4590 matches found
WordPress WPQA - Builder forms Addon plugin < 5.2 - Arbitrary Profile Picture Deletion via IDOR vulnerability
Arbitrary Profile Picture Deletion via IDOR vulnerability discovered by Binit Ghimire in WordPress WPQA - Builder forms Addon plugin versions 5.2. Solution Update the WordPress WPQA - Builder forms Addon plugin to the latest available version at least 5.2...
VikBooking Hotel Booking Engine & PMS < 1.5.4 - Booking Data Disclosure
The plugin has guessable booking IDs, which could allow attackers to retrieve booking data via an IDOR in the search request...
WP 2FA < 2.2.0 - Arbitrary 2FA Disabling via IDOR
The plugin does not properly check for authorisation when disabling 2FA, allowing users to disable the protection of other users via an IDOR attack...
Omise: IDOR Payments Status
Summary: Found in the payment status function, IDOR's weakness. Where when doing the experiment managed to see the payment status of another account The following is the POC of the experiments carried out. Steps To Reproduce: 1.GET /payments/paymtestxxxx/status HTTP/2 Host: api.omise.co Sec-Ch-Ua...
CVE-2022-27108
OrangeHRM 4.10 is vulnerable to Insecure Direct Object Reference IDOR via the end point symfony/web/index.php/time/createTimesheet. Any user can create a timesheet in another user's account...
Design/Logic Flaw
OrangeHRM 4.10 is vulnerable to Insecure Direct Object Reference IDOR via the end point symfony/web/index.php/time/createTimesheet. Any user can create a timesheet in another user's account...
CVE-2022-27108
OrangeHRM 4.10 is vulnerable to Insecure Direct Object Reference IDOR via the end point symfony/web/index.php/time/createTimesheet. Any user can create a timesheet in another user's account...
CVE-2022-27108
CVE-2022-27108 relates to OrangeHRM 4.10 and is due to an Insecure Direct Object Reference (IDOR) in the endpoint symfony/web/index.php/time/createTimesheet. The vulnerability allows any user to create a timesheet in another user’s account. Connected documents corroborate the same description acr...
CVE-2022-27108
OrangeHRM 4.10 is vulnerable to Insecure Direct Object Reference IDOR via the end point symfony/web/index.php/time/createTimesheet. Any user can create a timesheet in another user's account...
PT-2022-18225
Name of the Vulnerable Software and Affected Versions OrangeHRM version 4.10 Description The issue allows any user to create a timesheet in another user's account due to an Insecure Direct Object Reference IDOR via the endpoint "symfony/web/index.php/time/createTimesheet". Recommendations For...
CVE-2022-27108: Authorization Bypass Through User-Controlled Key
OrangeHRM 4.10 is vulnerable to Insecure Direct Object Reference IDOR via the end point symfony/web/index.php/time/createTimesheet. Any user can create a timesheet in another user's account...
CVE-2022-22331
IBM SterlingPartner Engagement Manager 6.2.0 could allow a remote authenticated attacker to obtain sensitive information or modify user details caused by an insecure direct object vulnerability IDOR. IBM X-Force ID: 219130...
CVE-2022-22331
The CVE-2022-22331 issue affects IBM Sterling Partner Engagement Manager Standard Edition 6.2.0, due to an insecure direct object vulnerability (IDOR). A remote authenticated attacker could disclose sensitive information or modify user details (impact per sources). Remediation exists: IBM lists F...
TikTok: IDOR on TikTok Ads Endpoint
An Insecure Direct Object Reference IDOR vulnerability was found on a TikTok Ads endpoint, which could have resulted in an unauthorized user adding products into another user's catalogue. We thank @sinayeganeh for reporting this to our team...
Type Confusion in LiveHelperChat
Live Helper Chat provides live support for your website. Loose comparison causes IDOR on multiple endpoints in LiveHelperChat prior to 3.96. There is a fix released in versions 3.96 and 3.97. Currently, there is no known workaround...
GHSA-5CMW-FHQ9-8FHH Type Confusion in LiveHelperChat
Live Helper Chat provides live support for your website. Loose comparison causes IDOR on multiple endpoints in LiveHelperChat prior to 3.96. There is a fix released in versions 3.96 and 3.97. Currently, there is no known workaround...
CVE-2022-22331: Authorization Bypass Through User-Controlled Key
IBM SterlingPartner Engagement Manager 6.2.0 could allow a remote authenticated attacker to obtain sensitive information or modify user details caused by an insecure direct object vulnerability IDOR. IBM X-Force ID: 219130...
PT-2022-15370 · Ibm · Ibm Sterling Partner Engagement Manager
Name of the Vulnerable Software and Affected Versions: IBM Sterling Partner Engagement Manager version 6.2.0 Description: The issue allows a remote authenticated attacker to obtain sensitive information or modify user details due to an insecure direct object vulnerability IDOR. Recommendations: F...