Design/Logic Flaw

Online Birth Certificate Management System version 1.0 suffers from an Insecure Direct Object Reference IDOR vulnerability...

CVE-2022-42067: Authorization Bypass Through User-Controlled Key

Online Birth Certificate Management System version 1.0 suffers from an Insecure Direct Object Reference IDOR vulnerability...

CVE-2022-42067

Online Birth Certificate Management System version 1.0 suffers from an Insecure Direct Object Reference IDOR vulnerability...

LinkedIn: IDOR to make someone attend or leave an event

An Insecure Direct Object Reference IDOR vulnerability was discovered in LinkedIn's event attendance functionality. The vulnerability allowed an attacker to manipulate event attendance by modifying the fsdprofile parameter in POST requests to the voyagerScheduledcontentDashViewerStates API...

TikTok: IDOR for changing privacy settings on any memories

Vulnerability description not provided...

CVE-2022-2828

In affected versions of Octopus Server it is possible to reveal information about teams via the API due to an Insecure Direct Object Reference IDOR vulnerability...

CVE-2022-2828

In affected versions of Octopus Server it is possible to reveal information about teams via the API due to an Insecure Direct Object Reference IDOR vulnerability...

CVE-2022-2828

CVE-2022-2828 describes an Insecure Direct Object Reference (IDOR) vulnerability in Octopus Server that can reveal information about teams via the API. The available documents confirm the issue and its root cause but do not specify affected versions, exploitable conditions, or a remediation. The ...

CVE-2022-2828

In affected versions of Octopus Server it is possible to reveal information about teams via the API due to an Insecure Direct Object Reference IDOR vulnerability...

CVE-2022-2828: Authorization Bypass Through User-Controlled Key

In affected versions of Octopus Server it is possible to reveal information about teams via the API due to an Insecure Direct Object Reference IDOR vulnerability...

Spoofing

Insecure direct object references IDOR vulnerability in ExpressTech Quiz And Survey Master plugin = 7.3.4 at WordPress allows attackers to change the content of the quiz...

CVE-2021-36865

CVE-2021-36865 affects WordPress environments using the ExpressTech/Quiz And Survey Master plugin family (WordPress Quiz And Survey Master/Quiz Master Next) up to version 7.3.4. The vulnerability is an insecure direct object reference (IDOR) that allows an attacker to change quiz content. Root ca...

CVE-2021-36865: Authorization Bypass Through User-Controlled Key

Insecure direct object references IDOR vulnerability in ExpressTech Quiz And Survey Master plugin = 7.3.4 at WordPress allows attackers to change the content of the quiz...

WordPress Quiz And Survey Master plugin <= 7.3.4 - Insecure direct object references (IDOR) vulnerability

Insecure direct object references IDOR vulnerability leading to Changing of Quiz Content discovered by Ngo Van Thien Patchstack Alliance in WordPress Quiz And Survey Master plugin versions = 7.3.4. Solution Update the WordPress Quiz And Survey Master plugin to the latest available version at leas...

Quiz And Survey Master < 7.3.5 - Quiz Update via IDOR

The plugin does not ensure that the quiz to be edited belongs to the user making the request, allowing high privilege users to edit quiz they should not be able to...

MTN Group: IDOR [mtnmobad.mtnbusiness.com.ng]

Steps To Reproduce: 1. Go to https://mtnmobad.mtnbusiness.com.ng//dashboard/home with burp proxy 1. Intercept a POST request to /app/dashboardData and review its response you will see emails and ids 1. Go to https://mtnmobad.mtnbusiness.com.ng//userProfile 1. change name, mobile, address etc. and...

CVE-2022-32277: Authorization Bypass Through User-Controlled Key

Squiz Matrix CMS 6.20 is vulnerable to an Insecure Direct Object Reference caused by failure to correctly validate authorization when submitting a request to change a user's contact details. NOTE: this is disputed by both the vendor and the original discoverer because it is a site-specific findin...

U.S. Dept Of Defense: IDOR leaking PII data via VendorId parameter

Description: Dear DoD, I found one bug on your domain from Hack US program: █████ It's IDOR bug. Make sure to know that I didn't test many funcs here for IDOR. I didn't test for ATO Account Takeover. But you should fix this. Here's the PoC: ██████████ Thank you DoD! Impact An attacker could steal...

CVE-2022-36202

Doctor's Appointment System1.0 is vulnerable to Incorrect Access Control via edoc/patient/settings.php. The settings.php is affected by Broken Access Control IDOR via id= parameter...

Improper access control

Doctor's Appointment System1.0 is vulnerable to Incorrect Access Control via edoc/patient/settings.php. The settings.php is affected by Broken Access Control IDOR via id= parameter...