CVE-2019-5469

An IDOR vulnerability exists in GitLab v12.1.2, v12.0.4, and v11.11.6 that allowed uploading files from project archive to replace other users files potentially allowing an attacker to replace project binaries or other uploaded assets...

CVE-2019-5469

Removed by vendor...

CVE-2019-5469

CVE-2019-5469 corresponds to an IDOR in GitLab prior to 12.1.2, before 12.0.4, and before 11.11.6 that lets an attacker upload a file from a project archive to replace another user’s files, potentially enabling replacement of project binaries or other uploaded assets. Public disclosures in multip...

Mail.ru: Customer domain information disclosure at https://biz.mail.ru/api/domains/*

IDOR vulnerability in biz.mail.ru could be used to enumerate registered domains...

Razer: [Razer Pay Mobile App] IDOR within /v1_IM/friends/queryDrawRedLog allowed unauthorised access to read logs

The tester determined the Razer Pay MY server was vulnerable to unauthorized access of certain log file information due to an exposed signature in the Razer Pay Android application. Razer Fintech appreciates the clear and detailed report...

Design/Logic Flaw

An Insecure Direct Object Reference IDOR vulnerability in the Xtivia Web Time and Expense WebTE interface used for Microsoft Dynamics NAV before 2017 allows an attacker to download arbitrary files by specifying arbitrary values for the recId and filename parameters of the /Home/GetAttachment...

CVE-2019-19616

An Insecure Direct Object Reference IDOR vulnerability in the Xtivia Web Time and Expense WebTE interface used for Microsoft Dynamics NAV before 2017 allows an attacker to download arbitrary files by specifying arbitrary values for the recId and filename parameters of the /Home/GetAttachment...

CVE-2019-19616

CVE-2019-19616 concerns an insecure direct object reference in the Xtivia Web Time and Expense (WebTE) interface for Microsoft Dynamics NAV prior to 2017. The vulnerability occurs in the /Home/GetAttachment function, where an attacker can download arbitrary files by supplying arbitrary values for...

CVE-2019-19616: Authorization Bypass Through User-Controlled Key

An Insecure Direct Object Reference IDOR vulnerability in the Xtivia Web Time and Expense WebTE interface used for Microsoft Dynamics NAV before 2017 allows an attacker to download arbitrary files by specifying arbitrary values for the recId and filename parameters of the /Home/GetAttachment...

Nord Security: IDOR allow access to payments data of any user

simple send this POST request no need any auth: POST /api/v1/orders HTTP/1.1 Host: join.nordvpn.com Accept: application/json Accept-Language: en-US,en;q=0.5 Content-Type: application/json Content-Length: 179 DNT: 1 Connection: close...

Mail.ru: [city-mobil.ru/taxiserv/] IDOR leads to driver account takeover

IDOR vulnerability allowed partner account with manager role to takeover driver's accounts belonging to different partner...

PT-2019-4158

Name of the Vulnerable Software and Affected Versions Microsoft Dynamics NAV versions prior to 2017 Description The issue is related to an Insecure Direct Object Reference IDOR vulnerability in the Web Time and Expense WebTE interface. This vulnerability can be exploited by a remote attacker to...

Mail.ru: relap.io IDOR

IDOR vulnerability in relap.io allowed to disclosure attributes of arbitrary site...

Mail.ru: [city-mobil.ru/taxiserv/] Disclosure information about drivers

IDOR vulnerabilitiy in city-mobil.ru alllowed partner account with superuser privileges to access data of drivers belonging to different partners...

Gitlab -- Multiple Vulnerabilities

Gitlab reports: Path traversal with potential remote code execution Private objects exposed through project import Disclosure of notes via Elasticsearch integration Disclosure of comments via Elasticsearch integration DNS Rebind SSRF in various chat notifications Disclosure of vulnerability statu...

Mail.ru: [https://city-mobil.ru/taxiserv] IDOR leads to information disclosure

IDOR vulnerability for orders report allowed partner's superuser account to access information related to different partners...

Mail.ru: IDOR of users

IDOR vulnerability in worki.ru API allowed to request information on job seekers / employers without imposed limits...

U.S. Dept Of Defense: idor on upload profile functionality

Vulnerable URL: https://██████████/███████ID/Common/EditOne/Person/accountid steps to reproduce: 1.browse the image and click on the upload button 2.capture this request in burp suite 3. change the value 'personId' parameter to account2 accountid please see screenshot1 4.then goes to account2, th...

Mail.ru: IDOR в списке пользователей по домену в relap.io

IDOR in relap.io allowed users enumeration for domain...

QIWI: IDOR редактирование любого вишлиста

The Piggybox service had the ability to edit other people's wishlists using a specially formed request. В копилке существовала возможность редактировать чужие вишлисты с помощью специально сформированного запроса. https://twitter.com/ptswarm...