4561 matches found
CVE-2019-7854
CVE-2019-7854 is an insecure direct object reference (IDOR) vulnerability in Magento. Affected: Magento 2.1 before 2.1.18, 2.2 before 2.2.9, and 2.3 before 2.3.2. Root cause: misdirected access to sensitive data (unauthorized disclosure of company credit history details) via IDOR. Impact: potenti...
Critical Bug in Android Antivirus Exposes Address Books
A slew of popular free Android antivirus apps in recent testing proved to have security holes and privacy issues – including a critical vulnerability that exposes user’s address books, and another serious flaw that enables attackers to turn off antivirus protection entirely. According to an...
PT-2019-18827
Name of the Vulnerable Software and Affected Versions Magento 2.1 versions prior to 2.1.18 Magento 2.2 versions prior to 2.2.9 Magento 2.3 versions prior to 2.3.2 Description An insecure direct object reference IDOR issue exists, allowing an administrator with limited privileges to delete the...
PT-2019-18810
Name of the Vulnerable Software and Affected Versions Magento 2.1 versions prior to 2.1.18 Magento 2.2 versions prior to 2.2.9 Magento 2.3 versions prior to 2.3.2 Description An Insecure Direct Object Reference IDOR issue exists in the order processing workflow. This can lead to unauthorized acce...
PT-2019-18796
Name of the Vulnerable Software and Affected Versions Magento 2.1 versions prior to 2.1.18 Magento 2.2 versions prior to 2.2.9 Magento 2.3 versions prior to 2.3.2 Description An insecure direct object reference IDOR issue exists due to insufficient authorization checks. This can be exploited by a...
PT-2019-18780
Name of the Vulnerable Software and Affected Versions Magento 2.1 versions prior to 2.1.18 Magento 2.2 versions prior to 2.2.9 Magento 2.3 versions prior to 2.3.2 Description An insecure direct object reference IDOR issue can lead to unauthorized disclosure of company credit history details...
CVE-2019-7872: Authorization Bypass Through User-Controlled Key
An insecure direct object reference IDOR vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2 due to insufficient authorizations checks. This can be abused by a user with admin privileges to add users to company accounts or modify existing us...
CVE-2019-7864: Authorization Bypass Through User-Controlled Key
An insecure direct object reference IDOR vulnerability exists in the RSS feeds of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This can lead to unauthorized access to order details...
CVE-2019-7925: Authorization Bypass Through User-Controlled Key
An insecure direct object reference IDOR vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This can be exploited by an administrator with limited privileges to delete the downloadable products folder...
CVE-2019-7890: Authorization Bypass Through User-Controlled Key
An Insecure Direct Object Reference IDOR vulnerability exists in the order processing workflow of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This can lead to unauthorized access to order details...
CVE-2019-7854: Authorization Bypass Through User-Controlled Key
An insecure direct object reference IDOR vulnerability in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2 can lead to unauthorized disclosure of company credit history details...
PT-2019-18789
Name of the Vulnerable Software and Affected Versions Magento 2.1 versions prior to 2.1.18 Magento 2.2 versions prior to 2.2.9 Magento 2.3 versions prior to 2.3.2 Description An insecure direct object reference IDOR vulnerability exists in the RSS feeds, which can lead to unauthorized access to...
HackerOne: IDOR in Bugs overview enables attacker to determine the date range a hackathon was active
A minor Insecure Direct Object Reference IDOR vulnerability is present in the /bugs endpoint. One of the Bugs overview filters enables a program member to filter by Hackathon that their program was a part of. This filter is applied when hackathon IDs are provided in the hackathons parameter, like...
Real Estate 7 < 2.9.1 - Stored XSS & IDOR
The 'Real Estate 7' premium WordPress theme is vulnerable to persistent XSS injection that allows an attacker to inject JavaScript or HTML code into the website front-end. There is also an Insecure Direct Object Reference issue, allowing unauthorized users to edit listings they should not have...
Real Estate 7 < 2.9.1 - Stored XSS & IDOR
The 'Real Estate 7' premium WordPress theme is vulnerable to persistent XSS injection that allows an attacker to inject JavaScript or HTML code into the website front-end. There is also an Insecure Direct Object Reference issue, allowing unauthorized users to edit listings they should not have...
Gitlab -- Multiple Vulnerabilities
Gitlab reports: GitHub Integration SSRF Trigger Token Impersonation Build Status Disclosure SSRF Mitigation Bypass Information Disclosure New Issue ID IDOR Label Name Enumeration Persistent XSS Wiki Pages User Revokation Bypass with Mattermost Integration Arbitrary File Upload via Import Project...
Mail.ru: [auto.mail.ru] IDOR на редактирование поста любого юзера.
IDOR allowed to edit arbitrary posts in auto.mail.ru auto.mail.ru belongs to Extended scope IDOR на редактирование произвольного поста на сайте auto.mail.ru...
CVE-2018-19582: Authorization Bypass Through User-Controlled Key
GitLab EE, versions 11.4 before 11.4.8 and 11.5 before 11.5.1, is affected by an insecure direct object reference vulnerability that permits an unauthorized user to publish the draft merge request comments of another user...
PRODSECBUG-2186: Insecure Direct Object Reference (IDOR) vulnerability can expose order details
More info at https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-33...
PRODSECBUG-2343: Insecure Direct Object Reference (IDOR) vulnerability can lead to deletion of downloadable products folder
More info at https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-23...