Vulnerabilities > Authorization Bypass Through User-Controlled Key
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2024-05-14 | CVE-2023-40720 | Authorization Bypass Through User-Controlled Key vulnerability in Fortinet Fortivoice An authorization bypass through user-controlled key vulnerability [CWE-639] in FortiVoiceEntreprise version 7.0.0 through 7.0.1 and before 6.4.8 allows an authenticated attacker to read the SIP configuration of other users via crafted HTTP or HTTPS requests. | 7.1 |
| 2024-04-05 | CVE-2023-6523 | Authorization Bypass Through User-Controlled Key vulnerability in ExtremePacs Extreme XDS allows Authentication Abuse.This issue affects Extreme XDS: before 3914. | 8.8 |
| 2024-03-12 | CVE-2024-23112 | Authorization Bypass Through User-Controlled Key vulnerability in Fortinet Fortios and Fortiproxy An authorization bypass through user-controlled key vulnerability [CWE-639] in FortiOS version 7.4.0 through 7.4.1, 7.2.0 through 7.2.6, 7.0.1 through 7.0.13, 6.4.7 through 6.4.14, and FortiProxy version 7.4.0 through 7.4.2, 7.2.0 through 7.2.8, 7.0.0 through 7.0.14 SSL-VPN may allow an authenticated attacker to gain access to another user’s bookmark via URL manipulation. | 4.3 |
| 2024-02-14 | CVE-2024-22455 | Authorization Bypass Through User-Controlled Key vulnerability in Dell E-Lab Navigator 3.1.9/3.2.0 Dell Mobility - E-Lab Navigator, version(s) 3.1.9, 3.2.0, contain(s) an Authorization Bypass Through User-Controlled Key vulnerability. | 4.6 |
| 2024-02-13 | CVE-2023-49339 | Authorization Bypass Through User-Controlled Key vulnerability in Ellucian Banner Ellucian Banner 9.17 allows Insecure Direct Object Reference (IDOR) via a modified bannerId to the /StudentSelfService/ssb/studentCard/retrieveData endpoint. | 6.5 |
| 2024-02-12 | CVE-2024-0421 | Authorization Bypass Through User-Controlled Key vulnerability in Mappresspro Mappress Maps for Wordpress The MapPress Maps for WordPress plugin before 2.88.16 is affected by an IDOR as it does not ensure that posts to be retrieve via an AJAX action is a public map, allowing unauthenticated users to read arbitrary private and draft posts. | 5.3 |
| 2024-02-09 | CVE-2023-6724 | Authorization Bypass Through User-Controlled Key vulnerability in Simgesel Hearing Tracking System 1.0 Authorization Bypass Through User-Controlled Key vulnerability in Software Engineering Consultancy Machine Equipment Limited Company Hearing Tracking System allows Authentication Abuse.This issue affects Hearing Tracking System: before for IOS 7.0, for Android Latest release 1.0. | 8.8 |
| 2024-02-08 | CVE-2023-6515 | Authorization Bypass Through User-Controlled Key vulnerability in Miateknoloji Mia-Med 1.0.0.58 Authorization Bypass Through User-Controlled Key vulnerability in Mia Technology Inc. | 8.8 |
| 2024-02-05 | CVE-2024-0366 | Authorization Bypass Through User-Controlled Key vulnerability in Squirrly Starbox The Starbox – the Author Box for Humans plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.4.7 via the action function due to missing validation on a user controlled key. | 4.3 |
| 2024-02-05 | CVE-2023-6983 | Authorization Bypass Through User-Controlled Key vulnerability in Josevega Display Custom Fields in the Frontend - Post and User Profile Fields The Display custom fields in the frontend – Post and User Profile Fields plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.2.1 via the vg_display_data shortcode due to missing validation on a user controlled key. | 4.3 |