idor vulnerabilities and exploits

(subscribe to this query)

An Insecure Direct Object Reference (IDOR) vulnerability in KubeSphere 4.x prior to 4.1.3 and 3.x up to and including 3.4.1 and KubeSphere Enterprise 4.x prior to 4.1.3 and 3.x up to and including 3.5.0 allows low-privileged authenticated malicious users to access sensitive resou...

1 EDB exploit

IDOR vulnerability in the order processing feature from ecommerce component of Apache OFBiz prior to 17.12.04

On versions prior to 2.1.4, after a regular user successfully logs in, they can manually make a request using the authorization token to view everyone's user flink information, including executeSQL and config. Mitigation: all users should upgrade to 2.1.4

Apache Streampark

A hardcoded privileged ID within Lumisxp v15.0.x to v16.1.x allows malicious users to bypass authentication and access internal pages and other sensitive information.

In ProConf prior to 6.1, an Insecure Direct Object Reference (IDOR) allows any author to view and grab all submitted papers (Title and Abstract) and their authors' personal information (Name, Email, Organization, and Position) by changing the value of Paper ID (the pid param...

Proconf Proconf

A potential Remote Unauthorized Access in Micro Focus Fortify Software Security Center (SSC), versions 17.10, 17.20, 18.10 this exploitation could allow Remote Unauthorized Access

Microfocus Fortify Software Security Center 17.10 Microfocus Fortify Software Security Center 17.20 Microfocus Fortify Software Security Center 18.10

1 Github repository

A potential Remote Unauthorized Access in Micro Focus Fortify Software Security Center (SSC), versions 17.10, 17.20, 18.10 this exploitation could allow Remote Unauthorized Access

Microfocus Fortify Software Security Center 17.10 Microfocus Fortify Software Security Center 17.20 Microfocus Fortify Software Security Center 18.10

1 Github repository

For Kiuwan installations with SSO (single sign-on) enabled, an unauthenticated reflected cross-site scripting attack can be performed on the login page "login.html". This is possible due to the request parameter "message" values being directly included in a Ja...

Kiuwan provides an API endpoint /saas/rest/v1/info/application to get information about any application, providing only its name via the "application" parameter. This endpoint lacks proper access control mechanisms, allowing other authenticated users to read information...

When the Kiuwan Local Analyzer uploads the scan results to the Kiuwan SAST web application (either on-premises or cloud/SaaS solution), the transmitted data consists of a ZIP archive containing several files, some of them in the XML file format. During Kiuwan's server-side p...

1 2 3 4 5 NEXT »

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Product List Vendor List Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook