CWE:
 

Tytuł
Data
Autor
Low
Listeo WordPress Theme <= 1.6.10 - Multiple Authenticated IDOR Vulnerabilities
17.05.2021
m0ze
Med.
HomeSweet - Real Estate WordPress Theme v1.4 - IDOR leading to arbitrary deletion of ads
13.07.2020
Vlad Vector
Med.
CarSpot – Dealership Wordpress Classified Theme v2.2.0 Multiple Vulnerabilities
17.01.2020
m0ze
Med.
Fortify Software Security Center (SSC) 17.10/17.20/18.10 Information Disclosure (2)
24.12.2018
alt3kx


Common Weakness Enumeration (CWE)

CVE
Szczegóły
Opis
2021-11-19
Medium
CVE-2021-22951

Vendor: Concretecms
Software: Concrete cms
 

 
Unauthorized individuals could view password protected files using view_inline in Concrete CMS (previously concrete 5) prior to version 8.5.7. Concrete CMS now checks to see if a file has a password in view_inline and, if it does, the file is not rendered.For version 8.5.6, the following mitigations were put in place a. restricting file types for view_inline to images only b. putting a warning in the file manager to advise users.Credit for discovery: "Solar Security Research Team"Concrete CMS security team CVSS scoring is 5.3: AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NThis fix is also in Concrete version 9.0.0

 
Medium
CVE-2021-22967

Vendor: Concretecms
Software: Concrete cms
 

 

 
2021-11-08
Medium
CVE-2021-24840

Vendor: Codesupply
Software: Squaretype
 

 
The Squaretype WordPress theme before 3.0.4 allows unauthenticated users to manipulate the query_vars used to retrieve the posts to display in one of its REST endpoint, without any validation. As a result, private and scheduled posts could be retrieved via a crafted request.

 
2021-10-26
Medium
CVE-2021-41307

Vendor: Atlassian
Software: JIRA
 

 
Affected versions of Atlassian Jira Server and Data Center allow unauthenticated remote attackers to view the names of private projects and private filters via an Insecure Direct Object References (IDOR) vulnerability in the Workload Pie Chart Gadget. The affected versions are before version 8.13.12, and from version 8.14.0 before 8.20.0.

 
2021-10-14
Medium
CVE-2021-36388

Vendor: Yellowfinbi
Software: Yellowfin
 

 
In Yellowfin before 9.6.1 it is possible to enumerate and download users profile pictures through an Insecure Direct Object Reference vulnerability exploitable by sending a specially crafted HTTP GET request to the page "MIIAvatarImage.i4".

 
Medium
CVE-2021-36389

Vendor: Yellowfinbi
Software: Yellowfin
 

 
In Yellowfin before 9.6.1 it is possible to enumerate and download uploaded images through an Insecure Direct Object Reference vulnerability exploitable by sending a specially crafted HTTP GET request to the page "MIImage.i4".

 
2021-09-30
Medium
CVE-2021-41298

Vendor: ECOA
Software: Riskterminator
 

 
ECOA BAS controller is vulnerable to insecure direct object references that occur when the application provides direct access to objects based on user-supplied input. As a result of this vulnerability, attackers with general user's privilege can remotely bypass authorization and access the hidden resources in the system and execute privileged functionalities.

 
High
CVE-2021-41301

Vendor: ECOA
Software: Riskterminator
 

 
ECOA BAS controller is vulnerable to configuration disclosure when direct object reference is made to the specific files using an HTTP GET request. This will enable the unauthenticated attacker to remotely disclose sensitive information and help her in authentication bypass, privilege escalation and full system access.

 
2021-09-27
Medium
CVE-2021-36874

Vendor: Stylemixthemes
Software: Ulisting
 

 
Authenticated Insecure Direct Object References (IDOR) vulnerability in WordPress uListing plugin (versions <= 2.0.5).

 
2021-09-14
Waiting for details
CVE-2021-37184

Updating...
 

 
A vulnerability has been identified in Industrial Edge Management (All versions < V1.3). An unauthenticated attacker could change the the password of any user in the system under certain circumstances. With this an attacker could impersonate any valid user on an affected system.

 

 


Copyright 2021, cxsecurity.com

 

Back to Top