Viliald

**Name of the Vulnerable Software and Affected Versions** Combodo iTop versions prior to 3.1.2 Combodo iTop versions prior to 3.2.0 **Description** The issue is related to a Cross-site Scripting (XSS) attack that can be performed when importing malicious CSV content. This can be done by filling malicious code in a CSV content. The estimated number of potentially affected devices worldwide is not specified. There is no information about real-world incidents where this issue was exploited. **Recommendations** For versions prior to 3.1.2, upgrade to version 3.1.2 or later. For versions prior to 3.2.0, upgrade to version 3.2.0 or later. As a temporary workaround for users unable to upgrade, validate CSV content before importing it to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Combodo iTop versions prior to 3.1.2 Combodo iTop versions prior to 3.2.0 **Description** A CSRF issue can be performed on CSV import simulation in Combodo iTop, allowing an attacker to forge malicious requests. There are no known workarounds for this issue. **Recommendations** For Combodo iTop versions prior to 3.1.2, upgrade to version 3.1.2 or later to resolve the issue. For Combodo iTop versions prior to 3.2.0, upgrade to version 3.2.0 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** ampache (affected versions not specified) **Description** A Cross-Site Request Forgery (CSRF) attack can be performed to delete objects such as playlists and smartlists. This attack forces authenticated users to submit a request to a web application against which they are currently authenticated. The issue can be exploited by creating a malicious script with an arbitrary playlist ID belonging to another user, resulting in the deletion of the user's playlist without their consent. Any user with an active session who is tricked into submitting a malicious request is impacted. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Navidrome versions prior to 0.52.0 **Description** Navidrome is an open source web-based music collection server and streamer. The issue is a parameter tampering vulnerability where an attacker can manipulate parameter values in the HTTP requests, allowing them to impersonate another user. This can be done by changing the parameter values in the body, and the attacker must be able to intercept HTTP traffic for this attack. Each known user is impacted, and an attacker can obtain the `ownerId` from shared playlist information, meaning every user who has shared a playlist is also impacted, as they can be impersonated. **Recommendations** For Navidrome versions prior to 0.52.0, upgrade to version 0.52.0 to address the issue. As a temporary workaround, consider restricting access to shared playlists and limiting the ability to intercept HTTP traffic. Avoid using shared playlist information to minimize the risk of exploitation. There are no known workarounds for this vulnerability other than upgrading to the fixed version.

**Name of the Vulnerable Software and Affected Versions** iTop versions prior to 3.1.1 iTop versions prior to 3.2.0 **Description** iTop is an IT service management platform. By manipulating HTTP queries, a user can inject malicious content in the fields used for the object friendlyname value. **Recommendations** For versions prior to 3.1.1, update to version 3.1.1 or later to resolve the issue. For versions prior to 3.2.0, update to version 3.2.0 or later to resolve the issue. As a temporary workaround, consider restricting access to HTTP queries that can manipulate the object friendlyname value until a patch is available.