CVE-2021-24500 Workreap theme < 2.2.2 - Multiple CSRF + IDOR Vulnerabilities

Several AJAX actions available in the Workreap WordPress theme before 2.2.2 lacked CSRF protections, as well as allowing insecure direct object references that were not validated. This allows an attacker to trick a logged in user to submit a POST request to the vulnerable site, potentially...

CVE-2021-37215

The CVE-2021-37215 entry describes an Insecure Direct Object Reference (IDOR) in Flygo’s employee management page. After authenticating as a general user, an attacker can manipulate and overwrite another employee’s data by supplying that employee’s ID in an API parameter. Documents confirm this v...

CVE-2021-37214 Larvata Digital Technology Co. Ltd. FLYGO - Use of Incorrectly-Resolved Name or Reference-3

The employee management page of Flygo contains Insecure Direct Object Reference IDOR vulnerability. After being authenticated as a general user, remote attackers can manipulate the employee ID in specific parameters to arbitrary access employee's data, modify it, and then obtain administrator...

CVE-2021-37214

CVE-2021-37214 affects Flygo's employee management page. It is an Insecure Direct Object Reference (IDOR ) vulnerability allowing an authenticated general user to alter the employee ID parameter to access/modify other employees’ data, escalate to administrator privileges, and execute arbitrary co...

CVE-2021-37213

The CVE-2021-37213 entry concerns Flygo, an attendance/clocking system by Larvata. Affected component: the check-in record page where an authenticated general user can exploit an insecure direct object reference (IDOR) by altering parameters (employee ID and date) to access other employees’ check...

CVE-2021-37212 Larvata Digital Technology Co. Ltd. FLYGO - Use of Incorrectly-Resolved Name or Reference-1

The bulletin function of Flygo contains Insecure Direct Object Reference IDOR vulnerability. After being authenticated as a general user, remote attackers can manipulate the bulletin ID in specific Url parameters and access and modify bulletin particular content...

CVE-2021-37212

CVE-2021-37212 describes an Insecure Direct Object Reference (IDOR) in the Flygo bulletin function. The issue allows a user who is authenticated as a general user to manipulate the bulletin ID in specific URL parameters to access and modify bulletin content. The vulnerability is documented across...

PT-2021-21579

Name of the Vulnerable Software and Affected Versions Flygo affected versions not specified Description The employee management page of Flygo contains an Insecure Direct Object Reference IDOR issue. After being authenticated as a general user, remote attackers can manipulate the employee ID in...

PT-2021-21578

Name of the Vulnerable Software and Affected Versions Flygo affected versions not specified Description The check-in record page of Flygo contains an Insecure Direct Object Reference IDOR issue. After being authenticated as a general user, remote attackers can manipulate the employee ID and date ...

CVE-2021-37213: Use of Incorrectly-Resolved Name or Reference

The check-in record page of Flygo contains Insecure Direct Object Reference IDOR vulnerability. After being authenticated as a general user, remote attackers can manipulate the employee ID and date in specific parameters to access particular employee’s check-in record...

CVE-2021-37214: Use of Incorrectly-Resolved Name or Reference

The employee management page of Flygo contains Insecure Direct Object Reference IDOR vulnerability. After being authenticated as a general user, remote attackers can manipulate the employee ID in specific parameters to arbitrary access employee's data, modify it, and then obtain administrator...

CVE-2021-37215: Use of Incorrectly-Resolved Name or Reference

The employee management page of Flygo contains an Insecure Direct Object Reference IDOR vulnerability. After being authenticated as a general user, remote attacker can manipulate the user data and then over-write another employee’s user data by specifying that employee’s ID in the API parameter...

PT-2021-21577

Name of the Vulnerable Software and Affected Versions Flygo affected versions not specified Description The bulletin function of Flygo contains an Insecure Direct Object Reference IDOR issue. After being authenticated as a general user, remote attackers can manipulate the bulletin ID in specific...

PT-2021-21580

Name of the Vulnerable Software and Affected Versions Flygo affected versions not specified Description The employee management page of Flygo contains an Insecure Direct Object Reference IDOR issue. After being authenticated as a general user, a remote attacker can manipulate user data and then...

CVE-2021-37212: Use of Incorrectly-Resolved Name or Reference

The bulletin function of Flygo contains Insecure Direct Object Reference IDOR vulnerability. After being authenticated as a general user, remote attackers can manipulate the bulletin ID in specific Url parameters and access and modify bulletin particular content...

CVE-2021-24473

The User Profile Picture WordPress plugin before 2.6.0 was affected by an IDOR issue, allowing users with the uploadimage capability by default author and above to change and delete the profile pictures of other users including those with higher roles...

CVE-2021-24473 User Profile Picture < 2.6.0 - Arbitrary User Picture Change/Deletion via IDOR

The User Profile Picture WordPress plugin before 2.6.0 was affected by an IDOR issue, allowing users with the uploadimage capability by default author and above to change and delete the profile pictures of other users including those with higher roles...

CVE-2021-24473

The CVE-2021-24473 entry concerns the WordPress plugin User Profile Picture, affected in versions before 2.6.0. The vulnerability is an Insecure Direct Object Reference (IDOR) that allows users with the upload_image capability (default: author and above) to change and delete the profile pictures ...

TikTok: Multiple IDORs in family pairing api

An IDOR Insecure Direct Object Reference vulnerability was found on a TikTok Family Pairing endpoint which could have been used to disable various features. We thank @s3c for reporting this to our team and confirming the fix. Write up...

CVE-2021-24473: Authorization Bypass Through User-Controlled Key

The User Profile Picture WordPress plugin before 2.6.0 was affected by an IDOR issue, allowing users with the uploadimage capability by default author and above to change and delete the profile pictures of other users including those with higher roles...