Vulnerabilities > Yellowfinbi > Yellowfin > High

DATE CVE VULNERABILITY TITLE RISK
2021-10-14 CVE-2021-36388 Authorization Bypass Through User-Controlled Key vulnerability in Yellowfinbi Yellowfin
In Yellowfin before 9.6.1 it is possible to enumerate and download users profile pictures through an Insecure Direct Object Reference vulnerability exploitable by sending a specially crafted HTTP GET request to the page "MIIAvatarImage.i4".
network
low complexity
yellowfinbi CWE-639
7.5
7.5
2021-10-14 CVE-2021-36389 Authorization Bypass Through User-Controlled Key vulnerability in Yellowfinbi Yellowfin
In Yellowfin before 9.6.1 it is possible to enumerate and download uploaded images through an Insecure Direct Object Reference vulnerability exploitable by sending a specially crafted HTTP GET request to the page "MIImage.i4".
network
low complexity
yellowfinbi CWE-639
7.5
7.5