Advisories · Technology

Combodo iTop.

Every CVE that names Combodo iTop among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2023-43790 CVE record

CVSS 5.7 Medium

iTop vulnerable to XSS in friendlyname in object details
- Combodo iTop
- Cross-site scripting (XSS)
Not analysed yet 15 Apr 2024
CVE-2023-38511 CVE record

CVSS 5.0 Medium

iTop Dashboard editor vulnerable dashboard config file parameter
- Combodo iTop
- Path traversal
Not analysed yet 15 Apr 2024
CVE-2023-34447 CVE record

CVSS 8.8 High

iTop XSS vulnerability on pages/UI.php
- Combodo iTop
- Cross-site scripting (XSS)
Not analysed yet 25 Oct 2023
CVE-2023-34446 CVE record

CVSS 8.8 High

iTop XSS vulnerability on pages/preferences.php
- Combodo iTop
- Cross-site scripting (XSS)
Not analysed yet 25 Oct 2023
CVE-2022-39216 CVE record

CVSS 7.4 High

Combodo iTop's weak password reset token leads to account takeover
- Combodo iTop
- Weak cryptography or TLS
Not analysed yet 14 Mar 2023
CVE-2022-39214 CVE record

CVSS 9.6 CriticalCritical · CVSS 9+, CVSS 7+ and EPSS

Authenticated users of Combodo iTop can take over any account
- Combodo iTop
- Broken access control
Not analysed yet 14 Mar 2023
CVE-2021-41162 CVE record

CVSS 9.3 CriticalCritical · CVSS 9+

Cross-site Scripting in Combodo iTop
- Combodo iTop
- Cross-site scripting (XSS)
Not analysed yet 21 Apr 2022
CVE-2022-24870 CVE record

CVSS 8.7 High

Stored Cross-site Scripting in Combodo iTop
- Combodo iTop
- Cross-site scripting (XSS)
Not analysed yet 21 Apr 2022
CVE-2021-41161 CVE record

CVSS 9.3 CriticalCritical · CVSS 9+

XSS in csvimport in 3.0.0-beta versions
- Combodo iTop
- Cross-site scripting (XSS)
Not analysed yet 21 Apr 2022
CVE-2022-24811 CVE record

CVSS 5.4 Medium

Cross-site Scripting in Combodo iTop
- Combodo iTop
- Cross-site scripting (XSS)
Not analysed yet 5 Apr 2022
CVE-2022-24780 CVE record

CVSS 8.8 High

Code Injection in Combodo iTop
- Combodo iTop
- Code injection
Not analysed yet 5 Apr 2022
CVE-2021-41245 CVE record

CVSS 6.5 Medium

Possible Cross-Site Request Forgery in Combodo iTop
- Combodo iTop
- Cross-site request forgery (CSRF)
Not analysed yet 5 Apr 2022
CVE-2021-32664 CVE record

CVSS 8.1 High

Reflected XSS in Combodo/iTop
- Combodo iTop
- Cross-site scripting (XSS)
Not analysed yet 19 Oct 2021
CVE-2021-32663 CVE record

CVSS 8.7 High

Unauthorized setup leads to SSRF in Combodo/iTop
- Combodo iTop
- Server-side request forgery (SSRF)
Not analysed yet 19 Oct 2021
CVE-2021-32776 CVE record

CVSS 6.8 Medium

No CSRF form token cleanup on Windows servers
- Combodo iTop
- Cross-site request forgery (CSRF)
Not analysed yet 21 Jul 2021
CVE-2021-32775 CVE record

CVSS 7.7 High

Any user can see any fields (including mailbox password) with GroupBy Dashlet
- Combodo iTop
- Information disclosure
Not analysed yet 21 Jul 2021
CVE-2021-21407 CVE record

CVSS 8.0 High

Portal : the CSRF token isn't validated
- Combodo iTop
- Cross-site request forgery (CSRF)
Not analysed yet 21 Jul 2021
CVE-2021-21406 CVE record

CVSS 5.8 Medium

Command Injection vulnerability in the Setup Wizard
- Combodo iTop
- Command injection
Not analysed yet 21 Jul 2021
CVE-2020-15221 CVE record

CVSS 6.8 Medium

XSS in the breadcrumbs
- Combodo iTop
- Cross-site scripting (XSS)
Not analysed yet 13 Jan 2021
CVE-2020-15220 CVE record

CVSS 6.1 Medium

Session fixation
- Combodo iTop
- Authentication bypass
Not analysed yet 13 Jan 2021
CVE-2020-15219 CVE record

CVSS 4.3 Medium

SQL query displayed on portal error
- Combodo iTop
- Information disclosure
Not analysed yet 13 Jan 2021
CVE-2020-15218 CVE record

CVSS 6.8 Medium

Admin pages are cached and can be embedded
- Combodo iTop
- Authentication bypass
Not analysed yet 13 Jan 2021
CVE-2020-4079 CVE record

CVSS 7.7 High

Information disclosure vulnerability in iTop
- Combodo iTop
- Information disclosure
Not analysed yet 12 Jan 2021
CVE-2020-12781 CVE record

CVSS 5.7 Medium

Combodo iTop - CSRF
- Combodo iTop
- Cross-site request forgery (CSRF)
Not analysed yet 10 Aug 2020
CVE-2020-12780 CVE record

CVSS 7.5 High

Combodo iTop - Security Misconfiguration
- Combodo iTop
Not analysed yet 10 Aug 2020
CVE-2020-12779 CVE record

CVSS 6.8 Medium

Combodo iTop - Stored XSS
- Combodo iTop
Not analysed yet 10 Aug 2020
CVE-2020-12778 CVE record

CVSS 7.4 High

Combodo iTop - Reflected XSS
- Combodo iTop
Not analysed yet 10 Aug 2020
CVE-2020-12777 CVE record

CVSS 7.5 High

Combodo iTop - Broken Access Control
- Combodo iTop
Not analysed yet 10 Aug 2020