Combodo iTop (aka IT Operations Portal) any version

Users enumeration allowed through Rest API in Combodo iTop

Combodo iTop - Security Misconfiguration

Combodo iTop - Reflected XSS

Command injection vulnerability in Combodo iTop 2.4.1 allows remote authenticated administrators to execute arbitrary commands by changing the platform configuration, because web/env-production/itop-config/config.php contains a function called TestConfig() that calls the vulnerable function eval().

Logic bug in ajax.render.php allows for bypass of 'backOffice' access control in Combodo iTop

Cross-site Scripting in portal picture upload in Combodo iTop

Combodo iTop vulnerable to reflected XSS in webservices/export.php

Admin pages are cached and can be embedded

Combodo iTop - Stored XSS

XSS in the breadcrumbs

iTop vulnerable to XSS in dashlet modifications ajax endpoints

Combodo iTop vulnerable to stored self Cross-site Scripting in preferences

iTop portal Insecure Direct Object Reference vulnerability

iTop vulnerable to Self XSS in CSV Import

Cross-site scripting (XSS) vulnerability in application/dashboard.class.inc.php in Combodo iTop before 2.2.0-2459 allows remote attackers to inject arbitrary web script or HTML via a dashboard title.

Because of a lack of sanitization around error messages, multiple Reflective XSS issues exist in iTop through 2.6.0 via the param_file parameter to webservices/export.php, webservices/cron.php, or env-production/itop-backup/backup.php. By default, any XSS sent to the administrator can be transformed to remote command execution because of CVE-2018-10642 (still working through 2.6.0) The Reflective XSS can also become a stored XSS within the same account because of another vulnerability.

In iTop through 2.6.0, an XSS payload can be delivered in certain fields (such as icon) of the XML file used to build the dashboard. This is similar to CVE-2015-6544 (which is only about the dashboard title).

Session fixation

In Combodo iTop a menu shortcut name can be exploited with a stored XSS payload. This is fixed in all iTop packages (community, essential, professional) in version 2.7.0 and iTop essential and iTop professional in version 2.6.4.

In Combodo iTop, dashboard ids can be exploited with a reflective XSS payload. This is fixed in all iTop packages (community, essential, professional) for version 2.7.0 and in iTop essential and iTop professional packages for version 2.6.4.

iTop hub connector Information disclosure

iTop vulnerable to XSS in friendlyname in object details

Cross-site Scripting in Combodo iTop

iTop missing silo check on extkey in console and portal

iTop Inefficient Regular Expression Complexity vulnerability

iTop Dashboard editor vulnerable dashboard config file parameter

iTop portal user can see any other contact's picture

iTop doesn't have mass assignment of fields in the portal form

Multiple cross-site scripting (XSS) vulnerabilities in the search feature in iTop (aka IT Operations Portal) 2.0, 1.2.1, 1.2, and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) text parameter to pages/UI.php or (2) expression parameter to pages/run_query.php. NOTE: some of these details are obtained from third party information.

SQL query displayed on portal error

Portal user is able to access forbidden services information in Combodo iTop

iTop dashboard vulnerable to denial of service

Combodo iTop vulnerable to IDOR with ModuleInstallation object

Password is stored in clear in the database in Combodo iTop