2973 matches found
CVE-2023-29290 Adobe Commerce Guest Cart Shipping Address Overwrite IDOR
Adobe Commerce versions 2.4.6 and earlier, 2.4.5-p2 and earlier and 2.4.4-p3 and earlier are affected by an Incorrect Authorization vulnerability that could result in a security feature bypass. An attacker could leverage this vulnerability to bypass a minor functionality. Exploitation of this iss...
CVE-2023-29288 Adobe Commerce | Incorrect Authorization (CWE-863)
Adobe Commerce versions 2.4.6 and earlier, 2.4.5-p2 and earlier and 2.4.4-p3 and earlier are affected by an Incorrect Authorization vulnerability that could result in a security feature bypass. A privileged attacker could leverage this vulnerability to modify a minor functionality of another user...
Critical Security Vulnerability Discovered in WooCommerce Stripe Gateway Plugin
A security flaw has been uncovered in the WooCommerce Stripe Gateway WordPress plugin that could lead to the unauthorized disclosure of sensitive information. The flaw, tracked as CVE-2023-34000, impacts versions 7.4.0 and below. It was addressed by the plugin maintainers in version 7.4.1, which...
CVE-2023-34000
Unauth. IDOR vulnerability leading to PII Disclosure in WooCommerce Stripe Payment Gateway plugin = 7.4.0 versions...
CVE-2023-34000
Unauth. IDOR vulnerability leading to PII Disclosure in WooCommerce Stripe Payment Gateway plugin = 7.4.0 versions...
Design/Logic Flaw
Unauth. IDOR vulnerability leading to PII Disclosure in WooCommerce Stripe Payment Gateway plugin = 7.4.0 versions...
CVE-2023-34000
CVE-2023-34000 affects WordPress WooCommerce Stripe Payment Gateway plugin versions up to 7.4.0, with a fix in 7.4.1. The vulnerability is an unauthenticated insecure direct object reference (IDOR) that allows viewing order PII (email, name, full address) due to inadequate access control in order...
CVE-2023-34000 WordPress WooCommerce Stripe Payment Gateway Plugin <= 7.4.0 is vulnerable to Insecure Direct Object References (IDOR)
Unauth. IDOR vulnerability leading to PII Disclosure in WooCommerce Stripe Payment Gateway plugin = 7.4.0 versions...
Glassdoor: IDOR vulnerability on profile picture changing mechanism which discloses other user's profile picture.
Vulnerability description not provided...
CVE-2023-3048 IDOR in TMT's Lockcell
Authorization Bypass Through User-Controlled Key vulnerability in TMT Lockcell allows Authentication Abuse, Authentication Bypass. This issue affects Lockcell: before 15...
WooCommerce Stripe Payment Gateway < 7.4.1 - Unauthenticated PII Disclosure via IDOR
The plugin does not ensure that the order details to be displayed belongs to the user making the request, allows unauthenticated users to access sensitive information about the reorder details such as first/last names, email and address As unauthenticated, see the source of...
WordPress WooCommerce Stripe Payment Gateway Plugin <= 7.4.0 is vulnerable to Insecure Direct Object References (IDOR)
Software WooCommerce Stripe Payment Gateway Type Plugin Vulnerable versions = 7.4.0 Fixed in 7.4.1 OWASP Top 10 A5: Broken Access Control Classification Insecure Direct Object References IDOR CVE CVE-2023-34000 Patch priority Low CVSS severity Low 7.5 Developer Claim ownership PSID 38958ed35e7d...
IDOR in message deletion
Description user can delete others's message. we know the report https://huntr.dev/bounties/24ae402f-220f-41c6-962e-47c26938986e/ , but we find that we do not fix one case. Proof of Concept 1 user1 send admin a greeting card1 2 user2 send admin a greeting card2 3 user1 delete his message related ...
CVE-2023-33956
Kanboard is open source project management software that focuses on the Kanban methodology. Versions prior to 1.2.30 are subject to an Insecure direct object reference IDOR vulnerability present in the application's URL parameter. This vulnerability enables any user to read files uploaded by any...
Design/Logic Flaw
Kanboard is open source project management software that focuses on the Kanban methodology. Versions prior to 1.2.30 are subject to an Insecure direct object reference IDOR vulnerability present in the application's URL parameter. This vulnerability enables any user to read files uploaded by any...
CVE-2023-33956 Parameter based Indirect Object Referencing leading to private file exposure in Kanboard
Kanboard is open source project management software that focuses on the Kanban methodology. Versions prior to 1.2.30 are subject to an Insecure direct object reference IDOR vulnerability present in the application's URL parameter. This vulnerability enables any user to read files uploaded by any...
CVE-2023-33956
Kanboard is open source project management software that focuses on the Kanban methodology. Versions prior to 1.2.30 are subject to an Insecure direct object reference IDOR vulnerability present in the application's URL parameter. This vulnerability enables any user to read files uploaded by any...
CVE-2023-33956
The CVE-2023-33956 entry affects Kanboard before 1.2.30, with an IDOR in a URL parameter that lets any authenticated user read files uploaded by others (under /files), enabling unauthorized disclosure of sensitive documents. The vulnerability stems from insecure direct object reference without pr...
CVE-2023-33956 Parameter based Indirect Object Referencing leading to private file exposure in Kanboard
Kanboard is open source project management software that focuses on the Kanban methodology. Versions prior to 1.2.30 are subject to an Insecure direct object reference IDOR vulnerability present in the application's URL parameter. This vulnerability enables any user to read files uploaded by any...