7.2
CVE-2023-4855 -
A command injection vulnerability was identified in SMM/SMM2 and FPC that could allow an authenticated user with elevated privileges to execute unauthorized commands via IPMI.
9.8
CVE-2023-48710 - iTop limit pages/exec.php script to PHP files
iTop is an IT service management platform. Files from the `env-production` folder can be retrieved even though they should have restricted access. Hopefully, there is no sensitive files stored in that folder natively, but there could be from a third-party module. The `pages/exec.php` script as …
8
CVE-2023-48709 - iTop vulnerable to potential formula injection in Excel/CSV export file
iTop is an IT service management platform. When exporting data from backoffice or portal in CSV or Excel files, users' inputs may include malicious formulas that may be imported into Excel. As Excel 2016 does **not** prevent Remote Code Execution by default, uninformed users may become victims. Th…
8.8
CVE-2023-47626 - iTop vulnerable to XSS vulnerability in authent-token
iTop is an IT service management platform. When displaying/editing the user's personal tokens, XSS attacks are possible. This vulnerability is fixed in 3.1.1.
8.8
CVE-2023-47622 - iTop vulnerable to XSS vulnerability in dashlet refresh
iTop is an IT service management platform. When dashlet are refreshed, XSS attacks are possible. This vulnerability is fixed in 3.0.4 and 3.1.1.
8.7
CVE-2023-47123 - iTop vulnerable to XSS vulnerability in n:n relations "tagset" widget
iTop is an IT service management platform. By filling malicious code in an object friendlyname / complementary name, an XSS attack can be performed when this object will displayed as an n:n relation item in another object. This vulnerability is fixed in 3.1.1 and 3.2.0.
6.1
CVE-2024-23559 - HCL DevOps Deploy / Launch is generating an obsolete HTTP header
HCL DevOps Deploy / Launch is generating an obsolete HTTP header.
4.1
CVE-2023-45808 - iTop missing silo check on extkey in console and portal
iTop is an IT service management platform. When creating or updating an object, extkey values aren't checked to be in the current user silo. In other words, by forging an http request, the user can create objects pointing to out of silo objects (for example a UserRequest in an out of scope Organiz…
6.8
CVE-2023-44396 - iTop vulnerable to XSS in dashlet modifications ajax endpoints
iTop is an IT service management platform. Dashlet edits ajax endpoints can be used to produce XSS. Fixed in iTop 2.7.10, 3.0.4, and 3.1.1.
5.7
CVE-2023-43790 - iTop vulnerable to XSS in friendlyname in object details
iTop is an IT service management platform. By manipulating HTTP queries, a user can inject malicious content in the fields used for the object friendlyname value. This vulnerability is fixed in 3.1.1 and 3.2.0.