New Relic: IDOR - User is able to download charts/dashboards from cross accounts

@k3ne described an issue where a user on an account could access data concerning dashboards for another user on the same account. While this appeared to be a cross-account access issue, both users on the account have access to the same data by design...

Automattic: IDOR leads to Edit Anyone's Blogs / Websites

Hello there, I hope all is well! Steps: 1. Go to https://intensedebate.com/signup and create 2 accounts. 2. Login as victim and go to https://www.intensedebate.com/edit-user-profile 3. Click Add Blog / Website text and fill the form click Save Settings button 4. Go to...

Mail.ru: IDOR смена email пользователя через Ситимобил Бизнес

It was possible to change e-mail address of the user via corporate.city-mobil.ru. An award for this report was distributed evenly between 956791 and 971422. Report 956791 demonstrated the vector for corporate.city-mobil.ru, 971422 demonstrated this vulnerability may have higher impact besides the...

Mail.ru: Пользователь может изменить способ оплаты указав чужой corporation ID

IDOR vulnerability in city-mobil.ru allowed arbitrary organization to be billed for a taxi ride...

LY Corporation: Developer uploaded files missing authentication on LINE GAME Developers site(gdc.game.line.me)

IDOR vulnerability at gdc.game.line.me allowed unauthenticated users to perform brute-force attacks to disclose unauthorized files related to service testing and QA...

U.S. Dept Of Defense: IDOR to Account Takeover on https://████/index.html

Hello Team! Summary: I found when you wish to update your profile on https://███████/ after your login through https://██████████/signIn/signIn.html website due to an IDOR. This IDOR gives you the opportunity to change the origin email for the registered account by changing the ID parameter on th...

A Vulnerability Disclosure Program is not just a page on a web site

It’s great to see an increasing number of organisations starting down the path of a Vulnerability Disclosure Program or ‘VDP,’ but it increasingly strikes me that these are ‘check box’ exercises rather than a genuine desire to interact positively with researchers and improve security. A VDP is a...

Yelp: IDOR in locid parameter allowing to view others accounts Profile Locations

The application transmits in many occasions the locid parameter via URL, which means that this parameter may be being logged in plan text in the Apache server access.log, if not in others also. The fact that this happens, makes this parameter vulnerable not only to be read from this log file, but...

Azbuka Vkusa: IDOR - Other user's delivery address disclosed

Closed...

Dropcontact: Idor for firstpromoter service

An IDOR has been detected on firstpromoter service...

Mail.ru: В самокат имеется возможность просмотра суммы заказа и номера заказа по ID [smart.space]

IDOR in smart.space API allowed to list number and amount of order without attribution to user...

Mail.ru: Возможность просмотра коментариев к чужим обращениям [corporate.city-mobil.ru]

IDOR vulnerability in corporate.city-mobil.ru interface allowed to access a feedback comments of a different users...

Mail.ru: IDOR zakazaka (состояние заказа и перезаказ)

An IDOR vulnerability in zakazaka allowed to obtain the content of the order without personal details...

CVE-2020-10779

Red Hat CloudForms 4.7 and 5 leads to insecure direct object references IDOR and functional level access control bypass due to missing privilege check. Therefore, if an attacker knows the right criteria, it is possible to access some sensitive data within the CloudForms...

CVE-2020-10779

Red Hat CloudForms 4.7 and 5 leads to insecure direct object references IDOR and functional level access control bypass due to missing privilege check. Therefore, if an attacker knows the right criteria, it is possible to access some sensitive data within the CloudForms...

CVE-2020-10779

CVE-2020-10779 affects Red Hat CloudForms 4.7 and 5, where an insecure direct object reference (IDOR) and functional level access control bypass occur due to a missing privilege check. The issue enables an attacker with sufficient criteria and low privileges to access some sensitive data within C...

Authorization Bypass

cfme-gemset is vulnerable to authorization bypass. The vulnerability exists through missing functional level access control & IDOR lead to compromise...

Mail.ru: Ability to edit the address of any company by its id on [corporate.city-mobil.ru]

IDOR vulnerability in corporate.city-mobil.ru interface allowed to edit the address of any company...

Online Shopping Alphaware 1.0 Insecure Direct Object Reference Vulnerability

Exploit for php platform in category web applications Exploit Title: Online Shopping Alphaware 1.0 - 'Summary' Insecure Direct Object Reference Authenticated Exploit Author: Edo Maland Vendor Homepage: https://www.sourcecodester.com/php/14368/online-shopping-alphaware-phpmysql.html Software Link:...

Online Shopping Alphaware 1.0 Insecure Direct Object Reference

Exploit Title: Online Shopping Alphaware 1.0 - 'Summary' Insecure Direct Object Reference Authenticated Date: 2020-8-4 Exploit Author: Edo Maland Vendor Homepage: https://www.sourcecodester.com/php/14368/online-shopping-alphaware-phpmysql.html Software Link:...