PT-2022-20299

Name of the Vulnerable Software and Affected Versions ihb eG FlexNow versions prior to 2.04.09.016 Description The issue is an Insecure Direct Object Reference IDOR that allows remote authenticated attackers to obtain sensitive student information, including final grades, study courses, and...

CVE-2022-30760: Authorization Bypass Through User-Controlled Key

An Insecure Direct Object Reference IDOR issue in fn2Web in ihb eG FlexNow before 2.04.09.016 allows remote authenticated attackers to obtain sensitive student information final grades, study courses, degrees by changing the student ID parameter in the HTTP POST request to the FrontControllerSS...

Automattic: Sensei LMS IDOR to send message

Hi there, hope you are doing great. So, there is an option to send message to teacher privately by student on Sensei LMS. Each message sent by student will have different ID, Student1 cannot access or send message to the message from Student2 which is meant to be private with teacher Similarly...

LinkedIn: IDOR - Delete technical skill assessment result & Gained Badges result of any user

The web app is vulnerable to IDOR at DELETE /voyager/api/voyagerAssessmentsDashSkillAssessmentAttemptReports/urn%3Ali%3AfsdskillAssessmentAttemptReport%3Aurn%3Ali%3Afsdprofile%███%2Curn%3Ali%3Askill%3A280%2C1 HTTP request. Allows an attacker to delete the skill assessment result of any user's...

CVE-2022-29627

An insecure direct object reference IDOR in Online Market Place Site v1.0 allows attackers to modify products that are owned by other sellers...

Code injection

An insecure direct object reference IDOR in Online Market Place Site v1.0 allows attackers to modify products that are owned by other sellers...

TikTok: IDOR in family pairing API

Vulnerability description not provided...

CVE-2022-29627

An insecure direct object reference IDOR in Online Market Place Site v1.0 allows attackers to modify products that are owned by other sellers...

CVE-2022-29627

The CVE-2022-29627 entry describes an insecure direct object reference (IDOR) in Online Market Place Site v1.0 that lets an attacker modify products owned by other sellers. Affected component: the Online Market Place Site application (v1.0). Root cause: IDOR weakness enabling unauthorized modific...

PT-2022-19735

Name of the Vulnerable Software and Affected Versions Online Market Place Site version 1.0 Description The issue is related to an insecure direct object reference IDOR that allows attackers to modify products owned by other sellers. Recommendations For Online Market Place Site version 1.0, consid...

CVE-2022-29627: Authorization Bypass Through User-Controlled Key

An insecure direct object reference IDOR in Online Market Place Site v1.0 allows attackers to modify products that are owned by other sellers...

CVE-2022-30495

In oretnom23 Automotive Shop Management System v1.0, the name id parameter is vulnerable to IDOR - Broken Access Control allowing attackers to change the admin passwordvertical privilege escalation...

Improper access control

In oretnom23 Automotive Shop Management System v1.0, the name id parameter is vulnerable to IDOR - Broken Access Control allowing attackers to change the admin passwordvertical privilege escalation...

CVE-2022-30495

In oretnom23 Automotive Shop Management System v1.0, the name id parameter is vulnerable to IDOR - Broken Access Control allowing attackers to change the admin passwordvertical privilege escalation...

CVE-2022-30495

Affected software: oretnom23 Automotive Shop Management System v1.0. The vulnerability is an IDOR / Broken Access Control in the name id parameter that allows vertical privilege escalation to change the admin password. Root cause: improper access control on an identifier parameter. Documented imp...

CVE-2022-30495: Authorization Bypass Through User-Controlled Key

In oretnom23 Automotive Shop Management System v1.0, the name id parameter is vulnerable to IDOR - Broken Access Control allowing attackers to change the admin passwordvertical privilege escalation...

PT-2022-20142

Name of the Vulnerable Software and Affected Versions oretnom23 Automotive Shop Management System version 1.0 Description The issue concerns a Broken Access Control vulnerability, specifically an Insecure Direct Object Reference IDOR, allowing attackers to perform vertical privilege escalation by...

Stripe: Mass Account Takeover at https://app.taxjar.com/ - No user Interaction

@beerboyankit discovered an IDOR in the user invite link in Taxjar. This could have allowed an attacker to take over a user's account. The vulnerability was caused by a leaked token in the delete invitation request feature and resolved by using the invitation ID instead of the token to look up th...

Moodle Insecure direct object reference (IDOR) in a calendar web service

A flaw was found in Moodle in versions 3.11 to 3.11.3, 3.10 to 3.10.7, 3.9 to 3.9.10 and earlier unsupported versions. Insufficient capability checks made it possible to fetch other users' calendar action events...

GHSA-G39C-MCCF-RXJV Moodle Insecure direct object reference (IDOR) in a calendar web service

A flaw was found in Moodle in versions 3.11 to 3.11.3, 3.10 to 3.10.7, 3.9 to 3.9.10 and earlier unsupported versions. Insufficient capability checks made it possible to fetch other users' calendar action events...