2495 matches found
CVE-2019-5466
Removed by vendor...
CVE-2019-5466
Technical details about CVE-2019-5466 are not publicly provided in the connected documents. Monitor for updates from vendors (GitLab, Red Hat, Ubuntu, Debian, CVE List) for affected versions, impact, and remediation.
CVE-2019-15582
An IDOR was discovered in 12.3.2, 12.2.6, and 12.1.12 for GitLab Community Edition CE and Enterprise Edition EE that allowed a maintainer to add any private group to a protected environment...
CVE-2019-15582
CVE-2019-15582 affects GitLab Community Edition (CE) and Enterprise Edition (EE) prior to versions 12.3.2, 12.2.6, and 12.1.12. An IDOR was present that allowed a maintainer to add any private group to a protected environment, exposing potentially restricted group access. The vulnerability is des...
CVE-2019-15582
Removed by vendor...
CarSpot < 2.2.3 - Multiple Vulnerabilities
Multiple vulnerabilities was discovered in the 'CarSpot – Dealership Wordpress Classified Theme', tested version — v2.2.0: - Authenticated Persistent XSS - Registration Form/User Profile - Authenticated Persistent XSS - Ad Post - IDOR leading to arbitrary deletion of ads Edit WPScanTeam: January...
CarSpot < 2.2.3 - Multiple Vulnerabilities
Multiple vulnerabilities was discovered in the 'CarSpot – Dealership Wordpress Classified Theme', tested version — v2.2.0: - Authenticated Persistent XSS - Registration Form/User Profile - Authenticated Persistent XSS - Ad Post - IDOR leading to arbitrary deletion of ads Edit WPScanTeam: January...
Semrush: IDOR in semrush academy
INTRODUCTION I used two accounts to search for this vulnerability: - id: 5410425 email: ████[email protected] - id: 5407773 email: ████@anosimple.com IP used: ███ Endpoint URL: https://www.semrush.com/academy/courses/userEnroll EXPLOITATION Description of Security Issue: When a user clicks on the...
Starbucks: Singapore - IDOR in campaign.starbucks.com.sg
bytebunny discovered an Insecure Direct Object Reference IDOR exposing limited marketing data for customers in Singapore. @bytebunny — thank you for reporting the vulnerability and for confirming the resolution...
Clario: IDOR at https://account.mackeeper.com/at/load-reports/profile/<profile_id> leaks information about devices/licenses
Summary IDOR at https://account.mackeeper.com/at/load-reports/profile/ leaks information about devices/licenses An attacker can access victim information via profile id Steps to reproduce go to account.mackeeper.com and login now go to: https://account.mackeeper.com/at/load-reports/profile/+USER...
h1-ctf: [h1-415 2020] SSRF in a headless chrome with remote debugging leads to sensible information leak
Summary: Converter is using headless chrome with remote debbuging by rendring a page where we have out name, with which we can get xss leads to ssrf By using the remote debbugging with that ssrf we can grab the info all tabs in that chrome wher we can get even the flag document. Steps To Reproduc...
h1-ctf: [h1-415 2020] h1ctf{y3s_1m_c0sm1c_n0w}
Summary: add summary of the vulnerability Account takeover was possible because of the email validation used - [email protected] could be registered, but when the the system created the recovery QR code the extra symbols would get stripped leaving us with a valid recovery QR code to log into...
WordPress Ultimate Member plugin <= 2.1.2 - Insecure Direct Object Reference (IDOR) vulnerability
Insecure Direct Object Reference IDOR vulnerability found in WordPress Ultimate Member plugin versions = 2.1.2. Solution Update the WordPress Ultimate Member plugin to the latest available version at least 2.1.3...
WordPress Real Estate 7 premium theme <= 2.9.4 - Insecure Direct Object References (IDOR) vulnerability
Insecure Direct Object References IDOR vulnerability discovered by m0ze in WordPress Real Estate 7 premium theme versions = 2.9.4. Solution Update the WordPress Real Estate 7 premium theme to the latest available version at least 2.9.5...
Real Estate 7 < 2.9.5 - Multiple Vulnerabilities
Multiple vulnerabilities was discovered in the 'Real Estate 7 WordPress', tested version — v2.9.4: - Unauthenticated Reflected XSS - Authenticated Persistent XSS - Authenticated Persistent Self-XSS - IDOR - Information Exposure Edit WPScanTeam: January 12th - Report Received & Envato Contacted...
CVE-2019-20209
The CTHthemes CityBook before 2.3.4, TownHub before 1.0.6, and EasyBook before 1.2.2 themes for WordPress allow nsecure Direct Object Reference IDOR via wp-admin/admin-ajax.php to delete any page/post/listing...
Code injection
The CTHthemes CityBook before 2.3.4, TownHub before 1.0.6, and EasyBook before 1.2.2 themes for WordPress allow nsecure Direct Object Reference IDOR via wp-admin/admin-ajax.php to delete any page/post/listing...
CVE-2019-20209
The CVE-2019-20209 issue affects WordPress themes CityBook (<2.3.4), TownHub (<1.0.6), and EasyBook (
Ultimate Member < 2.1.3 - Insecure Direct Object Reference (IDOR)
IDOR issues allowing change of other users' profiles and cover photos...
EasyBook < 1.2.2 - Multiple Vulnerabilities
Multiple vulnerabilities was discovered in the 'EasyBook – Directory & Listing WordPress Theme', tested version — v1.2.1: - Unauthenticated Reflected XSS - Authenticated Persistent XSS - IDOR December 27th, 2019 - Envato Contacted January 6th, 2020 - Envato Investigating January ??th, 2020 -...