WordPress Miniorange OTP Verification with Firebase Plugin <= 3.6.0 is vulnerable to Broken Authentication

Software Miniorange OTP Verification with Firebase Type Plugin Vulnerable versions = 3.6.0 Fixed in 3.6.1 OWASP Top 10 A1: Broken Access Control Classification Broken Authentication CVE CVE-2024-9862 Patch priority High CVSS severity High 9.8 Developer Claim ownership PSID 712edfb96dcd Credits...

Malicious code in firebase-rc-monitor (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 5050a33312844999e086c6e2ca70d4ded2bfe70479b9cd505ba48564f6c2eb34 The OpenSSF Package Analysis project identified 'firebase-rc-monitor' @ 100.0.5 npm as malicious. It is considered malicious because: - The...

MAL-2024-9279 Malicious code in firebase-rc-monitor (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 5050a33312844999e086c6e2ca70d4ded2bfe70479b9cd505ba48564f6c2eb34 The OpenSSF Package Analysis project identified 'firebase-rc-monitor' @ 100.0.5 npm as malicious. It is considered malicious because: - The...

Arc 安全漏洞

Arc is a browser from Arc, Inc. A security vulnerability exists in versions of Arc prior to 2024-08-26 that stems from the presence of a remote code execution vulnerability that allows an attacker to execute arbitrary JavaScript code in a victim's browser via improperly configured Firebase ACLs...

PT-2024-6951

Name of the Vulnerable Software and Affected Versions: Arc versions prior to 2024-08-26 Description: Arc browser, before version 2024-08-26, contains a remote code execution issue within JavaScript boosts. Normally, JavaScript boosts cannot be shared; however, misconfigured Firebase Access Contro...

CVE-2024-7628

The MStore API – Create Native Android & iOS Apps On The Cloud plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 4.15.2. This is due to the use of loose comparison in the 'verifyidtoken' function. This makes it possible for unauthenticated attackers to...

CVE-2024-7628

The MStore API – Create Native Android & iOS Apps On The Cloud plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 4.15.2. This is due to the use of loose comparison in the 'verifyidtoken' function. This makes it possible for unauthenticated attackers to...

CVE-2024-7628 MStore API – Create Native Android & iOS Apps On The Cloud <= 4.15.2 - Authentication Bypass to Account Takeover

The MStore API – Create Native Android & iOS Apps On The Cloud plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 4.15.2. This is due to the use of loose comparison in the 'verifyidtoken' function. This makes it possible for unauthenticated attackers to...

CVE-2024-7628 MStore API – Create Native Android & iOS Apps On The Cloud <= 4.15.2 - Authentication Bypass to Account Takeover

The MStore API – Create Native Android & iOS Apps On The Cloud plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 4.15.2. This is due to the use of loose comparison in the 'verifyidtoken' function. This makes it possible for unauthenticated attackers to...

CVE-2024-7628

CVE-2024-7628 involves the MStore API – Create Native Android & iOS Apps On The Cloud WordPress plugin. It allows authentication bypass via a loose token-id verification in verify_id_token, enabling unauthenticated login as an existing site user (potentially an administrator) if firebase is confi...

PT-2024-38463 · WordPress · Mstore Api

Name of the Vulnerable Software and Affected Versions: MStore API – Create Native Android & iOS Apps On The Cloud plugin for WordPress versions up to, and including, 4.15.2 Description: The issue is due to the use of loose comparison in the verify id token function, making it possible for...

CVE-2024-6328

The MStore API – Create Native Android & iOS Apps On The Cloud plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 4.14.7. This is due to insufficient verification on the 'phone' parameter of the 'firebasesmslogin' and 'firebasesmsloginv2' functions...

CVE-2024-20897

Use of implicit intent for sensitive communication in FCM function in IMS service prior to SMR Jul-2024 Release 1 allows local attackers to get sensitive information...

GO-2024-2808 CSRF in firebase-tools emulator suite in github.com/firebase/firebase-tools

CSRF in firebase-tools emulator suite in github.com/firebase/firebase-tools...

Citrix EndPoint Management - Reconfigure your Firebase Cloud Messaging (FCM) in CEM console

As permigration guidance, Google is going to deprecate the FCM legacy APIs for HTTP, which is currently used in our Citrix Endpoint Management CEM FCM implementation. The migration deadline is on June 21, 2024. Customers need to migrate the FCM from legacy FCM API to HTTP v1 API. With the release...

GHSA-H533-5V22-8VCP firebase/php-jwt: "None" Algorithm treated as valid on tokens

Several widely-used JSON Web Token JWT libraries, including node-jsonwebtoken, pyjwt, namshi/jose, php-jwt, and jsjwt, are affected by critical vulnerabilities that could allow attackers to bypass the verification step when using asymmetric keys RS256, RS384, RS512, ES256, ES384, ES512...

firebase/php-jwt: "None" Algorithm treated as valid on tokens

Several widely-used JSON Web Token JWT libraries, including node-jsonwebtoken, pyjwt, namshi/jose, php-jwt, and jsjwt, are affected by critical vulnerabilities that could allow attackers to bypass the verification step when using asymmetric keys RS256, RS384, RS512, ES256, ES384, ES512...

Cross-Site Request Forgery (CSRF)

firebase-tools is vulnerable to a Cross-Site Request Forgery CSRF. This vulnerability is due to the export endpoint in the Firebase emulator suite. If a user runs the emulator while visiting a malicious website, the browser can call out to localhost, which could result in the exfiltration of...

Firebase vulnerable to CRSF attack

This vulnerability was a potential CSRF attack. When running the Firebase emulator suite, there is an export endpoint that is used normally to export data from running emulators. If a user was running the emulator and navigated to a malicious website with the exploit on a browser that allowed cal...

GHSA-RCM2-22F3-PQV3 Firebase vulnerable to CRSF attack

This vulnerability was a potential CSRF attack. When running the Firebase emulator suite, there is an export endpoint that is used normally to export data from running emulators. If a user was running the emulator and navigated to a malicious website with the exploit on a browser that allowed cal...