2042 matches found
Spoofing
Insecure direct object references IDOR vulnerability in the wpForo Forum plugin = 2.0.5 on WordPress allows attackers with subscriber or higher user roles to mark any forum post as solved/unsolved...
Spoofing
Insecure direct object references IDOR vulnerability in the wpForo Forum plugin = 2.0.5 on WordPress allows attackers with subscriber or higher user roles to mark any forum post as private/public...
CVE-2022-40206 WordPress wpForo Forum plugin <= 2.0.5 - Insecure direct object references (IDOR) vulnerability
Insecure direct object references IDOR vulnerability in the wpForo Forum plugin = 2.0.5 on WordPress allows attackers with subscriber or higher user roles to mark any forum post as private/public...
CVE-2022-40206
Summary (CVE-2022-40206) Insecure Direct Object References (IDOR) in the WordPress wpForo Forum plugin <= 2.0.5. Affected component: wpForo Forum plugin for WordPress. Root cause: IDOR allows users with subscriber or higher roles to change a forum post’s visibility to private/public. Impact: e...
CVE-2022-40206 WordPress wpForo Forum plugin <= 2.0.5 - Insecure direct object references (IDOR) vulnerability
Insecure direct object references IDOR vulnerability in the wpForo Forum plugin = 2.0.5 on WordPress allows attackers with subscriber or higher user roles to mark any forum post as private/public...
CVE-2022-40205 WordPress wpForo Forum plugin <= 2.0.5 - Insecure direct object references (IDOR) vulnerability
Insecure direct object references IDOR vulnerability in the wpForo Forum plugin = 2.0.5 on WordPress allows attackers with subscriber or higher user roles to mark any forum post as solved/unsolved...
CVE-2022-40205
The CVE-2022-40205 vulnerability concerns the WordPress wpForo Forum plugin, versions = 2.0.6) to resolve the issue.
grafana: IDOR vulnerability can lead to information disclosure
An Insecure Direct Object Reference IDOR vulnerability was found on Grafana Teams APIs. This flaw impacts the /teams/:teamId, /teams/:search, /teams/:teamId/members API endpoints and may allow an authenticated attacker to view unintended data by querying for the specific team ID or search for tea...
PT-2022-25283 · WordPress · Wpforo Forum
Name of the Vulnerable Software and Affected Versions: wpForo Forum plugin versions = 2.0.5 Description: The issue is related to an insecure direct object references IDOR vulnerability. This vulnerability allows attackers with subscriber or higher user roles to mark any forum post as private or...
CVE-2021-36906
Multiple Insecure Direct Object References IDOR vulnerabilities in ExpressTech Quiz And Survey Master plugin = 7.3.6 on WordPress...
Design/Logic Flaw
Multiple Insecure Direct Object References IDOR vulnerabilities in ExpressTech Quiz And Survey Master plugin = 7.3.6 on WordPress...
CVE-2021-36906 WordPress Quiz And Survey Master plugin <= 7.3.6 - Multiple Insecure direct object references (IDOR) vulnerabilities
Multiple Insecure Direct Object References IDOR vulnerabilities in ExpressTech Quiz And Survey Master plugin = 7.3.6 on WordPress...
CVE-2021-36906
The CVE refers to IDOR vulnerabilities in the ExpressTech Quiz And Survey Master WordPress plugin, specifically versions up to 7.3.6. The root cause is insufficient authorization checks that allow insecure direct object references, enabling actions such as deleting or duplicating quizzes by users...
CVE-2022-39945
Summary (CVE-2022-39945) : FortiMail contains an improper access control vulnerability (CWE-284) that can allow an authenticated admin user, when assigned to a specific domain, to access and modify information for other domains via insecure direct object references (IDOR). Affected FortiMail vers...
CVE-2022-39945
An improper access control vulnerability CWE-284 in FortiMail 7.2.0, 7.0.0 through 7.0.3, 6.4 all versions, 6.2 all versions, 6.0 all versions may allow an authenticated admin user assigned to a specific domain to access and modify other domains information via insecure direct object references...
CVE-2022-39945
An improper access control vulnerability CWE-284 in FortiMail 7.2.0, 7.0.0 through 7.0.3, 6.4 all versions, 6.2 all versions, 6.0 all versions may allow an authenticated admin user assigned to a specific domain to access and modify other domains information via insecure direct object references...
FortiMail - Inter-domain information leakage
An improper access control vulnerability CWE-284 in FortiMail may allow an authenticated admin user assigned to a specific domain to access and modify other domains information via insecure direct object references IDOR...
Train Scheduler App 1.0 Insecure Direct Object Reference
Exploit Title: Train Scheduler App v1.0 - Insecure Direct Object Reference IDOR to "delete user id " Exploit Author: Rohit Sharma Vendor Name: oretnom23 Vendor Homepage: https://www.sourcecodester.com/php/15720/train-scheduler-app-using-php-oop-and-mysql-database-free-download.html Software Link:...
Nextcloud: Possibility to delete files attached to deck cards of other users
Hi everyone, Hope you are well ! I come to report here an IDOR vulnerability on the Deck application of Nextcloud, allowing to delete any attached files on any cards. Nextcloud deck app version : latest stable 1.8.0 Steps To Reproduce: The Nextcloud Deck application now offers the ability to add ...
WordPress Comments – wpDiscuz plugin 7.4.2 - Insecure Direct Object References (IDOR) vulnerability
Insecure Direct Object References IDOR vulnerability discovered by Dhakal Ananda in WordPress Comments – wpDiscuz plugin versions 7.4.2. Solution Update the WordPress wpDiscuz plugin to the latest available version at least 7.5...