CVE-2020-12778

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

Combodo iTop does not validate inputted parameters, attackers can inject malicious commands and launch XSS attack.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Aug 10, 2020
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2020

CVE-2020-127795.4Combodo iTop contains a stored Cross-site Scripting vulnerability, which can be attacked by uploading file with malicious script.CVE-2020-12787.8An elevation of privilege vulnerability exists when the Diagnostics Hub Standard Collector Service improperly handles file operations, aka 'CVE-2020-127807.5A security misconfiguration exists in Combodo iTop, which can expose sensitive information.CVE-2020-127818.8Combodo iTop contains a cross-site request forgery (CSRF) vulnerability, attackers can execute specific commands via malicious site request CVE-2020-127829.8Openfind MailGates contains a Command Injection flaw, when receiving email with specific strings, malicious code in the mail attachment willCVE-2020-127837.5Exim through 4.93 has an out-of-bounds read in the SPA authenticator that could result in SPA/NTLM authentication bypass in auths/spa.c and CVE-2020-127845.3cPanel before 86.0.14 allows remote attackers to trigger a bandwidth suspension via mail log strings (SEC-505).CVE-2020-127858.1cPanel before 86.0.14 allows attackers to obtain access to the current working directory via the account backup feature (SEC-540).CVE-2020-127877.5Microchip Atmel ATSAMA5 products in Secure Mode allow an attacker to bypass existing security mechanisms related to applet handling.CVE-2020-127887.5CMAC verification functionality in Microchip Atmel ATSAMA5 products is vulnerable to vulnerable to timing and power analysis attacks.CVE-2020-127897.5The Secure Monitor in Microchip Atmel ATSAMA5 products use a hardcoded key to encrypt and authenticate secure applets.CVE-2020-12797.8An elevation of privilege vulnerability exists when Windows Lockscreen fails to properly load spotlight images from a secure location, aka '
CVE-2020-12778: Medium severity, CVSS 6.1 | Vulnix