CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2024-31448 – Cross-site Scripting vulnerability in link CSV import in Combodo iTop
https://notcve.org/view.php?id=CVE-2024-31448
Combodo iTop is a simple, web based IT Service Management tool. By filling malicious code in a CSV content, an Cross-site Scripting (XSS) attack can be performed when importing this content. This issue has been fixed in versions 3.1.2 and 3.2.0. All users are advised to upgrade. Users unable to upgrade should validate CSV content before importing it. • https://github.com/Combodo/iTop/security/advisories/GHSA-776w-x6v7-vfwf • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.8EPSS: 0%CPEs: 2EXPL: 0CVE-2023-34445 – Cross-site Scripting vulnerability on pages/ajax.render.php in Combodo iTop
https://notcve.org/view.php?id=CVE-2023-34445
Combodo iTop is a simple, web based IT Service Management tool. When displaying pages/ajax.render.php XSS are possible for scripts outside of script tags. This issue has been fixed in versions 2.7.9, 3.0.4, 3.1.0. All users are advised to upgrade. There are no known workarounds for this vulnerability. • https://github.com/Combodo/iTop/security/advisories/GHSA-mm45-wh68-jpvq • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.8EPSS: 0%CPEs: 2EXPL: 0CVE-2023-34444 – Cross-site Scripting vulnerability on pages/ajax.searchform.php in Combodo iTop
https://notcve.org/view.php?id=CVE-2023-34444
Combodo iTop is a simple, web based IT Service Management tool. When displaying pages/ajax.searchform.php XSS are possible for scripts outside of script tags. This issue has been fixed in versions 2.7.9, 3.0.4, 3.1.0. All users are advised to upgrade. There are no known workarounds for this vulnerability. • https://github.com/Combodo/iTop/security/advisories/GHSA-rwx9-rcxf-qrwv • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.8EPSS: 0%CPEs: 2EXPL: 0CVE-2023-34443 – Cross-site Scripting vulnerability in the run_query.php page in Combodo iTop
https://notcve.org/view.php?id=CVE-2023-34443
Combodo iTop is a simple, web based IT Service Management tool. When displaying page Run queries Cross-site Scripting (XSS) are possible for scripts outside of script tags. This has been fixed in versions 2.7.9, 3.0.4, 3.1.0. All users are advised to upgrade. There are no known workarounds for this vulnerability. • https://github.com/Combodo/iTop/security/advisories/GHSA-9mx6-pwpp-j3xx https://huntr.dev/bounties/c230d55d-1f0e-40c3-8c7e-20587d3e54da/?token=4d1195d5a50a9f0f7ae9fc24a2b0a3bd907427edaf7ee6ac1f8f31c11d8b7a5d2c204957125e63fd7cf3a87df6d5d12a35f9c7107ba5f33b5f668fa199a36932448b9bf186daa62cb32b5635770730eb68eeeba079b8864ab00358fd0dc65fa406d986525814a14951db2025e117f0098a1f270f5a5b2c935a65b00b5106e5511b61d501c4357654cb8ea76b • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.8EPSS: 0%CPEs: 3EXPL: 0CVE-2023-48710 – iTop limit pages/exec.php script to PHP files
https://notcve.org/view.php?id=CVE-2023-48710
iTop is an IT service management platform. Files from the `env-production` folder can be retrieved even though they should have restricted access. Hopefully, there is no sensitive files stored in that folder natively, but there could be from a third-party module. The `pages/exec.php` script as been fixed to limit execution of PHP files only. Other file types won't be retrieved and exposed. The vulnerability is fixed in 2.7.10, 3.0.4, 3.1.1, and 3.2.0. iTop es una plataforma de gestión de servicios de TI. • https://github.com/Combodo/iTop/commit/3b2da39469f7a4636ed250ed0d33f4efff38be26 https://github.com/Combodo/iTop/security/advisories/GHSA-g652-q7cc-7hfc • CWE-552: Files or Directories Accessible to External Parties •