CVE-2021-42642

The CVE-2021-42642 entry describes a vulnerability in PrinterLogic Web Stack versions 19.1.1.13 SP9 and below, due to an Insecure Direct Object Reference (IDOR) that could disclose the plaintext console username and password for a printer. Affected product: PrinterLogic Web Stack. Root cause: IDO...

CVE-2021-42642

PrinterLogic Web Stack versions 19.1.1.13 SP9 and below are vulnerable to an Insecure Direct Object Reference IDOR vulnerability that allows an unauthenticated attacker to disclose the plaintext console username and password for a printer...

CVE-2021-42641

PrinterLogic Web Stack versions 19.1.1.13 SP9 and below are vulnerable to an Insecure Direct Object Reference IDOR vulnerability that allows an unauthenticated attacker to disclose the username and email address of all users...

CVE-2021-42641

CVE-2021-42641 affects PrinterLogic Web Stack versions 19.1.1.13 SP9 and earlier. It is described as an Insecure Direct Object Reference (IDOR) vulnerability that allows an unauthenticated attacker to disclose the usernames and email addresses of all users. The NVD entry provides a CVSS v3.1 base...

CVE-2021-42640

PrinterLogic Web Stack versions 19.1.1.13 SP9 and below are vulnerable to an Insecure Direct Object Reference IDOR vulnerability that allows an unauthenticated attacker to reassign drivers for any printer...

CVE-2021-42640

CVE-2021-42640 affects PrinterLogic Web Stack versions 19.1.1.13 SP9 and below. The vulnerability is an Insecure Direct Object Reference (IDOR) that allows an unauthenticated attacker to reassign drivers for any printer. Root cause details indicate improper access control on object references. Im...

CVE-2021-42641: Exposure of Resource to Wrong Sphere

PrinterLogic Web Stack versions 19.1.1.13 SP9 and below are vulnerable to an Insecure Direct Object Reference IDOR vulnerability that allows an unauthenticated attacker to disclose the username and email address of all users...

CVE-2021-42640: Exposure of Resource to Wrong Sphere

PrinterLogic Web Stack versions 19.1.1.13 SP9 and below are vulnerable to an Insecure Direct Object Reference IDOR vulnerability that allows an unauthenticated attacker to reassign drivers for any printer...

PT-2022-11645

Name of the Vulnerable Software and Affected Versions PrinterLogic Web Stack versions 19.1.1.13 SP9 and below Description The issue is related to an Insecure Direct Object Reference IDOR vulnerability. This vulnerability allows an unauthenticated attacker to reassign drivers for any printer...

CVE-2021-42642: Cleartext Storage of Sensitive Information

PrinterLogic Web Stack versions 19.1.1.13 SP9 and below are vulnerable to an Insecure Direct Object Reference IDOR vulnerability that allows an unauthenticated attacker to disclose the plaintext console username and password for a printer...

PT-2022-11646

Name of the Vulnerable Software and Affected Versions PrinterLogic Web Stack versions 19.1.1.13 SP9 and below Description The issue allows an unauthenticated attacker to disclose the username and email address of all users due to an Insecure Direct Object Reference IDOR vulnerability...

PT-2022-11647

Name of the Vulnerable Software and Affected Versions PrinterLogic Web Stack versions 19.1.1.13 SP9 and below Description The issue allows an unauthenticated attacker to disclose the plaintext console username and password for a printer due to an Insecure Direct Object Reference IDOR vulnerabilit...

Semrush: IDOR allowing to read another user's token on the Social Media Ads service

The hotfix was released asap. The investigation showed that there were no cases of vulnerability exploitation. Social Media Ads is a tool for dedicated paid social specialists working with ads. The tool needs to interact with the user's social network account. To do this, Semrush collects a token...

VulnLab - A Web Vulnerability Lab Project

VulnLab A web vulnerability lab project developed by Yavuzlar. Vulnerabilities SQL Injection Cross Site Scripting XSS Command Injection Insecure Direct Object References IDOR Cross Site Request Forgery CSRF XML External Entity XXE Insecure Deserialization File Upload File Inclusion Broken...

02.aula (1.0.0), 19json-validator (>=0.0.3, <=0.0.4) +1997 more potentially affected by CVE-2021-23566 via nanoid (>=3.0.0, <=3.1.30)

nanoid NPM version =3.0.0, =0.0.3, =0.0.1, =0.1.23, =0.1.4, =0.1.3, =1.0.0, =0.1.1-alpha.51, =0.0.20, =1.0.1, =0.0.1, =0.4.2, =0.4.11 - @agrippa-io/node-connection-manager 1.0.0 and more Source cves: CVE-2021-23566 Source advisory: OSV:GHSA-QRPM-P2H7-HRV2...

Grafana -- Teams API IDOR

Grafana Labs reports: On Jan. 18, an external security researcher, Kürşad ALSAN from NSPECT.IO @nspectio on Twitter, contacted Grafana to disclose an IDOR Insecure Direct Object Reference vulnerability on Grafana Teams APIs. This vulnerability only impacts the following API endpoints:...

Nextcloud: Nextcloud Deck : Possibility for anyone to add a stack with existing tasks on anyone's board

Hi everyone, Hope you are well ! I found an IDOR vulnerability, allowing any user without privilege to add lists with tasks in any user board. This was tested on a Nextcloud Hub II server v23 with the Deck application in version 1.6.0. Steps To Reproduce: Beforehand: - Have an A user with a board...

MTN Group: Remove Every User, Admin, And Owner Out Of Their Teams on developers.mtn.com via IDOR + Information Disclosure

Hello world, This vulnerability is too involved with regular users, in order for us to prevent any damage, we need 3 different user accounts we own. This gives us specific "userid" and "teamid" to work with. There's an Information Disclosure as a side effect of this vulnerability. User and team...

02.aula (1.0.0), 19json-validator (>=0.0.3, <=0.0.4) +1997 more potentially affected by CVE-2021-23566 via nanoid (>=3.0.0, <=3.1.30)

nanoid NPM version =3.0.0, =0.0.3, =0.0.1, =0.1.23, =0.1.4, =0.1.3, =1.0.0, =0.1.1-alpha.51, =0.0.20, =1.0.1, =0.0.1, =0.4.2, =0.4.11 - @agrippa-io/node-connection-manager 1.0.0 and more Source cves: CVE-2021-23566 Source advisory: SNYK:JS-NANOID-2332193...

Hospitals Patient Records Management System 1.0 Account TakeOver

Exploit Title: Hospitals Patient Records Management System 1.0 - Account TakeOver Date: 30/12/2021 Exploit Author: twseptian Vendor Homepage: https://www.sourcecodester.com/php/15116/hospitals-patient-records-management-system-php-free-source-code.html Software Link:...