Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
173 results · page 2 of 4
May 29, 2025Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes.CVE-2025-47933 · Other software · argoproj · reported by GitHubCritical 9
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Prior to versions 2.13.8, 2.14.13, and 3.0.4, an attacker can perform arbitrary actions on behalf of the victim via the API. Due to the improper filtering of URL protocols in the repository page, an attacker can achieve cross-site scripting with permission to edit the repository. This issue has been patched in versions 2.13.8, 2.14.13, and 3.0.4.
- Product
- argo-cd
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 14, 2025iTop is an web based IT Service Management tool.CVE-2025-24969 · Other software · Combodo · reported by GitHubMedium 5
iTop is an web based IT Service Management tool. Prior to version 3.2.1, a portal user can see any other contacts picture by changing the picture ID in the URL. Version 3.2.1 contains a patch for the issue.
- Product
- iTop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 14, 2025iTop is an web based IT Service Management tool.CVE-2025-24785 · Other software · Combodo · reported by GitHubMedium 4.3
iTop is an web based IT Service Management tool. In version 3.2.0, an attacker may send a URL to the server to trigger a PHP error. The next user trying to load this dashboard would encounter a crashed start page. Version 3.2.1 fixes the issue by checking the provided layout_class before saving the dashboard.
- Product
- iTop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 14, 2025iTop is an web based IT Service Management tool.CVE-2025-24026 · Other software · Combodo · reported by GitHubMedium 5.3
iTop is an web based IT Service Management tool. Versions prior to 3.2.1 are vulnerable to regular expression denial of service (ReDoS) that may, under some circumstances, affect iTop server. Version 3.2.1 doesn't use the affected variable in the regular expression. As a workaround, if iTop app_root_url is defined in the configuration file, then there is no possible way to exploit this ReDoS.
- Product
- iTop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 14, 2025iTop is an web based IT Service Management tool.CVE-2025-24022 · Other software · Combodo · reported by GitHubHigh 8.5
iTop is an web based IT Service Management tool. Prior to versions 2.7.12, 3.1.3, and 3.2.1, server code execution is possible through the frontend of iTop's portal. This is fixed in versions 2.7.12, 3.1.3 and 3.2.1.
- Product
- iTop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 14, 2025iTop is an web based IT Service Management tool.CVE-2025-24021 · Other software · Combodo · reported by GitHubMedium 5
iTop is an web based IT Service Management tool. Prior to versions 2.7.12, 3.1.3, and 3.2.1, anyone with an account having portal access can set value to object fields when they're not supposed to. Versions 2.7.12, 3.1.3, and 3.2.1 contain a fix for the issue.
- Product
- iTop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 14, 2025iTop is an web based IT Service Management tool.CVE-2024-56157 · Other software · Combodo · reported by GitHubMedium 6.3
iTop is an web based IT Service Management tool. Prior to versions 3.1.3 and 3.2.1, by filling malicious code in a CSV content, a cross-site scripting attack can be performed when importing this content. The issue is fixed in versions 3.1.3 and 3.2.1. As a workaround, check CSV content before importing it.
- Product
- iTop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 14, 2025iTop is an web based IT Service Management tool.CVE-2024-52601 · Other software · Combodo · reported by GitHubMedium 6.5
iTop is an web based IT Service Management tool. Prior to versions 2.7.12, 3.1.3, and 3.2.1, anyone with an account having portal access can have read access to objects they're not allowed to see by querying an unprotected route. Versions 2.7.12, 3.1.3, and 3.2.1 contain a fix for the issue.
- Product
- iTop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 17, 2025TuriTop Booking System: Deserialization of Untrusted DataCVE-2025-32571 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in TuriTop TuriTop Booking System turitop-booking-system allows Object Injection.This issue affects TuriTop Booking System: from n/a through <= 1.0.10.
- Product
- TuriTop Booking System
- Affected
- up to 1.0.10
- What to do
- Affects up to 1.0.10. Update TuriTop Booking System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 3, 2025TuriTop Booking System: Missing AuthorizationCVE-2025-31541 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in TuriTop TuriTop Booking System turitop-booking-system allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects TuriTop Booking System: from n/a through <= 1.0.10.
- Product
- TuriTop Booking System
- Affected
- up to 1.0.10
- What to do
- Affects up to 1.0.10. Update TuriTop Booking System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 25, 2025Combodo iTop is a web based IT service management tool.CVE-2025-27139 · Other software · Combodo · reported by GitHubMedium 6.8
Combodo iTop is a web based IT service management tool. Versions prior to 2.7.12, 3.1.2, and 3.2.0 are vulnerable to cross-site scripting when the preferences page is opened. Versions 2.7.12, 3.1.2, and 3.2.0 fix the issue.
- Product
- iTop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 30, 2025Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes.CVE-2025-23216 · Other software · argoproj · reported by GitHubMedium 6.8
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. A vulnerability was discovered in Argo CD that exposed secret values in error messages and the diff view when an invalid Kubernetes Secret resource was synced from a repository. The vulnerability assumes the user has write access to the repository and can exploit it, either intentionally or unintentionally, by committing an invalid Secret to repository and triggering a Sync. Once exploited, any user with read access to Argo CD can view the exposed secret data. The vulnerability is fixed in v2.13.4, v2.12.10, and v2.11.13.
- Product
- argo-cd
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 28, 2025A flaw was found in openshift-gitops-operator-container.CVE-2024-13484 · Other software · Red Hat · reported by Red HatHigh 8.2
A flaw was found in openshift-gitops-operator-container. The openshift.io/cluster-monitoring label is applied to all namespaces that deploy an ArgoCD CR instance, allowing the namespace to create a rogue PrometheusRule. This issue can have adverse effects on the platform monitoring stack, as the rule is rolled out cluster-wide when the label is applied.
- Product
- Red Hat OpenShift GitOps 1.14
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
Jan 23, 2025A DLL hijacking vulnerability in iTop VPN v16.0 allows attackers to execute arbitrary code via placing a crafted DLL file into the path \ProgramData\iTop VPN\DoCVE-2024-53588 · Other software · reported by MITREHigh 7.8
A DLL hijacking vulnerability in iTop VPN v16.0 allows attackers to execute arbitrary code via placing a crafted DLL file into the path \ProgramData\iTop VPN\Downloader\vpn6.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 13, 2024Combodo iTop is an open source and web-based IT service management platform.CVE-2024-54139 · Other software · Combodo · reported by GitHubHigh 7.9
Combodo iTop is an open source and web-based IT service management platform. Prior to versions 2.7.11, 3.1.2, and 3.2.0., iTop has a cross-site scripting vulnerability that can lead to cross-site request forgery on the `_table_id` parameter. Versions 2.7.11, 3.1.2, and 3.2.0 contain a patch for the issue.
- Product
- iTop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 8, 2024Combodo iTop is a simple, web based IT Service Management tool.CVE-2024-52002 · Other software · Combodo · reported by GitHubHigh 8.8
Combodo iTop is a simple, web based IT Service Management tool. Several url endpoints are subject to a Cross-Site Request Forgery (CSRF) vulnerability. Please refer to the linked GHSA for the complete list. This issue has been addressed in version 3.2.0 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- iTop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 8, 2024Combodo iTop is a simple, web based IT Service Management tool.CVE-2024-52001 · Other software · Combodo · reported by GitHubMedium 4.3
Combodo iTop is a simple, web based IT Service Management tool. In affected versions portal users are able to access forbidden services information. This issue has been addressed in version 3.2.0. All users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- iTop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 8, 2024Combodo iTop is a simple, web based IT Service Management tool.CVE-2024-52000 · Other software · Combodo · reported by GitHubMedium 6.1
Combodo iTop is a simple, web based IT Service Management tool. Affected versions are subject to a reflected Cross-site Scripting (XSS) exploit by way of editing a request's payload which can lead to malicious javascript execution. This issue has been addressed in version 3.2.0 via systematic escaping of error messages when rendering on the page. All users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- iTop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 7, 2024Combodo iTop is a web based IT Service Management tool.CVE-2024-51995 · Other software · Combodo · reported by GitHubHigh 7.1
Combodo iTop is a web based IT Service Management tool. An attacker can request any `route` we want as long as we specify an `operation` that is allowed. This issue has been addressed in version 3.2.0 by applying the same access control pattern as in `UI.php` to the `ajax.render.php` page which does not allow arbitrary `routes` to be dispatched. All users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- iTop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 7, 2024Combodo iTop is a web based IT Service Management tool.CVE-2024-51994 · Other software · Combodo · reported by GitHubMedium 5.4
Combodo iTop is a web based IT Service Management tool. In affected versions uploading a text file containing some java script in the portal will trigger an Cross-site Scripting (XSS) vulnerability. This issue has been addressed in version 3.2.0 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- iTop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 7, 2024Combodo iTop is a web based IT Service Management tool.CVE-2024-51993 · Other software · Combodo · reported by GitHubLow 3.4
Combodo iTop is a web based IT Service Management tool. An attacker accessing a backup file or the database can read some passwords for misconfigured Users. This issue has been addressed in version 3.2.0 and all users are advised to upgrade. Users unable to upgrade are advised to encrypt their backups independently of the iTop application. ### Patches Sanitize parameter ### References N°7631 - Password is stored in clear in the database.
- Product
- iTop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 5, 2024Combodo iTop is a simple, web based IT Service Management tool.CVE-2024-51740 · Other software · Combodo · reported by GitHubMedium 4.3
Combodo iTop is a simple, web based IT Service Management tool. This vulnerability can be used to create HTTP requests on behalf of the server, from a low privileged user. The user portal form manager has been fixed to only instantiate classes derived from it. This issue has been addressed in versions 2.7.11, 3.0.5, 3.1.2, and 3.2.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- iTop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 5, 2024Combodo iTop is a simple, web based IT Service Management tool.CVE-2024-51739 · Other software · Combodo · reported by GitHubHigh 7.5
Combodo iTop is a simple, web based IT Service Management tool. Unauthenticated user can perform users enumeration, which can make it easier to bruteforce a valid account. As a fix the sentence displayed after resetting password no longer shows if the user exists or not. This fix is included in versions 2.7.11, 3.0.5, 3.1.2, and 3.2.0. Users are advised to upgrade. Users unable to upgrade may overload the dictionary entry `"UI:ResetPwd-Error-WrongLogin"` through an extension and replace it with a generic message.
- Product
- iTop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 4, 2024Combodo iTop is a simple, web based IT Service Management tool.CVE-2024-32870 · Other software · Combodo · reported by GitHubMedium 5.8
Combodo iTop is a simple, web based IT Service Management tool. Server, OS, DBMS, PHP, and iTop info (name, version and parameters) can be read by anyone having access to iTop URI. This issue has been patched in versions 2.7.11, 3.0.5, 3.1.2, and 3.2.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- iTop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 4, 2024Combodo iTop is a simple, web based IT Service Management tool.CVE-2024-31998 · Other software · Combodo · reported by GitHubHigh 8.8
Combodo iTop is a simple, web based IT Service Management tool. A CSRF can be performed on CSV import simulation. This issue has been fixed in versions 3.1.2 and 3.2.0. All users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- iTop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 4, 2024Combodo iTop is a simple, web based IT Service Management tool.CVE-2024-31448 · Other software · Combodo · reported by GitHubHigh 8.8
Combodo iTop is a simple, web based IT Service Management tool. By filling malicious code in a CSV content, an Cross-site Scripting (XSS) attack can be performed when importing this content. This issue has been fixed in versions 3.1.2 and 3.2.0. All users are advised to upgrade. Users unable to upgrade should validate CSV content before importing it.
- Product
- iTop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 4, 2024Combodo iTop is a simple, web based IT Service Management tool.CVE-2023-34445 · Other software · Combodo · reported by GitHubHigh 8.8
Combodo iTop is a simple, web based IT Service Management tool. When displaying pages/ajax.render.php XSS are possible for scripts outside of script tags. This issue has been fixed in versions 2.7.9, 3.0.4, 3.1.0. All users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- iTop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 4, 2024Combodo iTop is a simple, web based IT Service Management tool.CVE-2023-34444 · Other software · Combodo · reported by GitHubHigh 8.8
Combodo iTop is a simple, web based IT Service Management tool. When displaying pages/ajax.searchform.php XSS are possible for scripts outside of script tags. This issue has been fixed in versions 2.7.9, 3.0.4, 3.1.0. All users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- iTop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 4, 2024Combodo iTop is a simple, web based IT Service Management tool.CVE-2023-34443 · Other software · Combodo · reported by GitHubHigh 8.8
Combodo iTop is a simple, web based IT Service Management tool. When displaying page Run queries Cross-site Scripting (XSS) are possible for scripts outside of script tags. This has been fixed in versions 2.7.9, 3.0.4, 3.1.0. All users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- iTop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 31, 2024A vulnerability was found in IObit iTop Data Recovery Pro 4.4.0.687.CVE-2024-7324 · Other software · IObit · reported by VulDBHigh 8.5
A vulnerability was found in IObit iTop Data Recovery Pro 4.4.0.687. It has been declared as critical. Affected by this vulnerability is an unknown functionality in the library madbasic_.bpl of the component BPL Handler. The manipulation leads to uncontrolled search path. Local access is required to approach this attack. The associated identifier of this vulnerability is VDB-273247. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- iTop Data Recovery Pro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 24, 2024Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes.CVE-2024-41666 · Other software · argoproj · reported by GitHubMedium 4.7
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Argo CD has a Web-based terminal that allows users to get a shell inside a running pod, just as they would with kubectl exec. Starting in version 2.6.0, when the administrator enables this function and grants permission to the user `p, role:myrole, exec, create, */*, allow`, even if the user revokes this permission, the user can still perform operations in the container, as long as the user keeps the terminal view open for a long time. Although the token expiration and revocation of the user are fixed, however, the fix does not address the situation of revocation of only user `p, role:myrole, exec, create, */*, allow` permissions, which may still lead to the leakage of sensitive information. A patch for this vulnerability has been released in Argo CD versions 2.11.7, 2.10.16, and 2.9.21.
- Product
- argo-cd
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comgithub.com
Jul 22, 2024Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes.CVE-2024-40634 · Other software · argoproj · reported by GitHubHigh 7.5
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. This report details a security vulnerability in Argo CD, where an unauthenticated attacker can send a specially crafted large JSON payload to the /api/webhook endpoint, causing excessive memory allocation that leads to service disruption by triggering an Out Of Memory (OOM) kill. The issue poses a high risk to the availability of Argo CD deployments. This vulnerability is fixed in 2.11.6, 2.10.15, and 2.9.20.
- Product
- argo-cd
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 6, 2024Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes.CVE-2024-37152 · Other software · argoproj · reported by GitHubMedium 5.3
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. The vulnerability allows unauthorized access to the sensitive settings exposed by /api/v1/settings endpoint without authentication. All sensitive settings are hidden except passwordPattern. This vulnerability is fixed in 2.11.3, 2.10.12, and 2.9.17.
- Product
- argo-cd
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 6, 2024Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes.CVE-2024-36106 · Other software · argoproj · reported by GitHubMedium 4.3
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. It’s possible for authenticated users to enumerate clusters by name by inspecting error messages. It’s also possible to enumerate the names of projects with project-scoped clusters if you know the names of the clusters. This vulnerability is fixed in 2.11.3, 2.10.12, and 2.9.17.
- Product
- argo-cd
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 21, 2024Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes.CVE-2024-31989 · Other software · argoproj · reported by GitHubCritical 9
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. It has been discovered that an unprivileged pod in a different namespace on the same cluster could connect to the Redis server on port 6379. Despite having installed the latest version of the VPC CNI plugin on the EKS cluster, it requires manual enablement through configuration to enforce network policies. This raises concerns that many clients might unknowingly have open access to their Redis servers. This vulnerability could lead to Privilege Escalation to the level of cluster controller, or to information leakage, affecting anyone who does not have strict access controls on their Redis instance. This issue has been patched in version(s) 2.8.19, 2.9.15 and 2.10.10.
- Product
- argo-cd
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 14, 2024Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes.CVE-2024-32476 · Other software · argoproj · reported by GitHubMedium 6.5
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. There is a Denial of Service (DoS) vulnerability via OOM using jq in ignoreDifferences. This vulnerability has been patched in version(s) 2.10.7, 2.9.12 and 2.8.16.
- Product
- argo-cd
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2024Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes.CVE-2024-31990 · Other software · argoproj · reported by GitHubMedium 4.8
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. The API server does not enforce project sourceNamespaces which allows attackers to use the UI to edit resources which should only be mutable via gitops. This vulenrability is fixed in 2.10.7, 2.9.12, and 2.8.16.
- Product
- argo-cd
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2024iTop is an IT service management platform.CVE-2023-48710 · Other software · Combodo · reported by GitHubCritical 9.8
iTop is an IT service management platform. Files from the `env-production` folder can be retrieved even though they should have restricted access. Hopefully, there is no sensitive files stored in that folder natively, but there could be from a third-party module. The `pages/exec.php` script as been fixed to limit execution of PHP files only. Other file types won't be retrieved and exposed. The vulnerability is fixed in 2.7.10, 3.0.4, 3.1.1, and 3.2.0.
- Product
- iTop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2024iTop is an IT service management platform.CVE-2023-48709 · Other software · Combodo · reported by GitHubHigh 8
iTop is an IT service management platform. When exporting data from backoffice or portal in CSV or Excel files, users' inputs may include malicious formulas that may be imported into Excel. As Excel 2016 does **not** prevent Remote Code Execution by default, uninformed users may become victims. This vulnerability is fixed in 2.7.9, 3.0.4, 3.1.1, and 3.2.0.
- Product
- iTop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2024iTop is an IT service management platform.CVE-2023-47626 · Other software · Combodo · reported by GitHubHigh 8.8
iTop is an IT service management platform. When displaying/editing the user's personal tokens, XSS attacks are possible. This vulnerability is fixed in 3.1.1.
- Product
- iTop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2024iTop is an IT service management platform.CVE-2023-47622 · Other software · Combodo · reported by GitHubHigh 8.8
iTop is an IT service management platform. When dashlet are refreshed, XSS attacks are possible. This vulnerability is fixed in 3.0.4 and 3.1.1.
- Product
- iTop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2024iTop is an IT service management platform.CVE-2023-47123 · Other software · Combodo · reported by GitHubHigh 8.7
iTop is an IT service management platform. By filling malicious code in an object friendlyname / complementary name, an XSS attack can be performed when this object will displayed as an n:n relation item in another object. This vulnerability is fixed in 3.1.1 and 3.2.0.
- Product
- iTop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2024iTop is an IT service management platform.CVE-2023-45808 · Other software · Combodo · reported by GitHubMedium 4.1
iTop is an IT service management platform. When creating or updating an object, extkey values aren't checked to be in the current user silo. In other words, by forging an http request, the user can create objects pointing to out of silo objects (for example a UserRequest in an out of scope Organization). Fixed in iTop 2.7.10, 3.0.4, 3.1.1, and 3.2.0.
- Product
- iTop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2024iTop is an IT service management platform.CVE-2023-44396 · Other software · Combodo · reported by GitHubMedium 6.8
iTop is an IT service management platform. Dashlet edits ajax endpoints can be used to produce XSS. Fixed in iTop 2.7.10, 3.0.4, and 3.1.1.
- Product
- iTop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2024iTop is an IT service management platform.CVE-2023-43790 · Other software · Combodo · reported by GitHubMedium 5.7
iTop is an IT service management platform. By manipulating HTTP queries, a user can inject malicious content in the fields used for the object friendlyname value. This vulnerability is fixed in 3.1.1 and 3.2.0.
- Product
- iTop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2024iTop is an IT service management platform.CVE-2023-38511 · Other software · Combodo · reported by GitHubMedium 5
iTop is an IT service management platform. Dashboard editor : can load multiple files and URL, and full path disclosure on dashboard config file. This vulnerability is fixed in 3.0.4 and 3.1.1.
- Product
- iTop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 29, 2024Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes.CVE-2024-29893 · Other software · argoproj · reported by GitHubMedium 6.5
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. All versions of ArgoCD starting from v2.4 have a bug where the ArgoCD repo-server component is vulnerable to a Denial-of-Service attack vector. Specifically, it's possible to crash the repo server component through an out of memory error by pointing it to a malicious Helm registry. The loadRepoIndex() function in the ArgoCD's helm package, does not limit the size nor time while fetching the data. It fetches it and creates a byte slice from the retrieved data in one go. If the registry is implemented to push data continuously, the repo server will keep allocating memory until it runs out of it. A patch for this vulnerability has been released in v2.10.3, v2.9.8, and v2.8.12.
- Product
- argo-cd
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 21, 2024An issue in iTop DualSafe Password Manager & Digital Vault before 1.4.24 allows a local attacker to obtain sensitive information via leaked credentials as plainCVE-2024-24272 · Other software · Itopvpn · reported by MITREHigh 7.1
An issue in iTop DualSafe Password Manager & Digital Vault before 1.4.24 allows a local attacker to obtain sensitive information via leaked credentials as plaintext in a log file that can be accessed by the local user without knowledge of the master secret.
- Product
- Dualsafe Password Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordresearch.hisolutions.comresearch.hisolutions.com
Mar 18, 2024Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes.CVE-2024-21662 · Other software · argoproj · reported by GitHubHigh 7.5
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Prior to versions 2.8.13, 2.9.9, and 2.10.4, an attacker can effectively bypass the rate limit and brute force protections by exploiting the application's weak cache-based mechanism. This loophole in security can be combined with other vulnerabilities to attack the default admin account. This flaw undermines a patch for CVE-2020-8827 intended to protect against brute-force attacks. The application's brute force protection relies on a cache mechanism that tracks login attempts for each user. This cache is limited to a `defaultMaxCacheSize` of 1000 entries. An attacker can overflow this cache by bombarding it with login attempts for different users, thereby pushing out the admin account's failed attempts and effectively resetting the rate limit for that account. This is a severe vulnerability that enables attackers to perform brute force attacks at an accelerated rate, especially targeting the default admin account. Users should upgrade to version 2.8.13, 2.9.9, or 2.10.4 to receive a patch.
- Product
- argo-cd
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordargo-cd.readthedocs.iogithub.com
Mar 18, 2024Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes.CVE-2024-21661 · Other software · argoproj · reported by GitHubHigh 7.5
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Prior to versions 2.8.13, 2.9.9, and 2.10.4, an attacker can exploit a critical flaw in the application to initiate a Denial of Service (DoS) attack, rendering the application inoperable and affecting all users. The issue arises from unsafe manipulation of an array in a multi-threaded environment. The vulnerability is rooted in the application's code, where an array is being modified while it is being iterated over. This is a classic programming error but becomes critically unsafe when executed in a multi-threaded environment. When two threads interact with the same array simultaneously, the application crashes. This is a Denial of Service (DoS) vulnerability. Any attacker can crash the application continuously, making it impossible for legitimate users to access the service. The issue is exacerbated because it does not require authentication, widening the pool of potential attackers. Versions 2.8.13, 2.9.9, and 2.10.4 contain a patch for this issue.
- Product
- argo-cd
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.