Total
319 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2022-1352 | 1 Gitlab | 1 Gitlab | 2022-05-19 | 5.0 MEDIUM | 5.3 MEDIUM |
| Due to an insecure direct object reference vulnerability in Gitlab EE/CE affecting all versions from 11.0 prior to 14.8.6, 14.9 prior to 14.9.4, and 14.10 prior to 14.10.1, an endpoint may reveal the issue title to a user who crafted an API call with the ID of the issue from a public project that restricts access to issue only to project members. | |||||
| CVE-2022-28986 | 1 Lmsdoctor | 1 2 Factor Authentication | 2022-05-18 | 5.0 MEDIUM | 7.5 HIGH |
| LMS Doctor Simple 2 Factor Authentication Plugin For Moodle Affected: 2021072900 has an Insecure direct object references (IDOR) vulnerability, which allows remote attackers to update sensitive records such as email, password and phone number of other user accounts. | |||||
| CVE-2021-45428 | 1 Telesquare | 2 Tlr-2005ksh, Tlr-2005ksh Firmware | 2022-05-12 | 7.5 HIGH | 9.8 CRITICAL |
| TLR-2005KSH is affected by an incorrect access control vulnerability. THe PUT method is enabled so an attacker can upload arbitrary files including HTML and CGI formats. | |||||
| CVE-2022-23061 | 1 Shopizer | 1 Shopizer | 2022-05-09 | 5.5 MEDIUM | 6.5 MEDIUM |
| In Shopizer versions 2.0 to 2.17.0 a regular admin can permanently delete a superadmin (although this cannot happen according to the documentation) via Insecure Direct Object Reference (IDOR) vulnerability. | |||||
| CVE-2021-24800 | 1 Designwall | 1 Dw Question \& Answer | 2022-05-05 | 4.0 MEDIUM | 4.3 MEDIUM |
| The DW Question & Answer Pro WordPress plugin through 1.3.4 does not check that the comment to edit belongs to the user making the request, allowing any user to edit other comments. | |||||
| CVE-2022-1461 | 1 Open-emr | 1 Openemr | 2022-05-04 | 4.0 MEDIUM | 6.5 MEDIUM |
| Non Privilege User can Enable or Disable Registered in GitHub repository openemr/openemr prior to 6.1.0.1. | |||||
| CVE-2022-1459 | 1 Open-emr | 1 Openemr | 2022-05-04 | 5.5 MEDIUM | 8.3 HIGH |
| Non-Privilege User Can View Patient’s Disclosures in GitHub repository openemr/openemr prior to 6.1.0.1. | |||||
| CVE-2021-29773 | 2 Ibm, Linux | 2 Security Guardium, Linux Kernel | 2022-05-03 | 5.5 MEDIUM | 5.4 MEDIUM |
| IBM Security Guardium 10.6 and 11.3 could allow a remote authenticated attacker to obtain sensitive information or modify user details caused by an insecure direct object vulnerability (IDOR). IBM X-Force ID: 202865. | |||||
| CVE-2021-39889 | 1 Gitlab | 1 Gitlab | 2022-05-03 | 4.0 MEDIUM | 4.3 MEDIUM |
| In all versions of GitLab EE since version 14.1, due to an insecure direct object reference vulnerability, an endpoint may reveal the protected branch name to a malicious user who makes a crafted API call with the ID of the protected branch. | |||||
| CVE-2020-6641 | 1 Fortinet | 1 Fortipresence | 2022-05-03 | 4.0 MEDIUM | 4.3 MEDIUM |
| Two authorization bypass through user-controlled key vulnerabilities in the Fortinet FortiPresence 2.1.0 administration interface may allow an attacker to gain access to some user data via portal manager or portal users parameters. | |||||
| CVE-2021-31927 | 1 Annexcloud | 1 Loyalty Experience Platform | 2022-05-03 | 4.0 MEDIUM | 4.3 MEDIUM |
| An Insecure Direct Object Reference (IDOR) vulnerability in Annex Cloud Loyalty Experience Platform <2021.1.0.1 allows any authenticated attacker to modify any existing user, including users assigned to different environments and clients. It was fixed in v2021.1.0.2. | |||||
| CVE-2021-35337 | 1 Phone Shop Sales Management System Project | 1 Phone Shop Sales Management System | 2022-05-03 | 4.0 MEDIUM | 4.3 MEDIUM |
| Sourcecodester Phone Shop Sales Managements System 1.0 is vulnerable to Insecure Direct Object Reference (IDOR). Any attacker will be able to see the invoices of different users by changing the id parameter. | |||||
| CVE-2021-40352 | 1 Open-emr | 1 Openemr | 2022-05-03 | 4.0 MEDIUM | 6.5 MEDIUM |
| OpenEMR 6.0.0 has a pnotes_print.php?noteid= Insecure Direct Object Reference vulnerability via which an attacker can read the messages of all users. | |||||
| CVE-2021-37777 | 1 Gilacms | 1 Gila Cms | 2022-05-03 | 5.0 MEDIUM | 7.5 HIGH |
| Gila CMS 2.2.0 is vulnerable to Insecure Direct Object Reference (IDOR). Thumbnails uploaded by one site owner are visible by another site owner just by knowing the other site name and fuzzing for picture names. This leads to sensitive information disclosure. | |||||
| CVE-2021-33981 | 1 Myfwc | 1 Fish \| Hunt Fl | 2022-05-03 | 4.0 MEDIUM | 4.3 MEDIUM |
| An insecure, direct object vulnerability in hunting/fishing license retrieval function of the "Fish | Hunt FL" iOS app versions 3.8.0 and earlier allows a remote authenticated attacker to retrieve other people's personal information and images of their hunting/fishing licenses. | |||||
| CVE-2021-3380 | 1 Height8tech | 1 H8 Ssrms | 2022-05-03 | 4.0 MEDIUM | 6.5 MEDIUM |
| Insecure direct object reference (IDOR) vulnerability in ICREM H8 SSRMS allows attackers to disclose sensitive information via the Print Invoice Functionality. | |||||
| CVE-2021-41306 | 1 Atlassian | 3 Jira, Jira Server, Jira Software Data Center | 2022-05-03 | 5.0 MEDIUM | 7.5 HIGH |
| Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to view private project and filter names via an Insecure Direct Object References (IDOR) vulnerability in the Average Time in Status Gadget. The affected versions are before version 8.13.12, and from version 8.14.0 before 8.20.0. | |||||
| CVE-2021-41305 | 1 Atlassian | 2 Jira, Jira Software Data Center | 2022-05-03 | 5.0 MEDIUM | 7.5 HIGH |
| Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to view the names of private projects and filters via an Insecure Direct Object References (IDOR) vulnerability in the Average Number of Times in Status Gadget. The affected versions are before version 8.13.12.. | |||||
| CVE-2021-37213 | 1 Larvata | 1 Flygo | 2022-04-25 | 4.0 MEDIUM | 4.3 MEDIUM |
| The check-in record page of Flygo contains Insecure Direct Object Reference (IDOR) vulnerability. After being authenticated as a general user, remote attackers can manipulate the employee ID and date in specific parameters to access particular employee’s check-in record. | |||||
| CVE-2021-37214 | 1 Larvata | 1 Flygo | 2022-04-25 | 6.5 MEDIUM | 8.8 HIGH |
| The employee management page of Flygo contains Insecure Direct Object Reference (IDOR) vulnerability. After being authenticated as a general user, remote attackers can manipulate the employee ID in specific parameters to arbitrary access employee's data, modify it, and then obtain administrator privilege and execute arbitrary command. | |||||