CVE-2024-5977: Authorization Bypass Through User-Controlled Key

The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.13.0 via the 'handleRequest' function due to missing validation on a user controlled key. This makes it possible for authenticated...

CVE-2024-38447

NATO NCI ANET 3.4.1 allows Insecure Direct Object Reference via a modified ID field in a request for a private draft report that belongs to an arbitrary user...

CVE-2024-38447: Authorization Bypass Through User-Controlled Key

NATO NCI ANET 3.4.1 allows Insecure Direct Object Reference via a modified ID field in a request for a private draft report that belongs to an arbitrary user...

CVE-2024-38447

NATO NCI ANET 3.4.1 allows Insecure Direct Object Reference via a modified ID field in a request for a private draft report that belongs to an arbitrary user...

CVE-2024-38447

NATO NCI ANET 3.4.1 allows Insecure Direct Object Reference via a modified ID field in a request for a private draft report that belongs to an arbitrary user...

CVE-2024-38447

NATO NCI ANET 3.4.1 allows Insecure Direct Object Reference via a modified ID field in a request for a private draft report that belongs to an arbitrary user...

CVE-2024-38447

NATO NCI ANET version 3.4.1 is vulnerable to an Insecure Direct Object Reference (IDOR) . An attacker can gain unauthorized access to private draft reports belonging to arbitrary users by modifying the ID field in a request. The practical impact includes unauthorized access to private data. As a ...

CVE-2024-38496

CVE-2024-38496 affects Broadcom Symantec Privileged Access Management. A malicious, low-privileged PAM user can access information about other PAM users and their group memberships (an Insecure Direct Object Reference ). The connected documents confirm the vulnerability and general impact, but pr...

CVE-2024-38496 Symantec Privileged Access Manager Insecure Direct Object Reference vulnerability

The vulnerability allows a malicious low-privileged PAM user to access information about other PAM users and their group memberships...

“Cannot connect to the HyperVisor" when connecting to Hyper-V from the Machine Creation Wizards

When trying to connect to SCVMM to enumeratetemplates for Provisioning Services, the following error message appears: “Cannot connect to the HyperVisor at IP address of Hyper-V. Object reference not set to an instance of an object.”...

WordPress ProfileGrid plugin <= 5.8.9 - Authenticated (Subscriber+) Insecure Direct Object Reference vulnerability

Authenticated Subscriber+ Insecure Direct Object Reference vulnerability discovered by Tieu Pham Trong Nhan aptx4869 in WordPress Plugin ProfileGrid versions = 5.8.9...

CVE-2024-6410

The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.8.9 via the 'pmuploadimage' function due to missing validation on a user controlled key. This makes it possible for authenticated...

CVE-2024-6410

CVE-2024-6410 affects the ProfileGrid – User Profiles, Groups and Communities plugin for WordPress. It allows Insecure Direct Object Reference via the pm_upload_image function in all versions up to and including 5.8.9, due to missing validation on a user-controlled key. An authenticated attacker ...

CVE-2024-6410 ProfileGrid <= 5.8.9 - Authenticated (Subscriber+) Insecure Direct Object Reference

The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.8.9 via the 'pmuploadimage' function due to missing validation on a user controlled key. This makes it possible for authenticated...

CVE-2024-6410 ProfileGrid <= 5.8.9 - Authenticated (Subscriber+) Insecure Direct Object Reference

The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.8.9 via the 'pmuploadimage' function due to missing validation on a user controlled key. This makes it possible for authenticated...

PT-2024-27523 · Undefined · Undefined

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned. Description: The issue concerns an IDOR vulnerability. There is no information provided about the estimated number of potentially affected devices worldwide or details about real-world incidents...

PT-2024-37603 · WordPress · Profilegrid

Name of the Vulnerable Software and Affected Versions: The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress versions up to, and including, 5.8.9 Description: The issue is related to Insecure Direct Object Reference. It affects the pm upload image function due to missing...

CVE-2024-6410: Authorization Bypass Through User-Controlled Key

The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.8.9 via the 'pmuploadimage' function due to missing validation on a user controlled key. This makes it possible for authenticated...

WordPress Page and Post Clone plugin <= 6.0 - Insecure Direct Object Reference to Authenticated (Author+) Sensitive Information Exposure vulnerability

Insecure Direct Object Reference to Authenticated Author+ Sensitive Information Exposure vulnerability discovered by Bassem Essam in WordPress Plugin Page and Post Clone versions = 6.0...

CVE-2024-5942

The Page and Post Clone plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.0 via the 'contentclone' function due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Author-level access...