miniOrange

52 results · Feed

• High 8.1
  CVE-2022-44589

  WordPress miniOrange's Google Authenticator Plugin <= 5.6.1 is vulnerable to Sensitive Data Exposure

  Exposure of Sensitive Information to an Unauthorized Actor vulnerability in miniOrange miniOrange's Google Authenticator – WordPress Two Factor Authentication – 2FA , Two Factor, OTP SMS and Email | Passwordless login.This issue affects miniOrange's Google Au…

  miniOrange miniOrange's Google Authenticator – WordPress Two Factor Authentication – 2FA , Two Factor, OTP SMS and Email | Passwordless login Web / CMS
  Dec 29, 2023
• Medium 5.9
  CVE-2023-37986

  WordPress YourMembership Single Sign On Plugin <= 1.1.3 is vulnerable to Cross Site Scripting (XSS)

  Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in miniOrange YourMembership Single Sign On – YM SSO Login plugin <= 1.1.3 versions.

  miniOrange YourMembership Single Sign On – YM SSO Login
  Sep 1, 2023
• High 8.8
  CVE-2022-34155 Public exploit

  WordPress OAuth Single Sign On – SSO (OAuth Client) Plugin <= 6.23.3 is vulnerable to Broken Authentication

  Improper Authentication vulnerability in miniOrange OAuth Single Sign On – SSO (OAuth Client) plugin allows Authentication Bypass.This issue affects OAuth Single Sign On – SSO (OAuth Client): from n/a through 6.23.3.

  miniOrange OAuth Single Sign On – SSO (OAuth Client)
  Jul 18, 2023
• Medium 4.3
  CVE-2023-23706

  WordPress WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) Plugin <= 7.5.14 is vulnerable to Cross Site Request Forgery (CSRF)

  Cross-Site Request Forgery (CSRF) vulnerability in miniOrange WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) plugin <= 7.5.14 versions.

  miniOrange WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) Web / CMS
  May 23, 2023
• Medium 5.9
  CVE-2023-23710

  WordPress WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) plugin <= 7.5.14 is vulnerable to Cross Site Scripting (XSS)

  Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in miniOrange WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) plugin <= 7.5.14 versions.

  miniOrange WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) Web / CMS
  Apr 25, 2023
• Medium 6.5
  CVE-2023-1092

  OAuth Single Sign On - SSO (OAuth Client) - IdP Deletion via CSRF

  The OAuth Single Sign On Free WordPress plugin before 6.24.2, OAuth Single Sign On Standard WordPress plugin before 28.4.9, OAuth Single Sign On Premium WordPress plugin before 38.4.9 and OAuth Single Sign On Enterprise WordPress plugin before 48.4.9 do not h…

  miniOrange OAuth Single Sign On Free OAuth Single Sign On Premium OAuth Single Sign On Standard Web / CMS
  Mar 27, 2023
• Medium 6.1
  CVE-2022-4496

  miniOrange WordPress SAML SSO multiple versions - Open Redirect in SSO login

  The SAML SSO Standard WordPress plugin version 16.0.0 before 16.0.8, SAML SSO Premium WordPress plugin version 12.0.0 before 12.1.0 and SAML SSO Premium Multisite WordPress plugin version 20.0.0 before 20.0.7 does not validate that the redirect parameter to i…

  miniOrange miniOrange WordPress SAML SSO Standard miniOrange WordPress SAML SSO Premium MulsiteSite miniOrange WordPress SAML SSO Premium Web / CMS
  Jan 30, 2023
• High 7.5
  CVE-2023-23749

  Extension - miniorange - LDAP Integration - LDAP Injection (username)

  The 'LDAP Integration with Active Directory and OpenLDAP - NTLM & Kerberos Login' extension is vulnerable to LDAP Injection since is not properly sanitizing the 'username' POST parameter. An attacker can manipulate this paramter to dump arbitrary contents for…

  miniOrange LDAP Integration with Active Directory and OpenLDAP - NTLM & Kerberos Login
  Jan 17, 2023
• Medium 5.4
  CVE-2022-45073

  WordPress REST API Authentication plugin <= 2.4.0 - Cross-Site Request Forgery (CSRF) vulnerability

  Cross-Site Request Forgery (CSRF) vulnerability in REST API Authentication plugin <= 2.4.0 on WordPress.

  miniOrange WordPress REST API Authentication (WordPress plugin) Web / CMS
  Nov 18, 2022
• Medium 5.4
  CVE-2022-42461

  WordPress miniOrange's Google Authenticator plugin <= 5.6.1 - Broken Access Control vulnerability

  Broken Access Control vulnerability in miniOrange's Google Authenticator plugin <= 5.6.1 on WordPress.

  miniOrange miniOrange's Google Authenticator (WordPress plugin) Web / CMS
  Nov 18, 2022
• Critical 9.8
  CVE-2022-34149

  WordPress WP OAuth Server plugin <= 3.0.4 - Authentication Bypass vulnerability

  Authentication Bypass vulnerability in miniOrange WP OAuth Server plugin <= 3.0.4 at WordPress.

  miniOrange WP OAuth Server (WordPress plugin) Web / CMS
  Aug 22, 2022
• Critical 9.8
  CVE-2022-34858

  WordPress OAuth 2.0 client for SSO plugin <= 1.11.3 - Authentication Bypass vulnerability

  Authentication Bypass vulnerability in miniOrange OAuth 2.0 client for SSO plugin <= 1.11.3 at WordPress.

  miniOrange OAuth 2.0 client for SSO (WordPress plugin) Web / CMS
  Aug 22, 2022