CVE-2022-31883

Marval MSM v14.19.0.12476 is affected by an Insecure Direct Object Reference (IDOR) vulnerability. A low-privilege user can view other users’ API keys, including Admins’ API keys. Root cause: IDOR flaw in the application’s handling of user/API key access. Impact stated in the provided sources is ...

CVE-2022-31883

Marval MSM v14.19.0.12476 is has an Insecure Direct Object Reference IDOR vulnerability. A low privilege user is able to see other users API Keys including the Admins API Keys...

LinkedIn: IDOR allows an attacker to delete anyone's featured photo.

An Insecure Direct Object Reference IDOR vulnerability allowed an attacker to delete anyone's featured photo on LinkedIn by manipulating the parameters in the delete request. This vulnerability was exploited by obtaining the necessary parameters from the victim's profile link and replacing them i...

CVE-2022-30760

An Insecure Direct Object Reference IDOR issue in fn2Web in ihb eG FlexNow before 2.04.09.016 allows remote authenticated attackers to obtain sensitive student information final grades, study courses, degrees by changing the student ID parameter in the HTTP POST request to the FrontControllerSS...

CVE-2022-30760

Vulnerability context: CVE-2022-30760 affects the ihb eG FlexNow product (fn2Web) prior to version 2.04.09.016. The issue is an insecure direct object reference (IDOR) that allows remote authenticated users to access sensitive student data by altering the student ID parameter in a POST to the Fro...

Idor Lead to Archive Users

Description In this case a attacker can be able to archive any user of any targeted organization Proof of Concept 1. Attacker create new organization OrgA 2. Attacker add any user to his organization OrgA And archive the user 3. Capture this request in burp suite 4. victim is user of organization...

IDOR in Messages function

Description An user can view other users' private messages, join the conversation, delete messages if they know messages uuid Proof of Concept 1. A send B a priavte messages/email 2. C can view messages, join the conversation, delete messages if C know messages uuid...

Automattic: Sensei LMS IDOR to send message

Hi there, hope you are doing great. So, there is an option to send message to teacher privately by student on Sensei LMS. Each message sent by student will have different ID, Student1 cannot access or send message to the message from Student2 which is meant to be private with teacher Similarly...

LinkedIn: IDOR - Delete technical skill assessment result & Gained Badges result of any user

The web app is vulnerable to IDOR at DELETE /voyager/api/voyagerAssessmentsDashSkillAssessmentAttemptReports/urn%3Ali%3AfsdskillAssessmentAttemptReport%3Aurn%3Ali%3Afsdprofile%███%2Curn%3Ali%3Askill%3A280%2C1 HTTP request. Allows an attacker to delete the skill assessment result of any user's...

CVE-2022-29627

An insecure direct object reference IDOR in Online Market Place Site v1.0 allows attackers to modify products that are owned by other sellers...

Code injection

An insecure direct object reference IDOR in Online Market Place Site v1.0 allows attackers to modify products that are owned by other sellers...

TikTok: IDOR in family pairing API

Vulnerability description not provided...

CVE-2022-29627

The CVE-2022-29627 entry describes an insecure direct object reference (IDOR) in Online Market Place Site v1.0 that lets an attacker modify products owned by other sellers. Affected component: the Online Market Place Site application (v1.0). Root cause: IDOR weakness enabling unauthorized modific...

CVE-2022-29627

An insecure direct object reference IDOR in Online Market Place Site v1.0 allows attackers to modify products that are owned by other sellers...

CVE-2022-30495

In oretnom23 Automotive Shop Management System v1.0, the name id parameter is vulnerable to IDOR - Broken Access Control allowing attackers to change the admin passwordvertical privilege escalation...

Improper access control

In oretnom23 Automotive Shop Management System v1.0, the name id parameter is vulnerable to IDOR - Broken Access Control allowing attackers to change the admin passwordvertical privilege escalation...

CVE-2022-30495

Affected software: oretnom23 Automotive Shop Management System v1.0. The vulnerability is an IDOR / Broken Access Control in the name id parameter that allows vertical privilege escalation to change the admin password. Root cause: improper access control on an identifier parameter. Documented imp...

CVE-2022-30495

In oretnom23 Automotive Shop Management System v1.0, the name id parameter is vulnerable to IDOR - Broken Access Control allowing attackers to change the admin passwordvertical privilege escalation...

Stripe: Mass Account Takeover at https://app.taxjar.com/ - No user Interaction

@beerboyankit discovered an IDOR in the user invite link in Taxjar. This could have allowed an attacker to take over a user's account. The vulnerability was caused by a leaked token in the delete invitation request feature and resolved by using the invitation ID instead of the token to look up th...

GHSA-G39C-MCCF-RXJV Moodle Insecure direct object reference (IDOR) in a calendar web service

A flaw was found in Moodle in versions 3.11 to 3.11.3, 3.10 to 3.10.7, 3.9 to 3.9.10 and earlier unsupported versions. Insufficient capability checks made it possible to fetch other users' calendar action events...