PT-2022-25283 · WordPress · Wpforo Forum

Name of the Vulnerable Software and Affected Versions: wpForo Forum plugin versions = 2.0.5 Description: The issue is related to an insecure direct object references IDOR vulnerability. This vulnerability allows attackers with subscriber or higher user roles to mark any forum post as private or...

CVE-2022-40206: Authorization Bypass Through User-Controlled Key

Insecure direct object references IDOR vulnerability in the wpForo Forum plugin = 2.0.5 on WordPress allows attackers with subscriber or higher user roles to mark any forum post as private/public...

CVE-2022-40205: Authorization Bypass Through User-Controlled Key

Insecure direct object references IDOR vulnerability in the wpForo Forum plugin = 2.0.5 on WordPress allows attackers with subscriber or higher user roles to mark any forum post as solved/unsolved...

CVE-2021-36906

Multiple Insecure Direct Object References IDOR vulnerabilities in ExpressTech Quiz And Survey Master plugin = 7.3.6 on WordPress...

Design/Logic Flaw

Multiple Insecure Direct Object References IDOR vulnerabilities in ExpressTech Quiz And Survey Master plugin = 7.3.6 on WordPress...

CVE-2021-36906

The CVE refers to IDOR vulnerabilities in the ExpressTech Quiz And Survey Master WordPress plugin, specifically versions up to 7.3.6. The root cause is insufficient authorization checks that allow insecure direct object references, enabling actions such as deleting or duplicating quizzes by users...

CVE-2021-36906 WordPress Quiz And Survey Master plugin <= 7.3.6 - Multiple Insecure direct object references (IDOR) vulnerabilities

Multiple Insecure Direct Object References IDOR vulnerabilities in ExpressTech Quiz And Survey Master plugin = 7.3.6 on WordPress...

CVE-2021-36906: Authorization Bypass Through User-Controlled Key

Multiple Insecure Direct Object References IDOR vulnerabilities in ExpressTech Quiz And Survey Master plugin = 7.3.6 on WordPress...

CVE-2022-39945: Authorization Bypass Through User-Controlled Key

An improper access control vulnerability CWE-284 in FortiMail 7.2.0, 7.0.0 through 7.0.3, 6.4 all versions, 6.2 all versions, 6.0 all versions may allow an authenticated admin user assigned to a specific domain to access and modify other domains information via insecure direct object references...

CVE-2022-39945

Summary (CVE-2022-39945) : FortiMail contains an improper access control vulnerability (CWE-284) that can allow an authenticated admin user, when assigned to a specific domain, to access and modify information for other domains via insecure direct object references (IDOR). Affected FortiMail vers...

CVE-2022-39945

An improper access control vulnerability CWE-284 in FortiMail 7.2.0, 7.0.0 through 7.0.3, 6.4 all versions, 6.2 all versions, 6.0 all versions may allow an authenticated admin user assigned to a specific domain to access and modify other domains information via insecure direct object references...

CVE-2022-39945

An improper access control vulnerability CWE-284 in FortiMail 7.2.0, 7.0.0 through 7.0.3, 6.4 all versions, 6.2 all versions, 6.0 all versions may allow an authenticated admin user assigned to a specific domain to access and modify other domains information via insecure direct object references...

FortiMail - Inter-domain information leakage

An improper access control vulnerability CWE-284 in FortiMail may allow an authenticated admin user assigned to a specific domain to access and modify other domains information via insecure direct object references IDOR...

Train Scheduler App 1.0 Insecure Direct Object Reference

Exploit Title: Train Scheduler App v1.0 - Insecure Direct Object Reference IDOR to "delete user id " Exploit Author: Rohit Sharma Vendor Name: oretnom23 Vendor Homepage: https://www.sourcecodester.com/php/15720/train-scheduler-app-using-php-oop-and-mysql-database-free-download.html Software Link:...

Nextcloud: Possibility to delete files attached to deck cards of other users

Hi everyone, Hope you are well ! I come to report here an IDOR vulnerability on the Deck application of Nextcloud, allowing to delete any attached files on any cards. Nextcloud deck app version : latest stable 1.8.0 Steps To Reproduce: The Nextcloud Deck application now offers the ability to add ...

WordPress Comments – wpDiscuz plugin 7.4.2 - Insecure Direct Object References (IDOR) vulnerability

Insecure Direct Object References IDOR vulnerability discovered by Dhakal Ananda in WordPress Comments – wpDiscuz plugin versions 7.4.2. Solution Update the WordPress wpDiscuz plugin to the latest available version at least 7.5...

SUSE: Security Advisory (SUSE-SU-2022:3765-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SolarWinds Orion Platform < 2022.4 Multiple Vulnerabilities

The version of SolarWinds Orion Platform installed on the remote host is prior to 2022.4. It is, therefore, affected by multiple vulnerabilities as referenced in the solarwindsplatform20224 advisory: - SolarWinds Platform was susceptible to the Deserialization of Untrusted Data. This vulnerabilit...

CVE-2022-36966 Insecure Direct Object Reference Vulnerability: Orion Platform 2020.2.6

Users with Node Management rights were able to view and edit all nodes due to Insufficient control on URL parameter causing insecure direct object reference IDOR vulnerability in SolarWinds Platform 2022.3 and previous...

CVE-2022-36966

CVE-2022-36966 affects SolarWinds Platform (Orion Platform) 2022.3 and older. The root cause is insufficient control on a URL parameter causing an insecure direct object reference (IDOR). The impact is that users with Node Management rights can view and edit all nodes. Mitigation: update to a ver...