HackerOne Disclosed Reports - 2025-02-19

Medium
resolved

Insecure Direct Object Reference (IDOR) Vulnerability in Autodesk User Profile

Bug reported by Eyad was disclosed at February 19, 2025, 1:27 pm   |   Insecure Direct Object Reference (IDOR)

Insecure Direct Object Reference (IDOR) vulnerability was discovered in the Autodesk User Profile, where the "id" parameter could be used to edit another user's profile.

Critical
resolved

Cisco IOS XE instance at 41.208.24.174 vulnerable to CVE-2023-20198

Bug reported by ꦄꦤ꧀ꦢꦿꦶ was disclosed at February 19, 2025, 6:23 am   |   Command Injection - Generic

The Cisco IOS XE instance at 41.208.24.174 was found vulnerable to CVE-2023-20198. This vulnerability allowed bypassing authentication to reach the webui_wsma_http web endpoint, enabling the execution of arbitrary Cisco IOS commands or making configuration changes with Privilege 15 privileges. The exploitation also involved leveraging CVE-2023-20273 to escalate to the underlying Linux OS root user.