CVE-2020-15221

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

Combodo iTop is a web based IT Service Management tool. In iTop before versions 2.7.2 and 3.0.0, by modifying target browser local storage, an XSS can be generated in the iTop console breadcrumb. This is fixed in versions 2.7.2 and 3.0.0.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Jan 13, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-152228.1In ORY Fosite (the security first OAuth2 & OpenID Connect framework for Go) before version 0.31.0, when using "private_key_jwt" authenticati CVE-2020-152238.0In ORY Fosite (the security first OAuth2 & OpenID Connect framework for Go) before version 0.34.0, the `TokenRevocationHandler` ignores erro CVE-2020-152246.8In Open Enclave before version 0.12.0, an information disclosure vulnerability exists when an enclave application using the syscalls provide CVE-2020-152256.5django-filter is a generic system for filtering Django QuerySets based on user selections. In django-filter before version 2.4.0, automatica CVE-2020-152264.3In GLPI before version 9.5.2, there is a SQL Injection in the API's search function. Not only is it possible to break the SQL syntax, but it CVE-2020-152279.8Nette versions before 2.0.19, 2.1.13, 2.2.10, 2.3.14, 2.4.16, 3.0.6 are vulnerable to an code injection attack by passing specially formed p CVE-2020-152285.0In the `@actions/core` npm module before version 1.2.6,`addPath` and `exportVariable` functions communicate with the Actions Runner over std CVE-2020-152299.3Singularity (an open source container platform) from version 3.1.1 through 3.6.3 has a vulnerability. Due to insecure handling of path trave CVE-2020-15238.9<p>A tampering vulnerability exists when Microsoft SharePoint Server fails to properly handle profile data. An attacker who successfully exp CVE-2020-152306.5Vapor is a web framework for Swift. In Vapor before version 4.29.4, Attackers can access data at arbitrary filesystem paths on the same host CVE-2020-152316.1In mapfish-print before version 3.24, a user can use the JSONP support to do a Cross-site scripting.CVE-2020-152329.1In mapfish-print before version 3.24, a user can do to an XML External Entity (XXE) attack with the provided SDL style.