CVE-2021-29773

CVE-2021-29773 affects IBM Security Guardium 10.6 and 11.3, due to an insecure direct object vulnerability (IDOR) that could allow a remote authenticated attacker to obtain sensitive information or modify user details. The IBM Security bulletin indicates these vulnerabilities are fixed in specifi...

CVE-2021-29773

IBM Security Guardium 10.6 and 11.3 could allow a remote authenticated attacker to obtain sensitive information or modify user details caused by an insecure direct object vulnerability IDOR. IBM X-Force ID: 202865...

PT-2021-18470

Name of the Vulnerable Software and Affected Versions IBM Security Guardium versions 10.6 through 11.3 Description The issue allows a remote authenticated attacker to obtain sensitive information or modify user details due to an insecure direct object vulnerability IDOR. This enables the attacker...

CVE-2021-29773: Authorization Bypass Through User-Controlled Key

IBM Security Guardium 10.6 and 11.3 could allow a remote authenticated attacker to obtain sensitive information or modify user details caused by an insecure direct object vulnerability IDOR. IBM X-Force ID: 202865...

Siemens Teamcenter code issue vulnerability

Siemens Teamcenter, a product lifecycle management computer software application from Siemens, Germany, is vulnerable to a code issue that results from an application containing an insecure direct object reference IDOR vulnerability that could be exploited by an attacker to directly access object...

CVE-2021-40355

Siemens Teamcenter is affected by CVE-2021-40355 (IDOR). Affected versions: Teamcenter 12.4 prior to 12.4.0.8; 13.0 prior to 13.0.0.7; 13.1 prior to 13.1.0.5; 13.2 prior to 13.2.0.2. The vulnerability is an insecure direct object reference (IDOR) allowing access to objects via user-supplied input...

CVE-2021-40355: Authorization Bypass Through User-Controlled Key

A vulnerability has been identified in Teamcenter V12.4 All versions V12.4.0.8, Teamcenter V13.0 All versions V13.0.0.7, Teamcenter V13.1 All versions V13.1.0.5, Teamcenter V13.2 All versions 13.2.0.2. The affected application contains Insecure Direct Object Reference IDOR vulnerability that allo...

PT-2021-22873

Name of the Vulnerable Software and Affected Versions Teamcenter versions prior to 12.4.0.8 Teamcenter versions prior to 13.0.0.7 Teamcenter versions prior to 13.1.0.5 Teamcenter versions prior to 13.2.0.2 Description The issue is related to an Insecure Direct Object Reference IDOR vulnerability...

ECOA Building Automation System Authorization Bypass / IDOR

Summary 1 The Risk-Terminator Web Graphic control BEMS Building Energy Management System are designed to provide you with the latest in the Human Machine Interface HMI technology, for completely monitoring and controlling management. It may be used singly for small and medium sized facilities,...

Bus Pass Management System 1.0 Insecure Direct Object Reference

Exploit Title: Bus Pass Management System 1.0 - 'viewid' Insecure direct object references IDOR Date: 2021-09-05 Exploit Author: sudoninja Vendor Homepage: https://phpgurukul.com/bus-pass-management-system-using-php-and-mysql Software Link:...

Bus Pass Management System 1.0 - (viewid) Insecure direct object references Vulnerability

Exploit Title: Bus Pass Management System 1.0 - 'viewid' Insecure direct object references IDOR Exploit Author: sudoninja Vendor Homepage: https://phpgurukul.com/bus-pass-management-system-using-php-and-mysql Software Link:...

Bus Pass Management System 1.0 - 'viewid' Insecure direct object references (IDOR)

Exploit Title: Bus Pass Management System 1.0 - 'viewid' Insecure direct object references IDOR Date: 2021-09-05 Exploit Author: sudoninja Vendor Homepage: https://phpgurukul.com/bus-pass-management-system-using-php-and-mysql Software Link:...

OpenEMR 6.0.0 - 'noteid' Insecure Direct Object Reference (IDOR)

Exploit Title: OpenEMR 6.0.0 - 'noteid' Insecure Direct Object Reference IDOR Date: 31/08/2021 Exploit Author: Allen Enosh Upputori Vendor Homepage: https://www.open-emr.org Software Link: https://www.open-emr.org/wiki/index.php/OpenEMRDownloads Version: 6.0.0 Tested on: Linux CVE : CVE-2021-4035...

Improper Authorization in imran300/inventory

✍️ Description A General manager user can edit/add other group PERMISSIONS LIST with IDOR. 🕵️‍♂️ Proof of Concept go to this url when logging in as a General manager. http://localhost:8000/inventory/index.php/generals/addgroup and then you can see that Permissions can be bypassed. 💥 Impact This...

Improper Authorization in imran300/inventory

✍️ Description A designer user can deactivate any other users IDOR. 🕵️‍♂️ Proof of Concept go to this url when logging in as a Designer. http://localhost:8000/inventory/index.php/Users/deactiveStatus/10 and then you can see that a user with id 10 will be deactivated. 💥 Impact This vulnerability is...

Improper Authorization in imran300/inventory

✍️ Description A designer user can activate any other users IDOR. 🕵️‍♂️ Proof of Concept go to this url when logging in as a Designer. localhost:8000/inventory/index.php/Users/activeStatus/10 and then you can see that a user with id 10 will be activated. 💥 Impact This vulnerability is capable of...

Improper Authorization in imran300/inventory

✍️ Description A designer user can delete any other users IDOR. 🕵️‍♂️ Proof of Concept go to this url when logging in as a Designer. localhost/inventory/users/deleteusers/10 and then you can see that a user with id 10 will be deleted. 💥 Impact This vulnerability is capable of delete any user...

PT-2021-22871

Name of the Vulnerable Software and Affected Versions OpenEMR version 6.0.0 Description The issue allows an attacker to read the messages of all users due to an Insecure Direct Object Reference vulnerability. This can be exploited via the pnotes print.php endpoint with the noteid parameter...

Affirm: IDOR to view order information of users and personal information

Summary: Broken access control is the method of controlling which users can perform a certain type of action or view set of data. Broken access control is a vulnerability that allows an attacker to circumvent those controls and perform more actions than they are allowed to, or view content they...

CVE-2021-24562

The LMS by LifterLMS – Online Course, Membership & Learning Management System Plugin for WordPress plugin before 4.21.2 was affected by an IDOR issue, allowing students to see other student answers and grades...