CVE-2021-43957: Bypass for CVE-2020-29446 (Local file disclosure / path traversal within WEB-INF)

Affected versions of Atlassian Fisheye & Crucible allowed remote attackers to browse local files via an Insecure Direct Object References IDOR vulnerability in the WEB-INF directory and bypass the fix for CVE-2020-29446 due to a lack of url decoding. The affected versions are before version 4.8.9...

HackerOne: An attacker can archive and unarchive any structured scope object on HackerOne

Summary: Hello, I have discovered an IDOR vulnerability that allows the scope of any program to be archived. Scopes are used to give information about the valid scopes of a program. For example HackerOne has the following scopes: https://hackerone.com https://api.hackerone.com ... Steps To...

CVE-2022-25471

An Insecure Direct Object Reference IDOR vulnerability in OpenEMR 6.0.0 allows any authenticated attacker to access and modify unauthorized areas via a crafted POST request to /modules/zendmodules/public/Installer/register...

CVE-2022-25471

An Insecure Direct Object Reference IDOR vulnerability in OpenEMR 6.0.0 allows any authenticated attacker to access and modify unauthorized areas via a crafted POST request to /modules/zendmodules/public/Installer/register...

Design/Logic Flaw

An Insecure Direct Object Reference IDOR vulnerability in OpenEMR 6.0.0 allows any authenticated attacker to access and modify unauthorized areas via a crafted POST request to /modules/zendmodules/public/Installer/register...

CVE-2022-25471

CVE-2022-25471 : OpenEMR 6.0.0 contains an Insecure Direct Object Reference (IDOR). An authenticated attacker can access and modify unauthorized areas by sending a crafted POST to /modules/zend_modules/public/Installer/register. Root cause stated as IDOR; no exploit details or fixes are provided ...

CVE-2022-25471

An Insecure Direct Object Reference IDOR vulnerability in OpenEMR 6.0.0 allows any authenticated attacker to access and modify unauthorized areas via a crafted POST request to /modules/zendmodules/public/Installer/register...

CVE-2022-25471

An Insecure Direct Object Reference IDOR vulnerability in OpenEMR 6.0.0 allows any authenticated attacker to access and modify unauthorized areas via a crafted POST request to /modules/zendmodules/public/Installer/register...

CVE-2022-25471: Authorization Bypass Through User-Controlled Key

An Insecure Direct Object Reference IDOR vulnerability in OpenEMR 6.0.0 allows any authenticated attacker to access and modify unauthorized areas via a crafted POST request to /modules/zendmodules/public/Installer/register...

PT-2022-17317

Name of the Vulnerable Software and Affected Versions OpenEMR version 6.0.0 Description The issue is related to an Insecure Direct Object Reference IDOR vulnerability. It allows any authenticated attacker to access and modify unauthorized areas. This can be achieved by sending a crafted POST...

CVE-2022-0732

The backend infrastructure shared by multiple mobile device monitoring services does not adequately authenticate or authorize API requests, creating an IDOR Insecure Direct Object Reference vulnerability...

Design/Logic Flaw

The backend infrastructure shared by multiple mobile device monitoring services does not adequately authenticate or authorize API requests, creating an IDOR Insecure Direct Object Reference vulnerability...

CVE-2022-0732

The backend infrastructure shared by several mobile device monitoring services, including TheTruthSpy , Copy9 , MxSpy , iSpyoo , SecondClone , TheSpyApp , FoneTracker , and GuestSpy , contains an Insecure Direct Object Reference (IDOR) vulnerability (CVE-2022-0732 ). The root cause is a failure t...

CVE-2022-0732

The backend infrastructure shared by multiple mobile device monitoring services does not adequately authenticate or authorize API requests, creating an IDOR Insecure Direct Object Reference vulnerability...

CVE-2022-0732: Improper Access Control

The backend infrastructure shared by multiple mobile device monitoring services does not adequately authenticate or authorize API requests, creating an IDOR Insecure Direct Object Reference vulnerability...

CVE-2022-0731

Improper Access Control IDOR in GitHub repository dolibarr/dolibarr prior to 16.0...

Improper access control

Improper Access Control IDOR in GitHub repository dolibarr/dolibarr prior to 16.0...

UBUNTU-CVE-2022-0731

Improper Access Control IDOR in GitHub repository dolibarr/dolibarr prior to 16.0...

CVE-2022-0731

Improper Access Control IDOR in GitHub repository dolibarr/dolibarr prior to 16.0...

CVE-2022-0731

CVE-2022-0731 concerns an Improper Access Control (IDOR) in the GitHub repository dolibarr/dolibarr prior to 16.0. The connected OSV entries repeatedly describe the issue as an IDOR in dolibarr/dolibarr before version 16.0; no detailed root-cause or affected subcomponents are provided in the docu...