HackerOne: An attacker can archive and unarchive any structured scope object on HackerOne

Summary: Hello, I have discovered an IDOR vulnerability that allows the scope of any program to be archived. Scopes are used to give information about the valid scopes of a program. For example HackerOne has the following scopes: https://hackerone.com https://api.hackerone.com ... Steps To...

CVE-2022-25471

An Insecure Direct Object Reference IDOR vulnerability in OpenEMR 6.0.0 allows any authenticated attacker to access and modify unauthorized areas via a crafted POST request to /modules/zendmodules/public/Installer/register...

CVE-2022-25471

An Insecure Direct Object Reference IDOR vulnerability in OpenEMR 6.0.0 allows any authenticated attacker to access and modify unauthorized areas via a crafted POST request to /modules/zendmodules/public/Installer/register...

Design/Logic Flaw

An Insecure Direct Object Reference IDOR vulnerability in OpenEMR 6.0.0 allows any authenticated attacker to access and modify unauthorized areas via a crafted POST request to /modules/zendmodules/public/Installer/register...

CVE-2022-25471

An Insecure Direct Object Reference IDOR vulnerability in OpenEMR 6.0.0 allows any authenticated attacker to access and modify unauthorized areas via a crafted POST request to /modules/zendmodules/public/Installer/register...

CVE-2022-25471

An Insecure Direct Object Reference IDOR vulnerability in OpenEMR 6.0.0 allows any authenticated attacker to access and modify unauthorized areas via a crafted POST request to /modules/zendmodules/public/Installer/register...

CVE-2022-25471

CVE-2022-25471 : OpenEMR 6.0.0 contains an Insecure Direct Object Reference (IDOR). An authenticated attacker can access and modify unauthorized areas by sending a crafted POST to /modules/zend_modules/public/Installer/register. Root cause stated as IDOR; no exploit details or fixes are provided ...

PT-2022-17317

Name of the Vulnerable Software and Affected Versions OpenEMR version 6.0.0 Description The issue is related to an Insecure Direct Object Reference IDOR vulnerability. It allows any authenticated attacker to access and modify unauthorized areas. This can be achieved by sending a crafted POST...

CVE-2022-25471: Authorization Bypass Through User-Controlled Key

An Insecure Direct Object Reference IDOR vulnerability in OpenEMR 6.0.0 allows any authenticated attacker to access and modify unauthorized areas via a crafted POST request to /modules/zendmodules/public/Installer/register...

CVE-2022-0732

The backend infrastructure shared by multiple mobile device monitoring services does not adequately authenticate or authorize API requests, creating an IDOR Insecure Direct Object Reference vulnerability...

Design/Logic Flaw

The backend infrastructure shared by multiple mobile device monitoring services does not adequately authenticate or authorize API requests, creating an IDOR Insecure Direct Object Reference vulnerability...

CVE-2022-0732

The backend infrastructure shared by several mobile device monitoring services, including TheTruthSpy , Copy9 , MxSpy , iSpyoo , SecondClone , TheSpyApp , FoneTracker , and GuestSpy , contains an Insecure Direct Object Reference (IDOR) vulnerability (CVE-2022-0732 ). The root cause is a failure t...

CVE-2022-0732

The backend infrastructure shared by multiple mobile device monitoring services does not adequately authenticate or authorize API requests, creating an IDOR Insecure Direct Object Reference vulnerability...

CVE-2022-0732: Improper Access Control

The backend infrastructure shared by multiple mobile device monitoring services does not adequately authenticate or authorize API requests, creating an IDOR Insecure Direct Object Reference vulnerability...

Improper access control

Improper Access Control IDOR in GitHub repository dolibarr/dolibarr prior to 16.0...

CVE-2022-0731

Improper Access Control IDOR in GitHub repository dolibarr/dolibarr prior to 16.0...

UBUNTU-CVE-2022-0731

Improper Access Control IDOR in GitHub repository dolibarr/dolibarr prior to 16.0...

CVE-2022-0731

CVE-2022-0731 concerns an Improper Access Control (IDOR) in the GitHub repository dolibarr/dolibarr prior to 16.0. The connected OSV entries repeatedly describe the issue as an IDOR in dolibarr/dolibarr before version 16.0; no detailed root-cause or affected subcomponents are provided in the docu...

CVE-2022-0731

Improper Access Control IDOR in GitHub repository dolibarr/dolibarr prior to 16.0...

U.S. Dept Of Defense: Authorization bypass -> IDOR -> PII Leakage

Hi team! During testing ████ I found javascript file containing administrative panel functionality. It is accessible at: https://████/█████████ In this file I found an end point responsible for returning data about applications of the website users to the website administrators. The returned data...