Authorization Bypass

magento/community-edition is vulnerablbe to authorization bypass. The vulnerability exists through an Insecure Direct Object Reference IDOR that could allow unauthorized access to order details...

FreeBSD : Gitlab -- Multiple Vulnerabilities (1cd89254-b2db-11e9-8001-001b217b3468)

Gitlab reports : GitHub Integration SSRF Trigger Token Impersonation Build Status Disclosure SSRF Mitigation Bypass Information Disclosure New Issue ID IDOR Label Name Enumeration Persistent XSS Wiki Pages User Revokation Bypass with Mattermost Integration Arbitrary File Upload via Import Project...

BCM Messenger: IDOR leading to downloading of any attachment

Description: Hey team, I came across an endpoint on your android app which could be used to download any attachment which is being uploaded onto your server. All the attacker needs to do is bruteforce the simple ID which surprisingly is a randomly generated number I personally think it's based on...

CVE-2019-7925

An insecure direct object reference IDOR vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This can be exploited by an administrator with limited privileges to delete the downloadable products folder...

CVE-2019-7890

An Insecure Direct Object Reference IDOR vulnerability exists in the order processing workflow of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This can lead to unauthorized access to order details...

CVE-2019-7872

An insecure direct object reference IDOR vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2 due to insufficient authorizations checks. This can be abused by a user with admin privileges to add users to company accounts or modify existing us...

CVE-2019-7854

An insecure direct object reference IDOR vulnerability in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2 can lead to unauthorized disclosure of company credit history details...

Design/Logic Flaw

An insecure direct object reference IDOR vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This can be exploited by an administrator with limited privileges to delete the downloadable products folder...

Design/Logic Flaw

An Insecure Direct Object Reference IDOR vulnerability exists in the order processing workflow of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This can lead to unauthorized access to order details...

CVE-2019-7925

An insecure direct object reference IDOR vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This can be exploited by an administrator with limited privileges to delete the downloadable products folder...

CVE-2019-7925

CVE-2019-7925 describes an insecure direct object reference (IDOR) in Magento 2.1.x/2.2.x/2.3.x prior to 2.1.18, 2.2.9, 2.3.2, respectively. An administrator with limited privileges can delete the downloadable products folder. Root cause: IDOR in the handling of downloadable product folders. Impa...

CVE-2019-7890

An Insecure Direct Object Reference IDOR vulnerability exists in the order processing workflow of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This can lead to unauthorized access to order details...

CVE-2019-7890

An Insecure Direct Object Reference IDOR vulnerability exists in the order processing workflow of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This can lead to unauthorized access to order details...

CVE-2019-7890

CVE-2019-7890 is an IDOR in Magento’s order processing workflow affecting 2.1.x before 2.1.18, 2.2 before 2.2.9, and 2.3 before 2.3.2. This could allow unauthorized access to order details. The NVD/Red Hat/OSV entries confirm a high-severity, network-exposed vulnerability with no required user pr...

CVE-2019-7872

CVE-2019-7872 affects Magento 2.1 (<2.1.18), 2.2 (<2.2.9), and 2.3 (

CVE-2019-7864

CVE-2019-7864 describes an insecure direct object reference (IDOR) in Magento’s RSS feeds. Affected products are Magento 2.1 releases before 2.1.18, Magento 2.2 before 2.2.9, and Magento 2.3 before 2.3.2, where RSS feed requests could expose order details to unauthorized users. The Red Hat and OS...

CVE-2019-7854

CVE-2019-7854 is an insecure direct object reference (IDOR) vulnerability in Magento. Affected: Magento 2.1 before 2.1.18, 2.2 before 2.2.9, and 2.3 before 2.3.2. Root cause: misdirected access to sensitive data (unauthorized disclosure of company credit history details) via IDOR. Impact: potenti...

Critical Bug in Android Antivirus Exposes Address Books

A slew of popular free Android antivirus apps in recent testing proved to have security holes and privacy issues – including a critical vulnerability that exposes user’s address books, and another serious flaw that enables attackers to turn off antivirus protection entirely. According to an...

PT-2019-18810

Name of the Vulnerable Software and Affected Versions Magento 2.1 versions prior to 2.1.18 Magento 2.2 versions prior to 2.2.9 Magento 2.3 versions prior to 2.3.2 Description An Insecure Direct Object Reference IDOR issue exists in the order processing workflow. This can lead to unauthorized acce...

PT-2019-18780

Name of the Vulnerable Software and Affected Versions Magento 2.1 versions prior to 2.1.18 Magento 2.2 versions prior to 2.2.9 Magento 2.3 versions prior to 2.3.2 Description An insecure direct object reference IDOR issue can lead to unauthorized disclosure of company credit history details...