821 | 1 Combodo | 1 Itop | 2020-08-24 | 5.5 MEDIUM | 8.1 HIGH |
| A post-authentication privilege escalation in the web application of Combodo iTop allows regular authenticated users to access information and modify information with administrative privileges by not following the HTTP Location header in server responses. This is fixed in all iTop packages (community, essential, professional) in versions : 2.5.4, 2.6.3, 2.7.0 | |||||
| CVE-2019-13967 | 1 Combodo | 1 Itop | 2020-08-24 | 5.0 MEDIUM | 7.5 HIGH |
| iTop 2.2.0 through 2.6.0 allows remote attackers to cause a denial of service (application outage) via many requests to launch a compile operation. The requests use the pages/exec.php?exec_env=production&exec_module=itop-hub-connector&exec_page=ajax.php&operation=compile URI. This only affects the community version. | |||||
| CVE-2019-11215 | 1 Combodo | 1 Itop | 2020-08-24 | 6.8 MEDIUM | 8.1 HIGH |
| In Combodo iTop 2.2.0 through 2.6.0, if the configuration file is writable, then execution of arbitrary code can be accomplished by calling ajax.dataloader with a maliciously crafted payload. Many conditions can place the configuration file into a writable state: during installation; during upgrade; in certain cases, an error during modification of the file from the web interface leaves the file writable (can be triggered with XSS); a race condition can be triggered by the hub-connector module (community version only from 2.4.1 to 2.6.0); or editing the file in a CLI. | |||||
| CVE-2019-10863 | 1 Combodo | 1 Teemip | 2020-08-24 | 6.5 MEDIUM | 7.2 HIGH |
| A command injection vulnerability exists in TeemIp versions before 2.4.0. The new_config parameter of exec.php allows one to create a new PHP file with the exception of config information. The malicious PHP code sent is executed instantaneously and is not saved on the server. | |||||
| CVE-2018-10642 | 1 Combodo | 1 Itop | 2019-10-03 | 6.5 MEDIUM | 7.2 HIGH |
| Command injection vulnerability in Combodo iTop 2.4.1 allows remote authenticated administrators to execute arbitrary commands by changing the platform configuration, because web/env-production/itop-config/config.php contains a function called TestConfig() that calls the vulnerable function eval(). | |||||