Vulmon
Recent Vulnerabilities
Research Posts
Trends
Blog
About
Contact
Vulmon Alerts
By Relevance
By Risk Score
By Publish Date
insecure direct object reference vulnerabilities and exploits
(subscribe to this query)
4.3
CVSSv3
CVE-2015-8399
Atlassian Confluence prior to 5.8.17 allows remote authenticated users to read configuration files via the decoratorName parameter to (1) spaces/viewdefaultdecorator.action or (2) admin/viewdefaultdecorator.action.
Atlassian Confluence
1 EDB exploit
7.5
CVSSv3
CVE-2017-14680
ZKTeco ZKTime Web 2.0.1.12280 allows remote malicious users to obtain sensitive employee metadata via a direct request for a PDF document.
Zkteco Zktime Web 2.0.1.12280
1 EDB exploit
7.5
CVSSv3
CVE-2022-47076
An issue exists in Smart Office Web 20.28 and previous versions allows malicious users to view sensitive information via DisplayParallelLogData.aspx.
Smartofficepayroll Smartoffice
1 EDB exploit
7.5
CVSSv3
CVE-2022-47075
An issue exists in Smart Office Web 20.28 and previous versions allows malicious users to download sensitive information via the action name parameter to ExportEmployeeDetails.aspx, and to ExportReportingManager.aspx.
Smartofficepayroll Smartoffice
1 EDB exploit
8.8
CVSSv3
CVE-2014-8356
The web administrative portal in Zhone zNID 2426A before S3.0.501 allows remote authenticated users to bypass intended access restrictions via a modified server response, related to an insecure direct object reference.
Dasanzhone Znid 2426a Firmware
1 EDB exploit
8.8
CVSSv3
CVE-2014-8357
backupsettings.html in the web administrative portal in Zhone zNID GPON 2426A before S3.0.501 places a session key in a URL, which allows remote malicious users to obtain arbitrary user passwords via the sessionKey parameter in a getConfig action to backupsettings.conf.
Dasanzhone Znid 2426a Firmware
1 EDB exploit
8.8
CVSSv3
CVE-2014-9118
The web administrative portal in Zhone zNID GPON 2426A before S3.0.501 allows remote malicious users to execute arbitrary commands via shell metacharacters in the ipAddr parameter to zhnping.cmd.
Dasanzhone Znid 2426a Firmware -
1 EDB exploit
5.4
CVSSv3
CVE-2022-36966
Users with Node Management rights were able to view and edit all nodes due to Insufficient control on URL parameter causing insecure direct object reference (IDOR) vulnerability in SolarWinds Platform 2022.3 and previous.
Solarwinds Orion Platform 2020.2.6
Solarwinds Orion Platform
Solarwinds Orion Platform 2022.2
Solarwinds Orion Platform 2022.3
4.3
CVSSv3
CVE-2022-30852
Known v1.3.1 exists to contain an Insecure Direct Object Reference (IDOR).
Withknown Known
9.8
CVSSv3
CVE-2016-10734
ProjectSend (formerly cFTP) r582 allows Insecure Direct Object Reference via includes/actions.log.export.php.
Projectsend Projectsend 582
1 Github repository
CVSSv3
CVSSv2
CVSSv3
VMScore
Recommendations:
SSTI
CVE-2024-35863
CVE-2024-35910
man-in-the-middle
CVE-2024-35912
CVE-2024-25742
LFI
CVE-2024-32002
CVE-2024-22120
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started
« PREV
1
2
3
4
5
6
7
8
9
NEXT »