In ProConf version before 6.1, an Insecure Direct Object Reference (IDOR) vulnerability exists. This vulnerability allows any author to access and retrieve all submitted papers including titles, abstracts, and personal information of authors (such as Name, Email, Organization, and Position) by manipulating the Paper ID parameter.
Snipe-IT version 8.0.4 and below has an IDOR vulnerability in the `/locations/<id>/printassigned` endpoint. This allows an authenticated user to access asset assignment data of other departments by changing the `location_id` in the URL.
The Daikin Security Gateway 214 is vulnerable to an IDOR flaw in its password reset API endpoint. An attacker can exploit this vulnerability by sending a crafted POST request, bypassing authentication mechanisms. Successful exploitation results in resetting the system credentials to the default Daikin:Daikin username and password combination, granting unauthorized access to the system and potentially compromising connected devices and networks.
KubeSphere 3.4.0 allows unauthorized users to access sensitive information, such as cluster and node details, users' information, without being registered to any workspace or cluster. This vulnerability exists in versions [>= 4.0.0 & < 4.1.3] and [>= 3.0.0 & < 3.4.1]. An attacker can exploit this flaw to gain unauthorized access to various endpoints like cluster overview, node details, and project information.
An Insecure Direct Object Reference (IDOR) vulnerability was found in UJCMS version 9.6.3, enabling unauthorized username enumeration through manipulation of the user id parameter in the /users/id endpoint. Despite user IDs being mostly large numbers, attackers can still discover existing account usernames without authentication, except for admin and anonymous accounts.
The Hitachi NAS (HNAS) System Management Unit (SMU) before version 14.8.7825.01 is vulnerable to an Insecure Direct Object Reference (IDOR) issue. An attacker can exploit this vulnerability to download arbitrary files from the server. This vulnerability has been assigned CVE-2023-5808.
The vulnerability in Moodle version 4.3 allows an authenticated user to access different user details, email addresses, country, city/town, city, and timezone by manipulating the 'id' parameter in URLs like profile.php?id=11. By changing the 'id' value to another number, the attacker can view information of other users on the platform.
The exploit allows an attacker to perform an Account Takeover by manipulating the 'id' parameter in the URL of the 'Users.php?f=save' endpoint in Lost and Found Information System v1.0. By changing the 'id' parameter, an attacker can access other user accounts without proper authorization. This vulnerability has been assigned CVE-2023-38965.
The Hitachi NAS (HNAS) System Management Unit (SMU) before version 14.8.7825.01 is vulnerable to an Insecure Direct Object Reference (IDOR) vulnerability. An attacker could exploit this vulnerability to access unauthorized backup and restore functionalities.
The vulnerability in Moodle version 4.3 allows an attacker to access user details, email addresses, country, city/town, city, and timezone by manipulating the 'id' parameter in URLs like profile.php and user.php. By changing the 'id' value to another number, the attacker can view sensitive information of other users.
Services By CQR