Vulnerabilities > Authorization Bypass Through User-Controlled Key
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2021-10-26 | CVE-2021-41305 | Authorization Bypass Through User-Controlled Key vulnerability in Atlassian Jira Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to view the names of private projects and filters via an Insecure Direct Object References (IDOR) vulnerability in the Average Number of Times in Status Gadget. | 7.5 |
| 2021-10-26 | CVE-2021-41306 | Authorization Bypass Through User-Controlled Key vulnerability in Atlassian Jira Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to view private project and filter names via an Insecure Direct Object References (IDOR) vulnerability in the Average Time in Status Gadget. | 7.5 |
| 2021-10-26 | CVE-2021-41307 | Authorization Bypass Through User-Controlled Key vulnerability in Atlassian Jira Affected versions of Atlassian Jira Server and Data Center allow unauthenticated remote attackers to view the names of private projects and private filters via an Insecure Direct Object References (IDOR) vulnerability in the Workload Pie Chart Gadget. | 7.5 |
| 2021-10-14 | CVE-2021-36388 | Authorization Bypass Through User-Controlled Key vulnerability in Yellowfinbi Yellowfin In Yellowfin before 9.6.1 it is possible to enumerate and download users profile pictures through an Insecure Direct Object Reference vulnerability exploitable by sending a specially crafted HTTP GET request to the page "MIIAvatarImage.i4". | 7.5 |
| 2021-10-14 | CVE-2021-36389 | Authorization Bypass Through User-Controlled Key vulnerability in Yellowfinbi Yellowfin In Yellowfin before 9.6.1 it is possible to enumerate and download uploaded images through an Insecure Direct Object Reference vulnerability exploitable by sending a specially crafted HTTP GET request to the page "MIImage.i4". | 7.5 |
| 2021-10-05 | CVE-2021-39889 | Authorization Bypass Through User-Controlled Key vulnerability in Gitlab In all versions of GitLab EE since version 14.1, due to an insecure direct object reference vulnerability, an endpoint may reveal the protected branch name to a malicious user who makes a crafted API call with the ID of the protected branch. | 4.3 |
| 2021-10-04 | CVE-2021-37331 | Authorization Bypass Through User-Controlled Key vulnerability in Bookingcore Booking Core 2.0 Laravel Booking System Booking Core 2.0 is vulnerable to Incorrect Access Control. | 5.3 |
| 2021-10-04 | CVE-2021-37777 | Authorization Bypass Through User-Controlled Key vulnerability in Gilacms Gila CMS 2.2.0 Gila CMS 2.2.0 is vulnerable to Insecure Direct Object Reference (IDOR). | 7.5 |
| 2021-10-01 | CVE-2021-41847 | Authorization Bypass Through User-Controlled Key vulnerability in 3Xlogic Infinias Access Control 6.7.10708.0 An issue was discovered in 3xLogic Infinias Access Control through 6.7.10708.0, affecting physical security. | 8.8 |
| 2021-09-27 | CVE-2021-36874 | Authorization Bypass Through User-Controlled Key vulnerability in Stylemixthemes Ulisting Authenticated Insecure Direct Object References (IDOR) vulnerability in WordPress uListing plugin (versions <= 2.0.5). | 8.8 |