CVE-2019-19259

GitLab Enterprise Edition EE 11.3 and later through 12.5 allows an Insecure Direct Object Reference IDOR...

Design/Logic Flaw

GitLab Enterprise Edition EE 11.3 and later through 12.5 allows an Insecure Direct Object Reference IDOR...

CVE-2019-19259

Removed by vendor...

CVE-2019-19259

CVE-2019-19259 refers to a vulnerability in GitLab Enterprise Edition (EE) 11.3 and later through 12.5 that allows an Insecure Direct Object Reference (IDOR), leading to potential information disclosure. The issue affects the application’s handling of object references and is categorized with a C...

CVE-2019-19259: Authorization Bypass Through User-Controlled Key

GitLab Enterprise Edition EE 11.3 and later through 12.5 allows an Insecure Direct Object Reference IDOR...

PT-2020-10111

Name of the Vulnerable Software and Affected Versions GitLab Enterprise Edition EE versions 11.3 through 12.5 Description The issue is related to an Insecure Direct Object Reference IDOR. No information is provided about the estimated number of potentially affected devices worldwide or real-world...

Mail.ru: information disclosure via IDOR on "https://target.my.com/api/v2/coverage/segment.json?id={id}" endpoint

IDOR in target.my.com allowed to get numeric segmentation identifiers by site id. No sensitive information or associated security risks identified...

Polymail, Inc.: Metadata leakage via IDOR

Inbox metadata leakage via Insecure Direct Object Reference on one endpoint...

CVE-2019-5469

An IDOR vulnerability exists in GitLab v12.1.2, v12.0.4, and v11.11.6 that allowed uploading files from project archive to replace other users files potentially allowing an attacker to replace project binaries or other uploaded assets...

CVE-2019-5469

An IDOR vulnerability exists in GitLab v12.1.2, v12.0.4, and v11.11.6 that allowed uploading files from project archive to replace other users files potentially allowing an attacker to replace project binaries or other uploaded assets...

Code injection

An IDOR vulnerability exists in GitLab v12.1.2, v12.0.4, and v11.11.6 that allowed uploading files from project archive to replace other users files potentially allowing an attacker to replace project binaries or other uploaded assets...

CVE-2019-5469

An IDOR vulnerability exists in GitLab v12.1.2, v12.0.4, and v11.11.6 that allowed uploading files from project archive to replace other users files potentially allowing an attacker to replace project binaries or other uploaded assets...

CVE-2019-5469

CVE-2019-5469 corresponds to an IDOR in GitLab prior to 12.1.2, before 12.0.4, and before 11.11.6 that lets an attacker upload a file from a project archive to replace another user’s files, potentially enabling replacement of project binaries or other uploaded assets. Public disclosures in multip...

CVE-2019-5469

An IDOR vulnerability exists in GitLab v12.1.2, v12.0.4, and v11.11.6 that allowed uploading files from project archive to replace other users files potentially allowing an attacker to replace project binaries or other uploaded assets...

CVE-2019-5469

Removed by vendor...

Mail.ru: Customer domain information disclosure at https://biz.mail.ru/api/domains/*

IDOR vulnerability in biz.mail.ru could be used to enumerate registered domains...

Razer: [Razer Pay Mobile App] IDOR within /v1_IM/friends/queryDrawRedLog allowed unauthorised access to read logs

The tester determined the Razer Pay MY server was vulnerable to unauthorized access of certain log file information due to an exposed signature in the Razer Pay Android application. Razer Fintech appreciates the clear and detailed report...

Design/Logic Flaw

An Insecure Direct Object Reference IDOR vulnerability in the Xtivia Web Time and Expense WebTE interface used for Microsoft Dynamics NAV before 2017 allows an attacker to download arbitrary files by specifying arbitrary values for the recId and filename parameters of the /Home/GetAttachment...

CVE-2019-19616

CVE-2019-19616 concerns an insecure direct object reference in the Xtivia Web Time and Expense (WebTE) interface for Microsoft Dynamics NAV prior to 2017. The vulnerability occurs in the /Home/GetAttachment function, where an attacker can download arbitrary files by supplying arbitrary values for...

CVE-2019-19616

An Insecure Direct Object Reference IDOR vulnerability in the Xtivia Web Time and Expense WebTE interface used for Microsoft Dynamics NAV before 2017 allows an attacker to download arbitrary files by specifying arbitrary values for the recId and filename parameters of the /Home/GetAttachment...