CVE-2024-9097

ManageEngine Endpoint Central versions before 11.3.2440.09 are vulnerable to IDOR vulnerability which allows the attacker to change the username in the chat...

CVE-2022-1176

Loose comparison causes IDOR on multiple endpoints in GitHub repository livehelperchat/livehelperchat prior to 3.96...

CVE-2024-9097

ManageEngine Endpoint Central versions before 11.3.2440.09 are vulnerable to IDOR vulnerability which allows the attacker to change the username in the chat...

CVE-2024-9097 IDOR

ManageEngine Endpoint Central versions before 11.3.2440.09 are vulnerable to IDOR vulnerability which allows the attacker to change the username in the chat...

CVE-2024-9097 IDOR

ManageEngine Endpoint Central versions before 11.3.2440.09 are vulnerable to IDOR vulnerability which allows the attacker to change the username in the chat...

CVE-2024-9097

Summary: CVE-2024-9097 affects ManageEngine Endpoint Central before 11.3.2440.09. The vulnerability is an insecure direct object reference (IDOR) that allows an attacker to change a user’s name in chat. The issue is present in the endpoint central desktop management system (Host/Chat component) a...

CVE-2024-7473

An IDOR vulnerability exists in the 'Evaluations' function of the 'umgws datasets' section in lunary-ai/lunary versions 1.3.2. This vulnerability allows an authenticated user to update other users' prompts by manipulating the 'id' parameter in the request. The issue is fixed in version 1.4.3...

Autodesk: Insecure Direct Object Reference (IDOR) in GraphQL deleteProfileImages Mutation

The Insecure Direct Object Reference IDOR vulnerability was discovered in the GraphQL deleteProfileImages mutation of the Autodesk User Profile. The vulnerability could have allowed an attacker to delete another user's photo through the "id" parameter. Autodesk has addressed the vulnerability...

Autodesk: Insecure Direct Object Reference (IDOR) Vulnerability in Autodesk User Profile

An Insecure Direct Object Reference IDOR vulnerability was discovered in the Autodesk User Profile. The vulnerability was found in the "id" parameter, which could have allowed an attacker to edit another user's profile...

Autodesk: IDOR Vulnerability Allowing Unauthorized Profile Picture Change

An IDOR vulnerability was found on the Autodesk User Profile, which allowed an attacker to edit another user's profile picture. The vulnerability was reported and has been fixed by Autodesk...

CVE-2024-56404

In One Identity Identity Manager 9.x before 9.3, an insecure direct object reference IDOR vulnerability allows privilege escalation. Only On-Premise installations are affected...

U.S. Dept Of Defense: Applicant security exam Attachments/Documents accessible through an IDOR/BAC on the custom Apex controller on https://█████.mil

The applicant security exam contained an Insecure Direct Object Reference IDOR vulnerability on the custom Apex controller on the https://█████.mil portal. The vulnerability allowed an attacker to switch the ownership of any Attachment record and access the files, which contained sensitive...

Yelp: Unauthorized Reservation Cancellation Through IDOR Vulnerability

Vulnerability description not provided...

CVE-2024-52294 khoj has an IDOR in subscription management that allows unauthorized subscription modifications

Khoj is a self-hostable artificial intelligence app. Prior to version 1.29.10, an Insecure Direct Object Reference IDOR vulnerability in the updatesubscription endpoint allows any authenticated user to manipulate other users' Stripe subscriptions by simply modifying the email parameter in the...

CVE-2024-52294

Khoj’s CVE-2024-52294 describes an IDOR in the update_subscription endpoint (GET/PATCH to /api/subscription) where an email parameter directly references user subscriptions without ownership checks. Any authenticated user could modify other users’ Stripe subscriptions by altering email, potential...

khoj has an IDOR in subscription management allows unauthorized subscription modifications

Summary An Insecure Direct Object Reference IDOR vulnerability in the updatesubscription endpoint allows any authenticated user to manipulate other users' Stripe subscriptions by simply modifying the email parameter in the request. Details The vulnerability exists in the subscription endpoint at...

GHSA-HQ4H-W933-JM6C khoj has an IDOR in subscription management allows unauthorized subscription modifications

Summary An Insecure Direct Object Reference IDOR vulnerability in the updatesubscription endpoint allows any authenticated user to manipulate other users' Stripe subscriptions by simply modifying the email parameter in the request. Details The vulnerability exists in the subscription endpoint at...

PT-2024-35160

Name of the Vulnerable Software and Affected Versions Khoj versions prior to 1.29.10 Description The issue is related to an Insecure Direct Object Reference IDOR vulnerability in the update subscription endpoint, allowing any authenticated user to manipulate other users' Stripe subscriptions by...

CVE-2024-55471

Oqtane Framework is vulnerable to Insecure Direct Object Reference IDOR in Oqtane.Controllers.UserController. This allows unauthorized users to access sensitive information of other users by manipulating the id parameter...

CVE-2024-55186

CVE-2024-55186 affects Oqtane Framework 6.0.0 with an insecure direct object reference (IDOR): a logged-in user can access other users’ inbox messages by manipulating the notification ID in the request URL, exposing sensitive mail details. The issue is documented across multiple sources (Red Hat,...