CVE-2018-19575: Authorization Bypass Through User-Controlled Key

GitLab CE/EE, versions 10.1 up to 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, are vulnerable to an insecure direct object reference issue that allows a user to make comments on a locked issue...

CVE-2018-19584: Authorization Bypass Through User-Controlled Key

GitLab EE, versions 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, is vulnerable to an insecure direct object reference vulnerability that allows authenticated, but unauthorized, users to view members and milestone details of private groups...

PT-2019-9865

Name of the Vulnerable Software and Affected Versions GitLab EE versions 11.4 before 11.4.8 GitLab EE versions 11.5 before 11.5.1 Description The issue is related to an insecure direct object reference, allowing unauthorized users to publish draft merge request comments of other users...

PT-2019-9867

Name of the Vulnerable Software and Affected Versions GitLab EE versions 11.x before 11.3.11 GitLab EE versions 11.4 before 11.4.8 GitLab EE versions 11.5 before 11.5.1 Description The issue allows authenticated but unauthorized users to view members and milestone details of private groups due to...

PT-2019-9858

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 10.1 through 11.5 Description The issue allows a user to make comments on a locked issue due to an insecure direct object reference. Recommendations For versions 10.1 through 11.3.10, update to version 11.3.11 or later. F...

CVE-2019-13461

In PrestaShop before 1.7.6.0 RC2, the idaddressdelivery and idaddressinvoice parameters are affected by an Insecure Direct Object Reference vulnerability due to a guessable value sent to the web application during checkout. An attacker could leak personal customer information. This is PrestaShop...

CVE-2019-13461

In PrestaShop before 1.7.6.0 RC2, the idaddressdelivery and idaddressinvoice parameters are affected by an Insecure Direct Object Reference vulnerability due to a guessable value sent to the web application during checkout. An attacker could leak personal customer information. This is PrestaShop...

Design/Logic Flaw

In PrestaShop before 1.7.6.0 RC2, the idaddressdelivery and idaddressinvoice parameters are affected by an Insecure Direct Object Reference vulnerability due to a guessable value sent to the web application during checkout. An attacker could leak personal customer information. This is PrestaShop...

CVE-2019-13461

In PrestaShop before 1.7.6.0 RC2, the idaddressdelivery and idaddressinvoice parameters are affected by an Insecure Direct Object Reference vulnerability due to a guessable value sent to the web application during checkout. An attacker could leak personal customer information. This is PrestaShop...

CVE-2019-13461

PrestaShop

CVE-2019-13461

In PrestaShop before 1.7.6.0 RC2, the idaddressdelivery and idaddressinvoice parameters are affected by an Insecure Direct Object Reference vulnerability due to a guessable value sent to the web application during checkout. An attacker could leak personal customer information. This is PrestaShop...

PT-2019-13347

Name of the Vulnerable Software and Affected Versions PrestaShop versions prior to 1.7.6.0 RC2 Description The issue allows an attacker to leak personal customer information due to an Insecure Direct Object Reference vulnerability. This is caused by guessable values sent to the web application...

CVE-2019-13461: Authorization Bypass Through User-Controlled Key

In PrestaShop before 1.7.6.0 RC2, the idaddressdelivery and idaddressinvoice parameters are affected by an Insecure Direct Object Reference vulnerability due to a guessable value sent to the web application during checkout. An attacker could leak personal customer information. This is PrestaShop...

CVE-2019-12866

An Insecure Direct Object Reference, with Authorization Bypass through a User-Controlled Key, was possible in JetBrains YouTrack. The issue was fixed in 2018.4.49168...

CVE-2019-12866

CVE-2019-12866 affects JetBrains YouTrack and is described as an Insecure Direct Object Reference with Authorization Bypass via a user-controlled key. The issue was fixed in YouTrack version 2018.4.49168 (per JetBrains) and is reflected in multiple sources (NVD/Red Hat/CVE listings). The NVD CVSS...

CVE-2019-12866: Authorization Bypass Through User-Controlled Key

An Insecure Direct Object Reference, with Authorization Bypass through a User-Controlled Key, was possible in JetBrains YouTrack. The issue was fixed in 2018.4.49168...

PT-2019-12991

Name of the Vulnerable Software and Affected Versions JetBrains YouTrack versions prior to 2018.4.49168 Description The issue in JetBrains YouTrack allowed for an Insecure Direct Object Reference, with Authorization Bypass through a user-controlled key. This was resolved in 2018. Recommendations...

CVE-2019-12742

Bludit prior to 3.9.1 allows a non-privileged user to change the password of any account, including admin. This occurs because of bl-kernel/admin/controllers/user-password.php Insecure Direct Object Reference a modified username POST parameter...

Default credentials

Bludit prior to 3.9.1 allows a non-privileged user to change the password of any account, including admin. This occurs because of bl-kernel/admin/controllers/user-password.php Insecure Direct Object Reference a modified username POST parameter...

CVE-2019-12742

Bludit prior to 3.9.1 is affected. A vulnerability in bl-kernel/admin/controllers/user-password.php allows a non-privileged user to change the password of any account (including admin) via an insecure direct object reference using a modified username POST parameter. Affected: Bludit content manag...