A Vulnerability Disclosure Program is not just a page on a web site

It’s great to see an increasing number of organisations starting down the path of a Vulnerability Disclosure Program or ‘VDP,’ but it increasingly strikes me that these are ‘check box’ exercises rather than a genuine desire to interact positively with researchers and improve security. A VDP is a...

Yelp: IDOR in locid parameter allowing to view others accounts Profile Locations

The application transmits in many occasions the locid parameter via URL, which means that this parameter may be being logged in plan text in the Apache server access.log, if not in others also. The fact that this happens, makes this parameter vulnerable not only to be read from this log file, but...

Azbuka Vkusa: IDOR - Other user's delivery address disclosed

Closed...

Dropcontact: Idor for firstpromoter service

An IDOR has been detected on firstpromoter service...

Mail.ru: В самокат имеется возможность просмотра суммы заказа и номера заказа по ID [smart.space]

IDOR in smart.space API allowed to list number and amount of order without attribution to user...

Mail.ru: Возможность просмотра коментариев к чужим обращениям [corporate.city-mobil.ru]

IDOR vulnerability in corporate.city-mobil.ru interface allowed to access a feedback comments of a different users...

Mail.ru: IDOR zakazaka (состояние заказа и перезаказ)

An IDOR vulnerability in zakazaka allowed to obtain the content of the order without personal details...

CVE-2020-10779

Red Hat CloudForms 4.7 and 5 leads to insecure direct object references IDOR and functional level access control bypass due to missing privilege check. Therefore, if an attacker knows the right criteria, it is possible to access some sensitive data within the CloudForms...

CVE-2020-10779

Red Hat CloudForms 4.7 and 5 leads to insecure direct object references IDOR and functional level access control bypass due to missing privilege check. Therefore, if an attacker knows the right criteria, it is possible to access some sensitive data within the CloudForms...

CVE-2020-10779

CVE-2020-10779 affects Red Hat CloudForms 4.7 and 5, where an insecure direct object reference (IDOR) and functional level access control bypass occur due to a missing privilege check. The issue enables an attacker with sufficient criteria and low privileges to access some sensitive data within C...

CVE-2020-10779: Authorization Bypass Through User-Controlled Key

Red Hat CloudForms 4.7 and 5 leads to insecure direct object references IDOR and functional level access control bypass due to missing privilege check. Therefore, if an attacker knows the right criteria, it is possible to access some sensitive data within the CloudForms...

Authorization Bypass

cfme-gemset is vulnerable to authorization bypass. The vulnerability exists through missing functional level access control & IDOR lead to compromise...

Mail.ru: Ability to edit the address of any company by its id on [corporate.city-mobil.ru]

IDOR vulnerability in corporate.city-mobil.ru interface allowed to edit the address of any company...

Online Shopping Alphaware 1.0 Insecure Direct Object Reference Vulnerability

Exploit for php platform in category web applications Exploit Title: Online Shopping Alphaware 1.0 - 'Summary' Insecure Direct Object Reference Authenticated Exploit Author: Edo Maland Vendor Homepage: https://www.sourcecodester.com/php/14368/online-shopping-alphaware-phpmysql.html Software Link:...

Online Shopping Alphaware 1.0 Insecure Direct Object Reference

Exploit Title: Online Shopping Alphaware 1.0 - 'Summary' Insecure Direct Object Reference Authenticated Date: 2020-8-4 Exploit Author: Edo Maland Vendor Homepage: https://www.sourcecodester.com/php/14368/online-shopping-alphaware-phpmysql.html Software Link:...

Automattic: IDOR when editing email leads to Account Takeover on Atavist

Summary: Hi team, I created an account on Atavist and checked my settings page. I can change my email at https://magazine.atavist.com/cms/reader/account with this request : F936117 And as you can see, there is a id parameter on request data. It's our user ID, and it's vulnerable for IDOR. So we c...

Mail.ru: Disclosure of personal support email addresses on 'support-fleet.city-mobil.ru'

IDOR vulnerability in support-fleet.city-mobil.ru allowed to disclose the support staff e-mail addresses...

PT-2020-3569

Name of the Vulnerable Software and Affected Versions Red Hat CloudForms versions 4.7 through 5 Description The issue is related to insufficient access control in the CloudForms Management Engine, allowing for insecure direct object references IDOR and functional level access control bypass due t...

Mail.ru: В самокате можно просматривать и изменять данные любого заказа без авторизации

IDOR in smart.space API allowed to change orders and list items of order content...

Lark Technologies: [IDOR] Modify other team's reminders via reminderId parameter

An IDOR Insecure Direct Object Reference vulnerability was found in Larksuite reminders, allowing an attacker to modify any other user's reminder in the POST request via "reminderId" parameter. We thank imrannisar for reporting this vulnerability and confirming its resolution...