CVE-2020-12781

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Combodo iTop contains a cross-site request forgery (CSRF) vulnerability, attackers can execute specific commands via malicious site request forgery.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-352

Affected software

VendorProductVersions
CombodoiTop<= 2.7.0-beta2

References

Timeline

Published
Aug 10, 2020
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2020

CVE-2020-127829.8Openfind MailGates contains a Command Injection flaw, when receiving email with specific strings, malicious code in the mail attachment willCVE-2020-127837.5Exim through 4.93 has an out-of-bounds read in the SPA authenticator that could result in SPA/NTLM authentication bypass in auths/spa.c and CVE-2020-127845.3cPanel before 86.0.14 allows remote attackers to trigger a bandwidth suspension via mail log strings (SEC-505).CVE-2020-127858.1cPanel before 86.0.14 allows attackers to obtain access to the current working directory via the account backup feature (SEC-540).CVE-2020-127877.5Microchip Atmel ATSAMA5 products in Secure Mode allow an attacker to bypass existing security mechanisms related to applet handling.CVE-2020-127887.5CMAC verification functionality in Microchip Atmel ATSAMA5 products is vulnerable to vulnerable to timing and power analysis attacks.CVE-2020-127897.5The Secure Monitor in Microchip Atmel ATSAMA5 products use a hardcoded key to encrypt and authenticate secure applets.CVE-2020-12797.8An elevation of privilege vulnerability exists when Windows Lockscreen fails to properly load spotlight images from a secure location, aka 'CVE-2020-127907.5In the SEOmatic plugin before 3.2.49 for Craft CMS, helpers/DynamicMeta.php does not properly sanitize the URL. This leads to Server-Side TeCVE-2020-127975.3HashiCorp Consul and Consul Enterprise failed to enforce changes to legacy ACL token rules due to non-propagation to secondary data centers.CVE-2020-127987.8Cellebrite UFED 5.0 to 7.5.0.845 implements local operating system policies that can be circumvented to obtain a command prompt via the WindCVE-2020-12807.8An elevation of privilege vulnerability exists in the way that the Windows Bluetooth Service handles objects in memory, aka 'Windows Bluetoo
CVE-2020-12781: High severity, CVSS 8.8 | Vulnix