Insecure Direct Object Reference

Every one of the 50 is a mark on the map. Named now: 1 to 26, most at risk first.

1. An issue was discovered in GitLab Community and Enterprise Edition 10.x (starting from 10.8) and 11.x before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. It has Incorr…CVE-2019-9756Gitlab · 2.2% likely

   CWE-639

2. An issue was discovered in GitLab Community and Enterprise Edition 12.0 through 12.2.1. An IDOR in the epic notes API that could result in disclosure of private milestones, labels…CVE-2019-15725Gitlab · 1.8% likely

   CWE-639

3. GitLab EE, versions 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, is vulnerable to an insecure direct object reference vulnerability that allows authenticated,…CVE-2018-19584Gitlab · 1.5% likely

   CWE-639

4. An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. It has Incorrect Access Control.CVE-2019-9170Gitlab · 1.5% likely

   CWE-639

5. Gitlab Enterprise Edition version 10.3 is vulnerable to an authorization bypass issue in the GitLab Projects::BoardsController component resulting in an information disclosure on…CVE-2017-0922GitLab · 1.3% likely

   CWE-639

6. Due to an insecure direct object reference vulnerability in Gitlab EE/CE affecting all versions from 11.0 prior to 14.8.6, 14.9 prior to 14.9.4, and 14.10 prior to 14.10.1, an end…CVE-2022-1352GitLab · CVSS 5.3 · 1.3% likely

   CWE-639

7. An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. It has Incorrect Access Control (issue 2 of 5).CVE-2019-9219Gitlab · 1.3% likely

   CWE-639

8. GitLab CE/EE, versions 10.1 up to 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, are vulnerable to an insecure direct object reference issue that allows a user t…CVE-2018-19575Gitlab · 1.1% likely

   CWE-639

9. Multiple versions of GitLab expose sensitive user credentials when assigning a user to an issue or merge request. A fix was included in versions 8.15.8, 8.16.7, and 8.17.4, which…CVE-2017-0882Gitlab · 1.1% likely

   CWE-639

10. Improper access control allows any project member to retrieve the service desk email address in GitLab CE/EE versions starting 12.10 before 14.3.6, all versions starting from 14.4…CVE-2021-39934GitLab · CVSS 4.3 · 1.0% likely

    CWE-639

11. An IDOR was discovered in GitLab CE/EE 11.5 and later that allowed new merge requests endpoint to disclose label names.CVE-2019-5466Gitlab · 1.0% likely

    CWE-639

12. An Incorrect Access Control (issue 1 of 2) was discovered in GitLab Community and Enterprise Edition before 11.7.8, 11.8.x before 11.8.4, and 11.9.x before 11.9.2. It allowed non-…CVE-2019-10108Gitlab · 1.0% likely

    CWE-639

13. An IDOR exists in < 12.3.2, < 12.2.6, and < 12.1.12 for GitLab Community Edition (CE) and Enterprise Edition (EE) that allowed a project owner or maintainer to see the members of…CVE-2019-15581GitLab · 1.0% likely

    CWE-639

14. An issue has been discovered in GitLab EE affecting all versions starting from 13.10 before 15.0.5, all versions starting from 15.1 before 15.1.4, all versions starting from 15.2…CVE-2022-2499GitLab · CVSS 3.5 · 0.9% likely

    CWE-639

15. GitLab Community and Enterprise Editions before 10.1.6, 10.2.6, and 10.3.4 are vulnerable to an authorization bypass issue in the Projects::MergeRequests::CreationsController comp…CVE-2017-0920GitLab · 0.9% likely

    CWE-639

16. An IDOR was discovered in < 12.3.2, < 12.2.6, and < 12.1.12 for GitLab Community Edition (CE) and Enterprise Edition (EE) that allowed a maintainer to add any private group to a p…CVE-2019-15582GitLab · 0.9% likely

    CWE-639

17. An issue was discovered in GitLab Community and Enterprise Edition before 11.1.7, 11.2.x before 11.2.4, and 11.3.x before 11.3.1. Remote attackers could obtain sensitive informati…CVE-2018-17449Gitlab · CVSS 7.5 · 0.8% likely

    CWE-639

18. Lack of an access control check in the External Status Check feature allowed any authenticated user to retrieve the configuration of any External Status Check in GitLab EE startin…CVE-2021-39916GitLab · CVSS 4.3 · 0.8% likely

    CWE-639

19. In all versions of GitLab EE since version 14.1, due to an insecure direct object reference vulnerability, an endpoint may reveal the protected branch name to a malicious user who…CVE-2021-39889GitLab · CVSS 4.3 · 0.8% likely

    CWE-639

20. GitLab EE, versions 11.4 before 11.4.8 and 11.5 before 11.5.1, is affected by an insecure direct object reference vulnerability that permits an unauthorized user to publish the dr…CVE-2018-19582Gitlab · 0.8% likely

    CWE-639

21. An issue has been discovered in GitLab EE affecting all versions starting from 14.5 before 15.1.6, all versions starting from 15.2 before 15.2.4, all versions starting from 15.3 b…CVE-2022-3331GitLab · CVSS 3.5 · 0.8% likely

    CWE-639

22. An access control vulnerability in GitLab EE/CE affecting all versions from 14.8 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1.1, allows authenticated users to en…CVE-2022-2243GitLab · CVSS 5 · 0.8% likely

    CWE-639

23. An IDOR vulnerability exists in GitLab <v12.1.2, <v12.0.4, and <v11.11.6 that allowed uploading files from project archive to replace other users files potentially allowing an att…CVE-2019-5469Gitlab · 0.8% likely

    CWE-6391 bounty report

24. An issue was discovered in Gitlab CE/EE versions >= 13.1 to <13.4.7, >= 13.5 to <13.5.5, and >= 13.6 to <13.6.2 allowed an unauthorized user to access the user list corresponding…CVE-2020-13357GitLab · CVSS 4.3 · 0.8% likely

    CWE-639

25. Authorization Bypass Through User-Controlled Key in GitLabCVE-2023-2190GitLab · CVSS 6.5 · 0.7% likely

    CWE-639

26. An issue has been discovered in GitLab affecting all versions starting from 15.9 before 15.9.4, all versions starting from 15.10 before 15.10.1. It was possible for an unauthorise…CVE-2023-1417GitLab · CVSS 4.3 · 0.7% likely

    CWE-639

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.