CVE-2022-29434 WordPress Spiffy Calendar plugin <= 4.9.0 - Edit/Delete event via IDOR vulnerability

Insecure Direct Object References IDOR vulnerability in Spiffy Plugins Spiffy Calendar = 4.9.0 at WordPress allows an attacker to edit or delete events...

CVE-2022-29434 WordPress Spiffy Calendar plugin <= 4.9.0 - Edit/Delete event via IDOR vulnerability

Insecure Direct Object References IDOR vulnerability in Spiffy Plugins Spiffy Calendar = 4.9.0 at WordPress allows an attacker to edit or delete events...

CVE-2022-29434

The CVE-2022-29434 entry concerns the WordPress Spiffy Calendar plugin (versions

CVE-2022-29434: Authorization Bypass Through User-Controlled Key

Insecure Direct Object References IDOR vulnerability in Spiffy Plugins Spiffy Calendar = 4.9.0 at WordPress allows an attacker to edit or delete events...

PT-2022-19608

Name of the Vulnerable Software and Affected Versions Spiffy Calendar versions 4.9.0 and earlier Description The issue allows an attacker to edit or delete events due to an Insecure Direct Object References IDOR vulnerability. This vulnerability enables unauthorized access and modification of eve...

IDOR (Insecure direct object references) in Jira 8.13.10

We have found during testing that by sending a fake header with a domain name supplying as a suffix i.e. attack.eu into the Host header field, the web server processes the input to send the request to an attacker-controlled host that resides at the supplied domain, and not to an internal virtual...

Three new API exploits causes GitLab data privacy and availability issues

On May 10, 2022, and May 11, 2022, CVE-2022-1352 CVE-2021-1431, and CVE-2022-1545 were fixed and published on Gitlab-ORG public repository. There are no technical details or exploits yet, but according to the high-level description and titles, they gonna be critical Gitlab API vulnerabilities tha...

CVE-2022-1425

The WPQA Builder Plugin WordPress plugin before 5.2, used as a companion plugin for the Discy and Himer , does not validate that the messageid of the wpqamessageview ajax action belongs to the requesting user, leading to any user being able to read messages for any other users via a Insecure Dire...

CVE-2022-1425 WPQA < 5.2 - Subscriber+ Private Message Disclosure via IDOR

The WPQA Builder Plugin WordPress plugin before 5.2, used as a companion plugin for the Discy and Himer , does not validate that the messageid of the wpqamessageview ajax action belongs to the requesting user, leading to any user being able to read messages for any other users via a Insecure Dire...

CVE-2022-1425

The CVE concerns the WPQA Builder Plugin for WordPress (pre-5.2), used with the Discy and Himer plugins. The vulnerability arises because the wpqa_message_view AJAX action does not validate that the message_id belongs to the requesting user, enabling an IDOR disclosure where any authenticated use...

CVE-2022-1349 WPQA < 5.2 - Subscriber+ Arbitrary Profile Picture Deletion via IDOR

The WPQA Builder Plugin WordPress plugin before 5.2, used as a companion plugin for the Discy and Himer , does not validate that the value passed to the imageid parameter of the ajax action wpqaremoveimage belongs to the requesting user, allowing any users with privileges as low as Subscriber to...

TikTok: Create product discounts of any shop

An Insecure Direct Object Reference IDOR vulnerability was found on a TikTok seller endpoint, which could have resulted in any user to create product discounts for shops they did not own. We thank @datph4m for reporting this to our team...

PT-2022-13878

Name of the Vulnerable Software and Affected Versions WPQA Builder Plugin versions prior to 5.2 Description The issue allows any user to read messages for other users due to an Insecure Direct Object Reference IDOR vulnerability. This occurs because the plugin does not validate that the message i...

CVE-2022-1425: Authorization Bypass Through User-Controlled Key

The WPQA Builder Plugin WordPress plugin before 5.2, used as a companion plugin for the Discy and Himer , does not validate that the messageid of the wpqamessageview ajax action belongs to the requesting user, leading to any user being able to read messages for any other users via a Insecure Dire...

CVE-2022-1352

Due to an insecure direct object reference vulnerability in Gitlab EE/CE affecting all versions from 11.0 prior to 14.8.6, 14.9 prior to 14.9.4, and 14.10 prior to 14.10.1, an endpoint may reveal the issue title to a user who crafted an API call with the ID of the issue from a public project that...

CVE-2022-1352

GitLab EE/CE is affected by CVE-2022-1352 due to an insecure direct object reference. Versions affected: 11.0 and newer up to but excluding 14.8.6 (i.e., 11.0–14.8.5), 14.9 until before 14.9.4 (i.e., 14.9.0–14.9.3), and 14.10 until before 14.10.1 (i.e., 14.10.0). The vulnerability allows an endpo...

CVE-2022-29008

An insecure direct object reference IDOR vulnerability in the viewid parameter of Bus Pass Management System v1.0 allows attackers to access sensitive information...

Information disclosure

An insecure direct object reference IDOR vulnerability in the viewid parameter of Bus Pass Management System v1.0 allows attackers to access sensitive information...

CVE-2022-29008

The CVE-2022-29008 entry concerns an insecure direct object reference (IDOR) in Bus Pass Management System v1.0, specifically the viewid parameter. Exploitation could allow an attacker to access sensitive information by bypassing authorization checks on object access. Affected component: Bus Pass...

PT-2022-19362 · Unknown · Bus Pass Management System

Name of the Vulnerable Software and Affected Versions: Bus Pass Management System version 1.0 Description: An insecure direct object reference IDOR vulnerability in the viewid parameter allows attackers to access sensitive information. Recommendations: For Bus Pass Management System version 1.0,...