CWE-639

Netmaker makes networks with WireGuard. An Insecure Direct Object Reference (IDOR) vulnerability was found in versions p

A flaw in the TETRA authentication procecure allows a MITM adversary that can predict the MS challenge RAND2 to set sess

An Insecure Direct Object Reference (IDOR) vulnerability in the Community Edition version 9.0 of openSIS Classic allows

OpenZFS through 2.1.13 and 2.2.x through 2.2.1, in certain scenarios involving applications that try to rely on efficien

Archer Platform 6.x before 6.14 P1 HF2 (6.14.0.1.2) contains an insecure direct object reference vulnerability. An authe

EuroTel ETL3100 versions v01c01 and v01x37 are vulnerable to insecure direct object references that occur when the

Authorization Bypass Through User-Controlled Key vulnerability in WooCommerce Woo Subscriptions.This issue affects Woo S

Authorization Bypass Through User-Controlled Key vulnerability in Automattic WooPayments – Fully Integrated Solution Bui

Dino before 0.2.3, 0.3.x before 0.3.2, and 0.4.x before 0.4.2 allows attackers to modify the personal bookmark store via

The listed versions of Nexx Smart Home devices lack proper access control when executing actions. An attacker with a val

MeterSphere is an open source continuous testing platform, covering functions such as test tracking, interface testing,

An issue in AsyncSSH before 2.14.1 allows attackers to control the remote end of an SSH client session via packet inject

An issue was discovered in phpList before 3.6.14. Due to an access error, it was possible to manipulate and edit data of

An issue was discovered in WatchGuard EPDR 8.0.21.0002. It is possible to bypass the defensive capabilities by adding a

The RegistrationMagic plugin for WordPress is vulnerable to Insecure Direct Object References in versions up to, and inc

Instructure Canvas LMS didn't properly deny access to locked/unpublished files when the unprivileged user access the Doc

Play With Docker is a browser-based Docker playground. Versions 0.0.2 and prior are vulnerable to domain hijacking. Beca

Faveo 5.0.1 allows remote attackers to obtain sensitive information via a modified user ID in an Insecure Direct Object

WisdomGarden Tronclass has improper access control when uploading file. An authenticated remote attacker with general us

The listed versions of Nexx Smart Home devices lack proper access control when executing actions. An attacker with a val

Bhima version 1.27.0 allows an attacker authenticated with normal user permissions to view sensitive data of other appli

An issue was discovered in LIVEBOX Collaboration vDesk through v018. An Insecure Direct Object Reference can occur under

The Bluetooth module has a vulnerability of bypassing the user confirmation in the pairing process. Successful exploitat

The Ruby Help Desk WordPress plugin before 1.3.4 does not ensure that the ticket being modified belongs to the user maki

The Metform Elementor Contact Form Builder for WordPress is vulnerable to Information Disclosure via the 'mf_thankyou' s

The Metform Elementor Contact Form Builder for WordPress is vulnerable to Information Disclosure via the 'mf_transaction

The Metform Elementor Contact Form Builder for WordPress is vulnerable to Information Disclosure via the 'mf' shortcode

The Directorist plugin for WordPress is vulnerable to an Insecure Direct Object Reference in versions up to, and includi

Attackers can successfully request arbitrary snippet IDs, including E-Mail signatures of other users within the same con

An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.10 before 15.11.10, all versions st

A flaw was found in the Keylime registrar that could allow a bypass of the challenge-response protocol during agent regi

The BadgeOS plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 3.7

An Indirect Object Reference (IDOR) in Fl3xx Dispatch 2.10.37 and fl3xx Crew 2.10.37 allows a remote attacker to escalat

An Insecure Direct Object Reference (IDOR) vulnerability leads to events profiles access in Elenos ETG150 FM transmitter

An indirect object reference (IDOR) in GRANDING UTime Master v9.0.7-Build:Apr 4,2023 allows authenticated attackers to a

NCSIST ManageEngine Mobile Device Manager(MDM) APP's special function has a path traversal vulnerability. An unauthentic

Wiki comments required additional sanitizing and access restrictions to prevent a stored XSS risk and potential IDOR ris

Insecure Direct Object References (IDOR) in eMudhra emSigner v2.8.7 allow authenticated attackers to gain unauthorized a

SysAid before 23.2.15 allows Indirect Object Reference (IDOR) attacks to read ticket data via a modified sid parameter t

Mattermost fails to perform authorization checks in the /plugins/playbooks/api/v0/runs/add-to-timeline-dialog endpoint

Authorization Bypass Through User-Controlled Key vulnerability in WooCommerce Shipping Multiple Addresses.This issue aff

Authorization Bypass Through User-Controlled Key vulnerability in KaineLabs Youzify – BuddyPress Community, User Profile

Authorization Bypass Through User-Controlled Key in GitHub repository alextselegidis/easyappointments prior to 1.5.0.

Authorization Bypass Through User-Controlled Key vulnerability in Automattic WooPayments – Fully Integrated Solution Bui

A logic issue was addressed with improved checks. This issue is fixed in watchOS 9.5, macOS Ventura 13.4, macOS Big Sur

This issue was addressed with improved data protection. This issue is fixed in macOS Ventura 13. An app may be able to m

Authorization Bypass Through User-Controlled Key in GitHub repository nilsteampassnet/teampass prior to 3.0.0.23.

Insecure permissions in the updateUserInfo function of newbee-mall before commit 1f2c2dfy allows attackers to obtain use

Authorization bypass vulnerability in BuddyBoss 2.2.9 version, the exploitation of which could allow an authenticated us

Headwind MDM Web panel 5.22.1 is vulnerable to Incorrect Access Control. The Web panel allows users to gain access to po