Design/Logic Flaw

In GLPI before 9.5.3, ajax/comments.php has an Insecure Direct Object Reference IDOR vulnerability that allows an attacker to read data from any database table e.g., glpitickets, glpiusers, etc...

CVE-2020-27663

CVE-2020-27663 affects GLPI prior to 9.5.3, exposing an Insecure Direct Object Reference (IDOR) in ajax/getDropdownValue.php that allows reading data for any itemType (e.g., Ticket, Users). The vulnerability stems from insufficient access control in the endpoint, enabling data disclosure without ...

CVE-2020-27662

CVE-2020-27662 affects GLPI with an Insecure Direct Object Reference (IDOR) in ajax/comments.php, allowing reading data from arbitrary tables (e.g., glpi_tickets, glpi_users) in versions prior to 9.5.3. The CVSS data lists a moderate base impact (C/L) with network access and low privileges requir...

CVE-2020-27662

In GLPI before 9.5.3, ajax/comments.php has an Insecure Direct Object Reference IDOR vulnerability that allows an attacker to read data from any database table e.g., glpitickets, glpiusers, etc...

mantis -- multiple vulnerabilities

Mantis 2.24.4 release reports: Security and maintenance release, addressing 6 CVEs: 0027726: CVE-2020-29603: disclosure of private project name 0027727: CVE-2020-29605: disclosure of private issue summary 0027728: CVE-2020-29604: full disclosure of private issue contents, including bugnotes and...

Local file disclosure / path traversal within WEB-INF in Crucible - CVE-2020-29446

Affected versions of Atlassian Dev Tools allow remote attackers to browse local files via an Insecure Direct Object References IDOR vulnerability in WEB-INF in Fisheye/Crucible. The affected versions are before version 4.8.5. Affected versions: version 4.8.5 Fixed versions: 4.8.5 4.9.0...

Local file disclosure / path traversal within WEB-INF in Crucible - CVE-2020-29446

Affected versions of Atlassian Dev Tools allow remote attackers to browse local files via an Insecure Direct Object References IDOR vulnerability in WEB-INF in Fisheye/Crucible. The affected versions are before version 4.8.5. Affected versions: version 4.8.5 Fixed versions: 4.8.5 4.9.0...

glpi -- Insecure Direct Object Reference on ajax/comments.ph

MITRE Corporation reports: In GLPI before 9.5.3, ajax/comments.php has an Insecure Direct Object Reference IDOR vulnerability that allows an attacker to read data from any database table e.g., glpitickets, glpiusers, etc...

Realia <= 1.4 - Unauthenticated IDOR leading to Arbitrary Post Deletion

While investigating an IDOR issue on a premium theme, allowing arbitrary deletion of Ads, submitted by Vlad Vector, the Realia plugin was found to be the root cause. In fact, having this plugin installed which some themes require can allow unauthenticated attackers to delete arbitrary posts, by...

Realia <= 1.4 - Unauthenticated IDOR leading to Arbitrary Post Deletion

While investigating an IDOR issue on a premium theme, allowing arbitrary deletion of Ads, submitted by Vlad Vector, the Realia plugin was found to be the root cause. In fact, having this plugin installed which some themes require can allow unauthenticated attackers to delete arbitrary posts, by...

Mail.ru: Access User Tickets via IDOR in [widget.support.my.games]

IDOR vulnerability in widget.support.my.games allowed to disclose the user tickets...

U.S. Dept Of Defense: View another user information with IDOR vulnerability

1- Navigate to the system. https://███████/login.php 2- Navigate to register page. https://██████████/register.phpi created user, username:██████ pass: TEst.123.! 3- Login to the system. https://███/login.php 4- Navigate to "My Profile Page". 5- Intercept the request. 6- Change the "UID2=4820038"...

CS Money: IDOR in https://3d.cs.money/

Summary: Hello, I found an IDOR in https://3d.cs.money/ which will allow you to save, edit, delete build of victim account without any grant on the victim account Steps To Reproduce: This bug based on steamID which is reflected on Steam or you can use any Steam ID Finder software to find...

CVE-2020-16244

GE Digital APM Classic, Versions 4.4 and prior. Salt is not used for hash calculation of passwords, making it possible to decrypt passwords. This design flaw, along with the IDOR vulnerability, puts the entire platform at high risk because an authenticated user can retrieve all user account data...

CVE-2020-16240

GE Digital APM Classic (Versions 4.4 and prior) is vulnerable to CVE-2020-16240: an Authorization Bypass Through User-Controlled Key (IDOR) that allows unauthorized users to download sensitive user‑account data in JSON . Root cause: insecure IDOR enabling data exfiltration. Affected product: GE D...

CVE-2020-16244

GE Digital APM Classic, Versions 4.4 and prior. Salt is not used for hash calculation of passwords, making it possible to decrypt passwords. This design flaw, along with the IDOR vulnerability, puts the entire platform at high risk because an authenticated user can retrieve all user account data...

TikTok: Cross-Tenant IDOR ( graphql `AddRulesToPixelEvents` query ) allowing to add, update, and delete rules of any Pixel events on the platform

Due to an Insecure Direct Object Reference IDOR vulnerability, an attacker could have potentially added, deleted, or updated rules for other users' pixel events in the TikTok ads portal. We thank @bubbounty for reporting this to our team and confirming the resolution. This report is one of my...

Logitech: IDOR when creating App on [platform.streamlabs.com/api/v1/store/whitelist] with user_id field

Summary: Hi team, There is a IDOR when applying to platform.streamlabs.com after loginning. If you login to platform.streamlabs.com and click Create App. You will see the "apply form". And if you submit it, you will see the userid parameter in JSON data of the apply request. api/v1/store/whitelis...

Mail.ru: read new emails from any inbox IOS APP in notification center

IDOR vulnerability in notification center API as used by Mail.ru Mail application for iOS allowed to request notifications for arbitrary e-mail address...

Mail.ru: Пользователь может просматривать, удалять и изменять данные любой компании перебирая domain_id [biz.mail.ru]

An IDOR vulnerability in biz.mail.ru allowed to partially manipulate billing data tax id, addresses of arbitrary company...