CVE-2023-23706 WordPress WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) Plugin <= 7.5.14 is vulnerable to Cross Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in miniOrange WordPress Social Login and Register Discord, Google, Twitter, LinkedIn plugin = 7.5.14 versions...

GHSA-9M92-QWPC-QM78 Jenkins SAML Single Sign On(SSO) Plugin unconditionally disables SSL/TLS certificate validation

Jenkins SAML Single Sign OnSSO Plugin 2.1.0 and earlier unconditionally disables SSL/TLS certificate validation for connections to miniOrange or the configured IdP to retrieve SAML metadata. This lack of validation could be abused using a man-in-the-middle attack to intercept these connections...

GHSA-GHPM-MGF5-CV8Q Jenkins SAML Single Sign On(SSO) Plugin Cross-Site Request Forgery vulnerability

Jenkins SAML Single Sign OnSSO Plugin 2.0.0 and earlier does not perform a permission check in an HTTP endpoint. This allows attackers with Overall/Read permission to send an HTTP POST request with JSON body containing attacker-specified content, to miniOrange’s API for sending emails...

Jenkins SAML Single Sign On(SSO) Plugin Cross-Site Request Forgery vulnerability

Jenkins SAML Single Sign OnSSO Plugin 2.0.0 and earlier does not perform a permission check in an HTTP endpoint. This allows attackers with Overall/Read permission to send an HTTP POST request with JSON body containing attacker-specified content, to miniOrange’s API for sending emails...

Jenkins SAML Single Sign On(SSO) Plugin unconditionally disables SSL/TLS certificate validation

Jenkins SAML Single Sign OnSSO Plugin 2.1.0 and earlier unconditionally disables SSL/TLS certificate validation for connections to miniOrange or the configured IdP to retrieve SAML metadata. This lack of validation could be abused using a man-in-the-middle attack to intercept these connections...

CVE-2023-32996

A missing permission check in Jenkins SAML Single Sign OnSSO Plugin 2.0.0 and earlier allows attackers with Overall/Read permission to send an HTTP POST request with JSON body containing attacker-specified content, to miniOrange's API for sending emails...

CVE-2023-32996

A missing permission check in Jenkins SAML Single Sign OnSSO Plugin 2.0.0 and earlier allows attackers with Overall/Read permission to send an HTTP POST request with JSON body containing attacker-specified content, to miniOrange's API for sending emails...

CVE-2023-32993

Jenkins SAML Single Sign OnSSO Plugin 2.0.2 and earlier does not perform hostname validation when connecting to miniOrange or the configured IdP to retrieve SAML metadata, which could be abused using a man-in-the-middle attack to intercept these connections...

CVE-2023-32995

A cross-site request forgery CSRF vulnerability in Jenkins SAML Single Sign OnSSO Plugin 2.0.0 and earlier allows attackers to send an HTTP POST request with JSON body containing attacker-specified content, to miniOrange's API for sending emails...

CVE-2023-32994

Jenkins SAML Single Sign OnSSO Plugin 2.1.0 and earlier unconditionally disables SSL/TLS certificate validation for connections to miniOrange or the configured IdP to retrieve SAML metadata, which could be abused using a man-in-the-middle attack to intercept these connections...

CVE-2023-32995

A cross-site request forgery CSRF vulnerability in Jenkins SAML Single Sign OnSSO Plugin 2.0.0 and earlier allows attackers to send an HTTP POST request with JSON body containing attacker-specified content, to miniOrange's API for sending emails...

CVE-2023-32993

Jenkins SAML Single Sign OnSSO Plugin 2.0.2 and earlier does not perform hostname validation when connecting to miniOrange or the configured IdP to retrieve SAML metadata, which could be abused using a man-in-the-middle attack to intercept these connections...

Cross site request forgery (csrf)

A cross-site request forgery CSRF vulnerability in Jenkins SAML Single Sign OnSSO Plugin 2.0.0 and earlier allows attackers to send an HTTP POST request with JSON body containing attacker-specified content, to miniOrange's API for sending emails...

Design/Logic Flaw

A missing permission check in Jenkins SAML Single Sign OnSSO Plugin 2.0.0 and earlier allows attackers with Overall/Read permission to send an HTTP POST request with JSON body containing attacker-specified content, to miniOrange's API for sending emails...

Code injection

Jenkins SAML Single Sign OnSSO Plugin 2.1.0 and earlier unconditionally disables SSL/TLS certificate validation for connections to miniOrange or the configured IdP to retrieve SAML metadata, which could be abused using a man-in-the-middle attack to intercept these connections...

CVE-2023-32996

Jenkins SAML SSO Plugin (versions ≤ 2.0.0) has a missing permission check on an HTTP endpoint, enabling attackers with Overall/Read to send attacker-specified JSON to miniOrange’s API for sending emails and triggering a CSRF-like risk. The issue is formally associated with CVE-2023-32996. Mitigat...

CVE-2023-32996

A missing permission check in Jenkins SAML Single Sign OnSSO Plugin 2.0.0 and earlier allows attackers with Overall/Read permission to send an HTTP POST request with JSON body containing attacker-specified content, to miniOrange's API for sending emails...

CVE-2023-32994

Jenkins SAML Single Sign OnSSO Plugin 2.1.0 and earlier unconditionally disables SSL/TLS certificate validation for connections to miniOrange or the configured IdP to retrieve SAML metadata, which could be abused using a man-in-the-middle attack to intercept these connections...

CVE-2023-32994

Summary of CVE-2023-32994 : The Jenkins SAML Single Sign On (SSO) Plugin (versions ≤ 2.1.0) unconditionally disables SSL/TLS certificate validation when connecting to miniOrange or the configured IdP to fetch SAML metadata. This vulnerability enables potential man-in-the-middle attacks on those m...

CVE-2023-32995

CVE-2023-32995 is a CSRF vulnerability in Jenkins SAML Single Sign On(SSO) Plugin versions 2.0.0 and earlier. The flaw allows an attacker with Overall/Read permission to trigger an HTTP POST with a JSON body to miniOrange’s API for sending emails due to a missing/unchecked permission check on an ...