Vulnerabilities > Authorization Bypass Through User-Controlled Key

DATE CVE VULNERABILITY TITLE RISK
2021-11-19 CVE-2021-22951 Authorization Bypass Through User-Controlled Key vulnerability in Concretecms Concrete CMS
Unauthorized individuals could view password protected files using view_inline in Concrete CMS (previously concrete 5) prior to version 8.5.7.
network
low complexity
concretecms CWE-639
5.0
2021-11-19 CVE-2021-22967 Authorization Bypass Through User-Controlled Key vulnerability in Concretecms Concrete CMS
In Concrete CMS (formerly concrete 5) below 8.5.7, IDOR Allows Unauthenticated User to Access Restricted Files If Allowed to Add Message to a Conversation.To remediate this, a check was added to verify a user has permissions to view files before attaching the files to a message in "add / edit message”.Concrete CMS security team gave this a CVSS v3.1 score of 4.3 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:NCredit for discovery Adrian H
network
low complexity
concretecms CWE-639
5.0
2021-11-10 CVE-2021-3380 Authorization Bypass Through User-Controlled Key vulnerability in Height8Tech H8 Ssrms
Insecure direct object reference (IDOR) vulnerability in ICREM H8 SSRMS allows attackers to disclose sensitive information via the Print Invoice Functionality.
network
low complexity
height8tech CWE-639
4.0
2021-11-08 CVE-2021-24840 Authorization Bypass Through User-Controlled Key vulnerability in Codesupply Squaretype
The Squaretype WordPress theme before 3.0.4 allows unauthenticated users to manipulate the query_vars used to retrieve the posts to display in one of its REST endpoint, without any validation.
network
low complexity
codesupply CWE-639
5.0
2021-10-26 CVE-2021-41305 Authorization Bypass Through User-Controlled Key vulnerability in Atlassian Jira
Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to view the names of private projects and filters via an Insecure Direct Object References (IDOR) vulnerability in the Average Number of Times in Status Gadget.
network
low complexity
atlassian CWE-639
5.0
2021-10-26 CVE-2021-41306 Authorization Bypass Through User-Controlled Key vulnerability in Atlassian Jira
Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to view private project and filter names via an Insecure Direct Object References (IDOR) vulnerability in the Average Time in Status Gadget.
network
low complexity
atlassian CWE-639
5.0
2021-10-26 CVE-2021-41307 Authorization Bypass Through User-Controlled Key vulnerability in Atlassian Jira
Affected versions of Atlassian Jira Server and Data Center allow unauthenticated remote attackers to view the names of private projects and private filters via an Insecure Direct Object References (IDOR) vulnerability in the Workload Pie Chart Gadget.
network
low complexity
atlassian CWE-639
5.0
2021-10-14 CVE-2021-36388 Authorization Bypass Through User-Controlled Key vulnerability in Yellowfinbi Yellowfin
In Yellowfin before 9.6.1 it is possible to enumerate and download users profile pictures through an Insecure Direct Object Reference vulnerability exploitable by sending a specially crafted HTTP GET request to the page "MIIAvatarImage.i4".
network
low complexity
yellowfinbi CWE-639
5.0
2021-10-14 CVE-2021-36389 Authorization Bypass Through User-Controlled Key vulnerability in Yellowfinbi Yellowfin
In Yellowfin before 9.6.1 it is possible to enumerate and download uploaded images through an Insecure Direct Object Reference vulnerability exploitable by sending a specially crafted HTTP GET request to the page "MIImage.i4".
network
low complexity
yellowfinbi CWE-639
5.0
2021-10-14 CVE-2021-20599 Authorization Bypass Through User-Controlled Key vulnerability in Mitsubishielectric products
Cleartext transmission of sensitive information vulnerability in MELSEC iQ-R series Safety CPU R08/16/32/120SFCPU firmware versions "26" and prior and MELSEC iQ-R series SIL2 Process CPU R08/16/32/120PSFCPU all versions allows a remote unauthenticated attacker to login to a target CPU module by obtaining credentials other than password.
network
low complexity
mitsubishielectric CWE-639
7.5