CVE-2021-36874: Authorization Bypass Through User-Controlled Key

Authenticated Insecure Direct Object References IDOR vulnerability in WordPress uListing plugin versions = 2.0.5...

PT-2021-21387

Name of the Vulnerable Software and Affected Versions WordPress uListing plugin versions = 2.0.5 Description The issue is related to an Authenticated Insecure Direct Object References IDOR vulnerability. Recommendations For WordPress uListing plugin versions = 2.0.5, update to a version greater...

Anonymous user can view private project and filter names via IDOR in Average Number of Times in Status Gadget - CVE-2021-41305

Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to view the names of private projects and filters via an Insecure Direct Object References IDOR vulnerability in the Average Number of Times in Status Gadget. The affected versions are before version...

Anonymous user can view private project and filter names via IDOR in Average Number of Times in Status Gadget - CVE-2021-41305

Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to view the names of private projects and filters via an Insecure Direct Object References IDOR vulnerability in the Average Number of Times in Status Gadget. The affected versions are before version...

CVE-2021-29773

IBM Security Guardium 10.6 and 11.3 could allow a remote authenticated attacker to obtain sensitive information or modify user details caused by an insecure direct object vulnerability IDOR. IBM X-Force ID: 202865...

CVE-2021-29773

CVE-2021-29773 affects IBM Security Guardium 10.6 and 11.3, due to an insecure direct object vulnerability (IDOR) that could allow a remote authenticated attacker to obtain sensitive information or modify user details. The IBM Security bulletin indicates these vulnerabilities are fixed in specifi...

Siemens Teamcenter code issue vulnerability

Siemens Teamcenter, a product lifecycle management computer software application from Siemens, Germany, is vulnerable to a code issue that results from an application containing an insecure direct object reference IDOR vulnerability that could be exploited by an attacker to directly access object...

PT-2021-18470

Name of the Vulnerable Software and Affected Versions IBM Security Guardium versions 10.6 through 11.3 Description The issue allows a remote authenticated attacker to obtain sensitive information or modify user details due to an insecure direct object vulnerability IDOR. This enables the attacker...

CVE-2021-29773: Authorization Bypass Through User-Controlled Key

IBM Security Guardium 10.6 and 11.3 could allow a remote authenticated attacker to obtain sensitive information or modify user details caused by an insecure direct object vulnerability IDOR. IBM X-Force ID: 202865...

CVE-2021-40355

Siemens Teamcenter is affected by CVE-2021-40355 (IDOR). Affected versions: Teamcenter 12.4 prior to 12.4.0.8; 13.0 prior to 13.0.0.7; 13.1 prior to 13.1.0.5; 13.2 prior to 13.2.0.2. The vulnerability is an insecure direct object reference (IDOR) allowing access to objects via user-supplied input...

CVE-2021-40355: Authorization Bypass Through User-Controlled Key

A vulnerability has been identified in Teamcenter V12.4 All versions V12.4.0.8, Teamcenter V13.0 All versions V13.0.0.7, Teamcenter V13.1 All versions V13.1.0.5, Teamcenter V13.2 All versions 13.2.0.2. The affected application contains Insecure Direct Object Reference IDOR vulnerability that allo...

PT-2021-22873

Name of the Vulnerable Software and Affected Versions Teamcenter versions prior to 12.4.0.8 Teamcenter versions prior to 13.0.0.7 Teamcenter versions prior to 13.1.0.5 Teamcenter versions prior to 13.2.0.2 Description The issue is related to an Insecure Direct Object Reference IDOR vulnerability...

ECOA Building Automation System Authorization Bypass / IDOR

Summary 1 The Risk-Terminator Web Graphic control BEMS Building Energy Management System are designed to provide you with the latest in the Human Machine Interface HMI technology, for completely monitoring and controlling management. It may be used singly for small and medium sized facilities,...

Bus Pass Management System 1.0 Insecure Direct Object Reference

Exploit Title: Bus Pass Management System 1.0 - 'viewid' Insecure direct object references IDOR Date: 2021-09-05 Exploit Author: sudoninja Vendor Homepage: https://phpgurukul.com/bus-pass-management-system-using-php-and-mysql Software Link:...

Bus Pass Management System 1.0 - (viewid) Insecure direct object references Vulnerability

Exploit Title: Bus Pass Management System 1.0 - 'viewid' Insecure direct object references IDOR Exploit Author: sudoninja Vendor Homepage: https://phpgurukul.com/bus-pass-management-system-using-php-and-mysql Software Link:...

OpenEMR 6.0.0 - 'noteid' Insecure Direct Object Reference (IDOR)

Exploit Title: OpenEMR 6.0.0 - 'noteid' Insecure Direct Object Reference IDOR Date: 31/08/2021 Exploit Author: Allen Enosh Upputori Vendor Homepage: https://www.open-emr.org Software Link: https://www.open-emr.org/wiki/index.php/OpenEMRDownloads Version: 6.0.0 Tested on: Linux CVE : CVE-2021-4035...

Bus Pass Management System 1.0 - 'viewid' Insecure direct object references (IDOR)

Exploit Title: Bus Pass Management System 1.0 - 'viewid' Insecure direct object references IDOR Date: 2021-09-05 Exploit Author: sudoninja Vendor Homepage: https://phpgurukul.com/bus-pass-management-system-using-php-and-mysql Software Link:...

Improper Authorization in imran300/inventory

✍️ Description A General manager user can edit/add other group PERMISSIONS LIST with IDOR. 🕵️‍♂️ Proof of Concept go to this url when logging in as a General manager. http://localhost:8000/inventory/index.php/generals/addgroup and then you can see that Permissions can be bypassed. 💥 Impact This...

Improper Authorization in imran300/inventory

✍️ Description A designer user can deactivate any other users IDOR. 🕵️‍♂️ Proof of Concept go to this url when logging in as a Designer. http://localhost:8000/inventory/index.php/Users/deactiveStatus/10 and then you can see that a user with id 10 will be deactivated. 💥 Impact This vulnerability is...

Improper Authorization in imran300/inventory

✍️ Description A designer user can activate any other users IDOR. 🕵️‍♂️ Proof of Concept go to this url when logging in as a Designer. localhost:8000/inventory/index.php/Users/activeStatus/10 and then you can see that a user with id 10 will be activated. 💥 Impact This vulnerability is capable of...