CVE-2022-42067

Online Birth Certificate Management System version 1.0 suffers from an Insecure Direct Object Reference IDOR vulnerability...

Design/Logic Flaw

Online Birth Certificate Management System version 1.0 suffers from an Insecure Direct Object Reference IDOR vulnerability...

CVE-2022-42067

Online Birth Certificate Management System version 1.0 suffers from an Insecure Direct Object Reference IDOR vulnerability...

LinkedIn: IDOR to make someone attend or leave an event

An Insecure Direct Object Reference IDOR vulnerability was discovered in LinkedIn's event attendance functionality. The vulnerability allowed an attacker to manipulate event attendance by modifying the fsdprofile parameter in POST requests to the voyagerScheduledcontentDashViewerStates API...

TikTok: IDOR for changing privacy settings on any memories

Vulnerability description not provided...

CVE-2022-2828

In affected versions of Octopus Server it is possible to reveal information about teams via the API due to an Insecure Direct Object Reference IDOR vulnerability...

CVE-2022-2828

CVE-2022-2828 describes an Insecure Direct Object Reference (IDOR) vulnerability in Octopus Server that can reveal information about teams via the API. The available documents confirm the issue and its root cause but do not specify affected versions, exploitable conditions, or a remediation. The ...

CVE-2022-2828

In affected versions of Octopus Server it is possible to reveal information about teams via the API due to an Insecure Direct Object Reference IDOR vulnerability...

CVE-2022-2828

In affected versions of Octopus Server it is possible to reveal information about teams via the API due to an Insecure Direct Object Reference IDOR vulnerability...

Spoofing

Insecure direct object references IDOR vulnerability in ExpressTech Quiz And Survey Master plugin = 7.3.4 at WordPress allows attackers to change the content of the quiz...

CVE-2021-36865

CVE-2021-36865 affects WordPress environments using the ExpressTech/Quiz And Survey Master plugin family (WordPress Quiz And Survey Master/Quiz Master Next) up to version 7.3.4. The vulnerability is an insecure direct object reference (IDOR) that allows an attacker to change quiz content. Root ca...

Quiz And Survey Master < 7.3.5 - Quiz Update via IDOR

The plugin does not ensure that the quiz to be edited belongs to the user making the request, allowing high privilege users to edit quiz they should not be able to...

WordPress Quiz And Survey Master plugin <= 7.3.4 - Insecure direct object references (IDOR) vulnerability

Insecure direct object references IDOR vulnerability leading to Changing of Quiz Content discovered by Ngo Van Thien Patchstack Alliance in WordPress Quiz And Survey Master plugin versions = 7.3.4. Solution Update the WordPress Quiz And Survey Master plugin to the latest available version at leas...

MTN Group: IDOR [mtnmobad.mtnbusiness.com.ng]

Steps To Reproduce: 1. Go to https://mtnmobad.mtnbusiness.com.ng//dashboard/home with burp proxy 1. Intercept a POST request to /app/dashboardData and review its response you will see emails and ids 1. Go to https://mtnmobad.mtnbusiness.com.ng//userProfile 1. change name, mobile, address etc. and...

U.S. Dept Of Defense: IDOR leaking PII data via VendorId parameter

Description: Dear DoD, I found one bug on your domain from Hack US program: █████ It's IDOR bug. Make sure to know that I didn't test many funcs here for IDOR. I didn't test for ATO Account Takeover. But you should fix this. Here's the PoC: ██████████ Thank you DoD! Impact An attacker could steal...

CVE-2022-36202

Doctor's Appointment System1.0 is vulnerable to Incorrect Access Control via edoc/patient/settings.php. The settings.php is affected by Broken Access Control IDOR via id= parameter...

Improper access control

Doctor's Appointment System1.0 is vulnerable to Incorrect Access Control via edoc/patient/settings.php. The settings.php is affected by Broken Access Control IDOR via id= parameter...

CVE-2022-36202

Doctor's Appointment System1.0 is vulnerable to Incorrect Access Control via edoc/patient/settings.php. The settings.php is affected by Broken Access Control IDOR via id= parameter...

PT-2022-23258 · Unknown · Doctor Appointment System

Name of the Vulnerable Software and Affected Versions: Doctor's Appointment System version 1.0 Description: The issue concerns Incorrect Access Control, specifically Broken Access Control IDOR, in the settings.php file located at the /edoc/patient/ endpoint. The vulnerability is exploited via the...

Stripe: Mass Accounts Takeover Without any user Interaction at https://app.taxjar.com/

@mrasg discovered an improper access control issue in TaxJar. This could have allowed for account takeover using the email change functionality. The vulnerability was caused by not correctly validating whether or not the reset password token was connected to the user being reset and was resolved ...