PT-2023-19150 · Miniorange · Miniorange Wordpress Social Login/Register

Name of the Vulnerable Software and Affected Versions: miniOrange WordPress Social Login and Register plugin versions prior to 7.5.14 Description: The issue is related to an Authenticated Stored Cross-Site Scripting XSS vulnerability. This means that an attacker with admin access can inject...

WordPress miniOrange's Google Authenticator Plugin <= 5.6.5 is vulnerable to Broken Access Control

Software miniOrange's Google Authenticator Type Plugin Vulnerable versions = 5.6.5 Fixed in 5.6.6 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2022-4943 Patch priority High CVSS severity High 7.5 Developer Claim ownership PSID 1f8ee97c6af1 Credits Ramuel Gal...

CVE-2022-4496 miniOrange WordPress SAML SSO multiple versions - Open Redirect in SSO login

The SAML SSO Standard WordPress plugin version 16.0.0 before 16.0.8, SAML SSO Premium WordPress plugin version 12.0.0 before 12.1.0 and SAML SSO Premium Multisite WordPress plugin version 20.0.0 before 20.0.7 does not validate that the redirect parameter to its SSO login endpoint points to an...

CVE-2022-4496 miniOrange WordPress SAML SSO multiple versions - Open Redirect in SSO login

The SAML SSO Standard WordPress plugin version 16.0.0 before 16.0.8, SAML SSO Premium WordPress plugin version 12.0.0 before 12.1.0 and SAML SSO Premium Multisite WordPress plugin version 20.0.0 before 20.0.7 does not validate that the redirect parameter to its SSO login endpoint points to an...

WordPress miniOrange Two-Factor Authentication plugin <= 5.6.1 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Calvin Alkan in WordPress miniOrange Two-Factor Authentication plugin versions = 5.6.1. Solution Update the WordPress miniOrange's Google Authenticator plugin to the latest available version at least 5.6.2...

CVE-2022-42461

Broken Access Control vulnerability in miniOrange's Google Authenticator plugin = 5.6.1 on WordPress...

CVE-2022-42461

Broken Access Control vulnerability in miniOrange's Google Authenticator plugin = 5.6.1 on WordPress...

Improper access control

Broken Access Control vulnerability in miniOrange's Google Authenticator plugin = 5.6.1 on WordPress...

CVE-2022-42461 WordPress miniOrange's Google Authenticator plugin <= 5.6.1 - Broken Access Control vulnerability

Broken Access Control vulnerability in miniOrange's Google Authenticator plugin = 5.6.1 on WordPress...

CVE-2022-42461

CVE-2022-42461 concerns a Broken Access Control issue in miniOrange’s Google Authenticator plugin for WordPress, affected versions ≤ 5.6.1. The vulnerability is described across multiple sources as an access-control flaw in the plugin’s settings/authorization flow, with no publicly documented exp...

PT-2022-26445 · Miniorange · Miniorange'S Google Authenticator Plugin

Name of the Vulnerable Software and Affected Versions: miniOrange's Google Authenticator plugin versions = 5.6.1 Description: The issue is related to a Broken Access Control vulnerability. This vulnerability affects miniOrange's Google Authenticator plugin on WordPress, potentially allowing...

WordPress miniOrange's Google Authenticator plugin <= 5.6.1 - Broken Access Control vulnerability

Broken Access Control vulnerability leading to Plugin Settings Change discovered by Lana Codes Patchstack Alliance in WordPress miniOrange's Google Authenticator plugin versions = 5.6.1. Solution Update the WordPress miniOrange's Google Authenticator plugin to the latest available version at leas...

miniOrange's Google Authenticator < 5.6.2 - Subscriber+ Settings Update

The plugin does not have authorisation check when updating its settings, which could allow any authenticated users, such as subscriber to update them...

CVE-2022-3082

The miniOrange Discord Integration WordPress plugin before 2.1.6 does not have authorisation and CSRF in some of its AJAX actions, allowing any logged in users, such as subscriber to call them, and disable the app for example...

Cross site request forgery (csrf)

The miniOrange Discord Integration WordPress plugin before 2.1.6 does not have authorisation and CSRF in some of its AJAX actions, allowing any logged in users, such as subscriber to call them, and disable the app for example...

CVE-2022-3082 miniOrange Discord Integration < 2.1.6 - Subscriber+ App Disabling

The miniOrange Discord Integration WordPress plugin before 2.1.6 does not have authorisation and CSRF in some of its AJAX actions, allowing any logged in users, such as subscriber to call them, and disable the app for example...

CVE-2022-3082 miniOrange Discord Integration < 2.1.6 - Subscriber+ App Disabling

The miniOrange Discord Integration WordPress plugin before 2.1.6 does not have authorisation and CSRF in some of its AJAX actions, allowing any logged in users, such as subscriber to call them, and disable the app for example...

CVE-2022-3082

CVE-2022-3082 affects the miniOrange Discord Integration WordPress plugin, versions prior to 2.1.6. The issue is insufficient authorization and CSRF protection in certain AJAX actions, allowing any logged-in user (e.g., subscribers) to invoke these actions and potentially disable the app. The doc...

WordPress Plugin miniOrange Discord Integration 访问控制错误漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. An Access Control Error vulnerability exist...

PT-2022-20334 · Miniorange · Miniorange Discord Integration Wordpress Plugin

Name of the Vulnerable Software and Affected Versions: miniOrange Discord Integration WordPress plugin versions prior to 2.1.6 Description: The issue concerns a lack of authorization and CSRF protection in certain AJAX actions of the plugin, allowing any logged-in user, such as a subscriber, to...