CVE-2025-24021

MEDIUM Year: 2025
CVSS v3 Score
5.0
Medium
Weakness Type
CWE-862
View all →

Vulnerability Description

iTop is an web based IT Service Management tool. Prior to versions 2.7.12, 3.1.3, and 3.2.1, anyone with an account having portal access can set value to object fields when they're not supposed to. Versions 2.7.12, 3.1.3, and 3.2.1 contain a fix for the issue.

Related Vulnerabilities

CVE-2022-20394

MEDIUM
CVSS:5.0(Medium)

In getInputMethodWindowVisibleHeight of InputMethodManagerService.java, there is a possible way to determine when another app is showing an IME due to a missing permission check. This could lead to lo...

CWE-8622022

CVE-2024-0447

MEDIUM
CVSS:5.0(Medium)

The ArtiBot Free Chat Bot for WordPress WebSites plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the artibot_update function in all version...

CWE-8622024

CVE-2024-0451

MEDIUM
CVSS:5.0(Medium)

The AI ChatBot plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the openai_file_list_callback function in all versions up to, and including, 5.3.4...

CWE-8622024

CVE-2024-20355

MEDIUM
CVSS:5.0(Medium)

A vulnerability in the implementation of SAML 2.0 single sign-on (SSO) for remote access VPN services in Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Softw...

CWE-8622024

CVE-2024-42934

MEDIUM
CVSS:5.0(Medium)

OpenIPMI before 2.0.36 has an out-of-bounds array access (for authentication type) in the ipmi_sim simulator, resulting in denial of service or (with very low probability) authentication bypass or cod...

CWE-8622024

CVE-2024-43090

MEDIUM
CVSS:5.0(Medium)

In multiple locations, there is a possible cross-user image read due to a missing permission check. This could lead to local information disclosure with User execution privileges needed. User interact...

CWE-8622024