547 matches found
CVE-2022-26493 miniOrange SAML Authentication Bypass
Xecurify's miniOrange Premium, Standard, and Enterprise Drupal SAML SP modules possess an authentication and authorization bypass vulnerability. An attacker with access to a HTTP-request intercepting method is able to bypass authentication and authorization by removing the SAML Assertion Signatur...
CVE-2022-26493: Improper Certificate Validation
Xecurify's miniOrange Premium, Standard, and Enterprise Drupal SAML SP modules possess an authentication and authorization bypass vulnerability. An attacker with access to a HTTP-request intercepting method is able to bypass authentication and authorization by removing the SAML Assertion Signatur...
PT-2022-17899
Name of the Vulnerable Software and Affected Versions miniOrange Drupal SAML SP modules versions prior to the most recent versions Drupal SAML SP 2.0 Single Sign On SSO - SAML Service Provider 8.x versions 8.x-2.24 and prior Drupal SAML SP 2.0 Single Sign On SSO - SAML Service Provider 7.x versio...
WordPress miniOrange's Google Authenticator plugin cross-site request forgery vulnerability
WordPress is a blogging platform developed by the Wordpress Foundation using the PHP language. WordPress plugin is a WordPress application plugin. WordPress miniOrange's Google Authenticator plugin version 5.5 or earlier is vulnerable to a cross-site request forgery vulnerability that stems from...
CVE-2022-0229
The miniOrange's Google Authenticator WordPress plugin before 5.5 does not have proper authorisation and CSRF checks when handling the reconfigureMethod, and does not validate the parameters passed to it properly. As a result, unauthenticated users could delete arbitrary options from the blog,...
CVE-2022-0229
The miniOrange's Google Authenticator WordPress plugin before 5.5 does not have proper authorisation and CSRF checks when handling the reconfigureMethod, and does not validate the parameters passed to it properly. As a result, unauthenticated users could delete arbitrary options from the blog,...
CVE-2022-0229 miniOrange's Google Authenticator < 5.5 - Unauthenticated Arbitrary Options Deletion
The miniOrange's Google Authenticator WordPress plugin before 5.5 does not have proper authorisation and CSRF checks when handling the reconfigureMethod, and does not validate the parameters passed to it properly. As a result, unauthenticated users could delete arbitrary options from the blog,...
WordPress plugin miniOrange 安全漏洞
WordPress is a blogging platform developed by the Wordpress Foundation using the PHP language. WordPress plugin is a WordPress application plugin. WordPress miniOrange's Google Authenticator plugin version 5.5 or earlier is vulnerable to a cross-site request forgery vulnerability that stems from...
PT-2022-13048 · Miniorange · Google Authenticator Wordpress Plugin
Name of the Vulnerable Software and Affected Versions: miniOrange's Google Authenticator WordPress plugin versions prior to 5.5 Description: The issue arises from the lack of proper authorization and CSRF checks when handling the reconfigureMethod, and improper validation of parameters passed to...
WordPress miniOrange's Google Authenticator plugin <= 5.4.52 - Unauthenticated Arbitrary Options Deletion vulnerability
Unauthenticated Arbitrary Options Deletion vulnerability discovered by Krzysztof Zając in WordPress miniOrange's Google Authenticator plugin versions = 5.4.52. Solution Update the WordPress miniOrange's Google Authenticator plugin to the latest available version at least 5.5...
miniOrange's Google Authenticator < 5.5 - Unauthenticated Arbitrary Options Deletion
The plugin does not have proper authorisation and CSRF checks when handling the reconfigureMethod, and does not validate the parameters passed to it properly. As a result, unauthenticated users could delete arbitrary options from the blog, making it unusable. Note: The initial issue was fixed in...
GHSA-G485-29GQ-6H2H Sensitive Data Exposure in miniorange_saml
The miniorangesaml aka Miniorange Saml extension before 1.4.3 for TYPO3 allows Sensitive Data Exposure of API credentials and private keys...
GHSA-JJ8R-P9F5-FMVV Cross-site Scripting in TYPO3 extension
The miniorangesaml aka Miniorange Saml extension before 1.4.3 for TYPO3 allows XSS...
Cross-site Scripting in TYPO3 extension
The miniorangesaml aka Miniorange Saml extension before 1.4.3 for TYPO3 allows XSS...
Multiple Plugins from miniorange - Reflected Cross-Site Scripting via appId
The plugins do not escape the appId parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting issue PoC https://example.com/wp-admin/admin.php?page=mooauthsettings=config=" https://example.com/wp-admin/admin.php?page=mooauthsettings=config=instructions="...
Multiple Plugins from miniorange - Reflected Cross-Site Scripting via appId
The plugins do not escape the appId parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting issue https://example.com/wp-admin/admin.php?page=mooauthsettings&tab=config&appId="alert/XSS/...
CVE-2021-36786
The miniorangesaml aka Miniorange Saml extension before 1.4.3 for TYPO3 allows Sensitive Data Exposure of API credentials and private keys...
CVE-2021-36785
The miniorangesaml aka Miniorange Saml extension before 1.4.3 for TYPO3 allows XSS...