2042 matches found
Mail.ru: IDOR in tender.mail.ru leading to Information Disclosure
tender.mail.ru could partially leak information about few organizations with accounts in incomplete registration state. Information leaked was public non confidential organization registry information, such as name, ИНН ITN, ОГРН PSRN, etc. tender.mail.ru is not currently in bug bounty scope...
Open-Xchange: Unauthorized access to attachments details of Private Calendar appointments (Access control issue)
Hi Team, Description : In calendar folder there is a permission settings where user can be assigned as read only user of it's own objects . User with this permission shouldn't be able to view private appointments and it's attachments . There is request of getting attachment details from server...
Uber: Stored XSS on any page in most Uber domains
Due to two IDOR vulnerabilities in Tealium, it was possible to compromise an administrator’s account and inject arbitrary Javascript into https://tags.tiqcdn.com/utag/uber/, which an attacker could leverage for a stored XSS attack on several Uber domains. Additionally, a Tealium user’s password a...
Radancy: Possible to view and takeover other user's education and courses @ mijn.werkenbijdefensie.nl
Domain and URL: https://mijn.werkenbijdefensie.nl/instellingen/gegevens/tab2 Summary: IDOR vulnerability in editing education/courses Description: It is possible to view and change courses and education of other users also known as an IDOR. It's also possible to save these, and after saving the...
ProjectSend r754 Insecure Direct Object Reference / Authenticaton Bypass
Document Title: =============== ProjectSend r754 - IDOR & Authentication Bypass Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2031 Release Date: ============= 2017-02-21 Vulnerability Laboratory ID VL-ID:...
ProjectSend r754 - IDOR & Authentication Bypass
Document Title: =============== ProjectSend r754 - IDOR & Authentication Bypass References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2031 Release Date: ============= 2017-02-21 Vulnerability Laboratory ID VL-ID: ==================================== 2031 Comm...
ProjectSend r754 - Insecure Direct Object Reference
ProjectSend r754 - Insecure Direct Object Reference Document Title: =============== ProjectSend r754 - IDOR & Authentication Bypass Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2031 Release Date: ============= 2017-02-21 Vulnerability...
ProjectSend r754 - IDOR & Authentication Bypass
Document Title: =============== ProjectSend r754 - IDOR & Authentication Bypass References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2031 Release Date: ============= 2017-02-21 Vulnerability Laboratory ID VL-ID: ==================================== 2031 Comm...
U.S. Dept Of Defense: Insecure Direct Object Reference (IDOR) vulnerability in a DoD website
A Department of Defense website was vulnerable to an IDOR attack which may allow an attacker to modify web content or certain database parameters. @eugui was able to demonstrate this vulnerability by manipulating web objects in a clever way. Very well done. Thank you!...
Open-Xchange: IDOR - Accessing other user's attachements via PUT /appsuite/api/files?action=saveAs
Hello, I have found a request in witch a user is able to copy other user's pattachements in his own folders and after that, he is able to download them or he is able to email them to another address or able to view them in browser. POC ----------------- PUT...
Rockstar Games: <- Critical IDOR vulnerability in socialclub allow to insert and delete comments as another user and it discloses sensitive information ->
In this report, the researcher found an insecure direct object reference that allowed a malicious user to impersonate another user in the comment section under Newswire articles. This meant that an attacker could leave abusive comments that appeared to have been made by another user, or delete a...
Open-Xchange: IDOR - Leaking other user's folder names from /appsuite/api/import?action=ICA
Hello, I have found a point in the appointments API import that leaks the folder names from other users or the system folder names. POC ------------------ POST /appsuite/api/import?action=ICAL&folder=6&ignoreUIDs=false&session=56ab07c24398421990bc6820eeeff6cc HTTP/1.1 Host: sandbox.open-xchange.c...
iTechScripts Payment Gateway Script 8.46 SQL Injection
Exploit Title : Payment Gateway Script v8.46 - Multiple Vulnerability Author : Hasan Emre Ozer Google Dork : - Date : 18/01/2017 Type : webapps Platform: PHP Vendor Homepage : http://itechscripts.com/payment-gateway-script/ Sofware Price and Demo : $400 http://payment-gateway.itechscripts.com...
Pornhub: IDOR - Access to private video thumbnails even if video requires password authentication
The researcher discovered an IDOR path which allows the user to few content and images from a password protected videos...
Showmax: Changing details of other users profile using UUID (IDOR)
Access token uniquely maps to particular user record, which is then the only one accessible to user when doing API calls. Issue arise when intermediate service had used service token to update the user record. That allowed accessing user details of other user that the current access token belongs...
Open-Xchange: IDOR - Downloading all attachements if having access to a shared link
Hello, I have found that one can download all attachements if finds/has access to a public link in this POC a shared task link. This is a big issue as one can download all the attachements of registered users, while the attacker is not actually logged in the application ! Also, I have found anoth...
Uber: IDOR on partners.uber.com allows for a driver to override administrator documents
An IDOR in the /p3/drivers/uploadDocument endpoint on partners.uber.com allowed a driver to upload and overwrite documents for other drivers on a multi-driver account. In addition to this, there was an access control issue where a driver account could also upload and overwrite documents for the...
Open-Xchange: IDOR - Folder names disclosure inside a domain, regardless of user
Hello, by changing the folderid parameter from the task reminders action, the folder name is leaked and a specific user can find all the folders inside the domain. PUT /appsuite/api/tasks?action=new&session=396a79677e3241b799f17051d0923da5&timezone=UTC HTTP/1.1 Host: sandbox.open-xchange.com...
Harvest: Unauthorised read Access to Expense Receipt of any user in the company(Vertical Privilege escalation)
Hi Team, Description : In Timesheet you have option for submitting your expense for the projects you are assigned. But Only Admin can view other user's Expenses and related receipts. But there is a request which gives a full size of expense receipt attached to the expenses. This request is...