Vulnerabilities > Authorization Bypass Through User-Controlled Key
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2021-12-01 | CVE-2021-3992 | Authorization Bypass Through User-Controlled Key vulnerability in Kimai2 Project Kimai2 kimai2 is vulnerable to Improper Access Control | 6.5 |
| 2021-11-23 | CVE-2021-24892 | Authorization Bypass Through User-Controlled Key vulnerability in Advanced Forms Project Advanced Forms Insecure Direct Object Reference in edit function of Advanced Forms (Free & Pro) before 1.6.9 allows authenticated remote attacker to change arbitrary user's email address and request for reset password, which could lead to take over of WordPress's administrator account. | 8.8 |
| 2021-11-19 | CVE-2021-22951 | Authorization Bypass Through User-Controlled Key vulnerability in Concretecms Concrete CMS Unauthorized individuals could view password protected files using view_inline in Concrete CMS (previously concrete 5) prior to version 8.5.7. | 7.5 |
| 2021-11-19 | CVE-2021-22967 | Authorization Bypass Through User-Controlled Key vulnerability in Concretecms Concrete CMS In Concrete CMS (formerly concrete 5) below 8.5.7, IDOR Allows Unauthenticated User to Access Restricted Files If Allowed to Add Message to a Conversation.To remediate this, a check was added to verify a user has permissions to view files before attaching the files to a message in "add / edit message”.Concrete CMS security team gave this a CVSS v3.1 score of 4.3 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:NCredit for discovery Adrian H | 7.5 |
| 2021-11-10 | CVE-2021-3380 | Authorization Bypass Through User-Controlled Key vulnerability in Height8Tech H8 Ssrms Insecure direct object reference (IDOR) vulnerability in ICREM H8 SSRMS allows attackers to disclose sensitive information via the Print Invoice Functionality. | 6.5 |
| 2021-11-08 | CVE-2021-24840 | Authorization Bypass Through User-Controlled Key vulnerability in Codesupply Squaretype The Squaretype WordPress theme before 3.0.4 allows unauthenticated users to manipulate the query_vars used to retrieve the posts to display in one of its REST endpoint, without any validation. | 5.3 |
| 2021-10-26 | CVE-2021-41305 | Authorization Bypass Through User-Controlled Key vulnerability in Atlassian Jira Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to view the names of private projects and filters via an Insecure Direct Object References (IDOR) vulnerability in the Average Number of Times in Status Gadget. | 7.5 |
| 2021-10-26 | CVE-2021-41306 | Authorization Bypass Through User-Controlled Key vulnerability in Atlassian Jira Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to view private project and filter names via an Insecure Direct Object References (IDOR) vulnerability in the Average Time in Status Gadget. | 7.5 |
| 2021-10-26 | CVE-2021-41307 | Authorization Bypass Through User-Controlled Key vulnerability in Atlassian Jira Affected versions of Atlassian Jira Server and Data Center allow unauthenticated remote attackers to view the names of private projects and private filters via an Insecure Direct Object References (IDOR) vulnerability in the Workload Pie Chart Gadget. | 7.5 |
| 2021-10-14 | CVE-2021-36388 | Authorization Bypass Through User-Controlled Key vulnerability in Yellowfinbi Yellowfin In Yellowfin before 9.6.1 it is possible to enumerate and download users profile pictures through an Insecure Direct Object Reference vulnerability exploitable by sending a specially crafted HTTP GET request to the page "MIIAvatarImage.i4". | 7.5 |