Advisories · Technology
Combodo iTop.
Every CVE that names Combodo iTop among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 5.3 Medium
Combodo iTop 3.1.0 through 3.3.0 Missing Authorization via LinkSetController
- Combodo iTop
- Broken access control
- CVSS 8.7 High
Combodo iTop: PHP Object Injection Leading to Remote Code Execution on user preferences
- Combodo iTop
- Code injection
- Insecure deserialization
- CVSS 8.9 High
Combodo iTop: Reflected XSS in dashboard revert
- Combodo iTop
- Cross-site scripting (XSS)
- CVSS 9.4 CriticalCritical · CVSS 9+
Combodo iTop: Remote code execution using external auth variable value
- Combodo iTop
- Code injection
- CVSS 6.5 Medium
Combodo iTop: Unauthenticated user can delete .readonly file
- Combodo iTop
- Authentication bypass
- CVSS 7.7 High
Combodo iTop: Access control bypass via OQL joins
- Combodo iTop
- Information disclosure
- CVSS 6.5 Medium
Combodo iTop: Improper access control in ajax.render.php and ajax.document.php
- Combodo iTop
- Broken access control
- CVSS 8.6 High
Combodo iTop: Authentication bypass in exec.php allows PHP file execution
- Combodo iTop
- Authentication bypass
- CVSS 3.5 Low
Combodo iTop: Information disclosure in ajax.render.php
- Combodo iTop
- Information disclosure
- CVSS 8.8 High
Combodo iTop: Reflected XSS in foreign key search criteria
- Combodo iTop
- Cross-site scripting (XSS)
- CVSS 4.3 Medium
Combodo iTop: Object can be locked by a user without write permissions
- Combodo iTop
- Broken access control
- CVSS 8.8 High
Combodo iTop: Unauthorized access to object information via search operation
- Combodo iTop
- Broken access control
- CVSS 8.0 High
Combodo iTop: Reflected XSS in universal search
- Combodo iTop
- Cross-site scripting (XSS)
- CVSS 8.0 High
Combodo iTop: Reflected XSS in tag admin
- Combodo iTop
- Cross-site scripting (XSS)
- CVSS 8.0 High
Combodo iTop: Reflected XSS in synchro/synchro_import.php
- Combodo iTop
- Cross-site scripting (XSS)
- CVSS 7.1 High
Combodo iTop: Reflected XSS in dashboard save
- Combodo iTop
- Cross-site scripting (XSS)
- CVSS 8.0 High
Combodo iTop: Reflected XSS in run_query.php
- Combodo iTop
- Cross-site scripting (XSS)
- CVSS 7.3 High
Combodo iTop: Reflected XSS in /pages/ajax.render.php dashboard_id parameter
- Combodo iTop
- Cross-site scripting (XSS)
- CVSS 7.5 High
Combodo iTop: Weak secret generation for inline image
- Combodo iTop
- Weak cryptography or TLS
- CWE-331
- CVSS 5.3 Medium
Combodo iTop: Version disclosure via login page logo
- Combodo iTop
- Information disclosure
- CVSS 7.5 High
Combodo iTop: User enumeration via password reset
- Combodo iTop
- CWE-204
- CVSS 7.5 High
Combodo iTop: Insecured access to uploaded images via sniffed url
- Combodo iTop
- Information disclosure
- Authentication bypass
- CVSS 7.1 High
Combodo iTop vulnerable to reflected XSS in webservices/export.php
- Combodo iTop
- Cross-site scripting (XSS)
- CVSS 8.7 High
iTop admin can drop iTop database using webhooks
- Combodo iTop
- Broken access control
- CVSS 4.3 Medium
Combodo iTop vulnerable to IDOR with ModuleInstallation object
- Combodo iTop
- Broken access control
- CVSS 8.8 High
Combodo iTop vulnerable to reflected XSS via objection edition form error
- Combodo iTop
- Cross-site scripting (XSS)
- CVSS 8.5 High
Combodo iTop has stored XSS in user portal's browse brick
- Combodo iTop
- Cross-site scripting (XSS)
- CVSS 8.8 High
Combodo iTop vulnerable to reflected XSS in ajax.render.php render_dashboard
- Combodo iTop
- Cross-site scripting (XSS)
- CVSS 8.8 High
Combodo iTop has XSS vulnerability in /pages/ajax.render.php
- Combodo iTop
- Cross-site scripting (XSS)
- CVSS 8.6 High
Combodo iTop vulnerable to Remote Code Execution in the backup creation functionality
- Combodo iTop
- Other injection
- CVSS 5.0 Medium
iTop portal user can see any other contact's picture
- Combodo iTop
- Broken access control
- CVSS 4.3 Medium
iTop dashboard vulnerable to denial of service
- Combodo iTop
- CWE-20
- CVSS 5.3 Medium
iTop Inefficient Regular Expression Complexity vulnerability
- Combodo iTop
- Denial of service
- CVSS 8.6 High
iTop server vulnerable to portal code injection
- Combodo iTop
- Command injection
- CVSS 5.0 Medium
iTop doesn't have mass assignment of fields in the portal form
- Combodo iTop
- Broken access control
- CVSS 6.3 Medium
iTop vulnerable to Self XSS in CSV Import
- Combodo iTop
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
iTop portal Insecure Direct Object Reference vulnerability
- Combodo iTop
- Broken access control
- CVSS 6.8 Medium
Combodo iTop vulnerable to stored self Cross-site Scripting in preferences
- Combodo iTop
- Cross-site scripting (XSS)
- CVSS 7.9 High
Combodo iTop vulnerable to XSS leading to CSRF breach on _table_id parameter
- Combodo iTop
- Cross-site scripting (XSS)
- Cross-site request forgery (CSRF)
- CVSS 8.1 High
Reflected Cross-site Scripting exploit in Combodo iTop
- Combodo iTop
- Cross-site scripting (XSS)
- CVSS 4.3 Medium
Portal user is able to access forbidden services information in Combodo iTop
- Combodo iTop
- Information disclosure
- CVSS 7.6 High
Cross-Site Request Forgery (CSRF) in several iTop pages
- Combodo iTop
- Cross-site request forgery (CSRF)
- CVSS 3.4 Low
Password is stored in clear in the database in Combodo iTop
- Combodo iTop
- Information disclosure
- CVSS 7.1 High
Cross-site Scripting in portal picture upload in Combodo iTop
- Combodo iTop
- Cross-site scripting (XSS)
- CVSS 7.1 High
Logic bug in ajax.render.php allows for bypass of 'backOffice' access control in Combodo iTop
- Combodo iTop
- Broken access control
- CVSS 4.3 Medium
SSRF through arbitrary PHP class instantiation in the user portal in Combodo iTop
- Combodo iTop
- Server-side request forgery (SSRF)
- CVSS 7.5 High
Users enumeration allowed through Rest API in Combodo iTop
- Combodo iTop
- Information disclosure
- CVSS 5.8 Medium
iTop hub connector Information disclosure
- Combodo iTop
- Information disclosure
- CVSS 8.8 High
CSRF security issue on CSV import in Combodo iTop
- Combodo iTop
- Cross-site request forgery (CSRF)
- CVSS 8.8 High
Cross-site Scripting vulnerability in link CSV import in Combodo iTop
- Combodo iTop
- Cross-site scripting (XSS)
- CVSS 8.8 High
Cross-site Scripting vulnerability on pages/ajax.render.php in Combodo iTop
- Combodo iTop
- Cross-site scripting (XSS)
- CVSS 8.8 High
Cross-site Scripting vulnerability on pages/ajax.searchform.php in Combodo iTop
- Combodo iTop
- Cross-site scripting (XSS)
- CVSS 8.8 High
Cross-site Scripting vulnerability in the run_query.php page in Combodo iTop
- Combodo iTop
- Cross-site scripting (XSS)
- CVSS 9.8 CriticalCritical · CVSS 9+
iTop limit pages/exec.php script to PHP files
- Combodo iTop
- Information disclosure
- CVSS 8.0 High
iTop vulnerable to potential formula injection in Excel/CSV export file
- Combodo iTop
- Other injection
- CVSS 8.8 High
iTop vulnerable to XSS vulnerability in authent-token
- Combodo iTop
- Cross-site scripting (XSS)
- CVSS 8.8 High
iTop vulnerable to XSS vulnerability in dashlet refresh
- Combodo iTop
- Cross-site scripting (XSS)
- CVSS 8.7 High
iTop vulnerable to XSS vulnerability in n:n relations "tagset" widget
- Combodo iTop
- Cross-site scripting (XSS)
- CVSS 4.1 Medium
iTop missing silo check on extkey in console and portal
- Combodo iTop
- Broken access control
- CVSS 6.8 Medium
iTop vulnerable to XSS in dashlet modifications ajax endpoints
- Combodo iTop
- Cross-site scripting (XSS)