Design/Logic Flaw

In Endalia Selection Portal before 4.205.0, an Insecure Direct Object Reference IDOR allows any authenticated user to download every file uploaded to the platform by changing the value of the file identifier aka CommonDownload identification number...

CVE-2020-35577

Endalia Selection Portal (before 4.205.0) is affected by an Insecure Direct Object Reference (IDOR) vulnerability. Authenticated users can download any uploaded file by altering the file identifier (CommonDownload ID). This is the root cause described across multiple sources linked to CVE-2020-35...

CVE-2020-35577: Undefined Security Weakness

In Endalia Selection Portal before 4.205.0, an Insecure Direct Object Reference IDOR allows any authenticated user to download every file uploaded to the platform by changing the value of the file identifier aka CommonDownload identification number...

PT-2021-11805

Name of the Vulnerable Software and Affected Versions: Endalia Selection Portal versions prior to 4.205.0 Description: The issue allows any authenticated user to download every file uploaded to the platform by changing the value of the file identifier also known as CommonDownload identification...

Reddit: [dubmash] Lack of authorization checks - Update Sound Titles

Summary: During the security testing, it has been observed that the UpdateSound api is vulnerable to IDOR. It allows an attacker to edit the victim's sound track titles. This vulnerability can be exploited using the sound track's uuid in the vulnerable request. This id is publicly known. Steps To...

CVE-2021-21022

Magento versions 2.4.1 and earlier, 2.4.0-p1 and earlier and 2.3.6 and earlier are vulnerable to an insecure direct object reference IDOR in the product module. Successful exploitation could lead to unauthorized access to restricted resources...

CVE-2021-21022

Magento versions 2.4.1 and earlier, 2.4.0-p1 and earlier and 2.3.6 and earlier are vulnerable to an insecure direct object reference IDOR in the product module. Successful exploitation could lead to unauthorized access to restricted resources...

Authentication flaw

Magento versions 2.4.1 and earlier, 2.4.0-p1 and earlier and 2.3.6 and earlier are vulnerable to an insecure direct object reference IDOR in the product module. Successful exploitation could lead to unauthorized access to restricted resources...

CVE-2021-21022

Magento versions 2.4.1 and earlier, 2.4.0-p1 and earlier and 2.3.6 and earlier are vulnerable to an insecure direct object reference IDOR in the product module. Successful exploitation could lead to unauthorized access to restricted resources...

CVE-2021-21022

Magento Commerce/Open Source versions 2.4.1 and earlier, 2.4.0-p1 and earlier, and 2.3.6 and earlier are affected by an insecure direct object reference (IDOR) in the product module, enabling unauthorized access to restricted resources. The issue is a direct object reference vulnerability (IDOR) ...

CVE-2021-21022: Authorization Bypass Through User-Controlled Key

Magento versions 2.4.1 and earlier, 2.4.0-p1 and earlier and 2.3.6 and earlier are vulnerable to an insecure direct object reference IDOR in the product module. Successful exploitation could lead to unauthorized access to restricted resources...

Design/Logic Flaw

Insecure Direct Object Reference IDOR exists in Tufin SecureChange, affecting all versions prior to R20-2 GA. Fixed in version R20-2 GA...

CVE-2020-13462

CVE-2020-13462 concerns Tufin SecureChange. The vulnerability is an Insecure Direct Object Reference (IDOR) affecting all versions prior to R20-2 GA, allowing unintended access or disclosure via improper object reference handling. The issue is fixed in version R20-2 GA. Other connected documents ...

CVE-2020-13462: Authorization Bypass Through User-Controlled Key

Insecure Direct Object Reference IDOR exists in Tufin SecureChange, affecting all versions prior to R20-2 GA. Fixed in version R20-2 GA...

PT-2021-9617

Name of the Vulnerable Software and Affected Versions Tufin SecureChange versions prior to R20-2 GA Description An Insecure Direct Object Reference IDOR issue exists, which can be exploited. The estimated number of potentially affected devices worldwide is not specified. There is no information...

X (Formerly Twitter): Ability to add arbitrary images/descriptions/titles to ohter people's issues via IDOR on getrevue.co

Summary: Hi team, I discovered a vulnerability that allows an attacker to add arbitrary images/descriptions/titles to other people's issues via IDOR Description: It's possible to perform a IDOR attacker on getrevue.cowhen adding a image to your issue it's also possible to add descriptions and mor...

CVE-2020-16194

An Insecure Direct Object Reference IDOR vulnerability was found in Prestashop Opart devis 4.0.2. Unauthenticated attackers can have access to any user's invoice and delivery address by exploiting an IDOR on the deliveryaddress and invoiceaddress fields...

Design/Logic Flaw

An Insecure Direct Object Reference IDOR vulnerability was found in Prestashop Opart devis 4.0.2. Unauthenticated attackers can have access to any user's invoice and delivery address by exploiting an IDOR on the deliveryaddress and invoiceaddress fields...

CVE-2020-16194

CVE-2020-16194 concerns an Insecure Direct Object Reference (IDOR) in Prestashop Opart devis versions before 4.0.2. Unauthenticated attackers can access any user’s invoice and delivery address by exploiting IDOR on the delivery_address and invoice_address fields. The vulnerability is documented a...

CVE-2020-16194

An Insecure Direct Object Reference IDOR vulnerability was found in Prestashop Opart devis 4.0.2. Unauthenticated attackers can have access to any user's invoice and delivery address by exploiting an IDOR on the deliveryaddress and invoiceaddress fields...