506 matches found
PT-2022-26445 · Miniorange · Miniorange'S Google Authenticator Plugin
Name of the Vulnerable Software and Affected Versions: miniOrange's Google Authenticator plugin versions = 5.6.1 Description: The issue is related to a Broken Access Control vulnerability. This vulnerability affects miniOrange's Google Authenticator plugin on WordPress, potentially allowing...
CVE-2022-42461: Undefined Security Weakness
Broken Access Control vulnerability in miniOrange's Google Authenticator plugin = 5.6.1 on WordPress...
WordPress miniOrange's Google Authenticator plugin <= 5.6.1 - Broken Access Control vulnerability
Broken Access Control vulnerability leading to Plugin Settings Change discovered by Lana Codes Patchstack Alliance in WordPress miniOrange's Google Authenticator plugin versions = 5.6.1. Solution Update the WordPress miniOrange's Google Authenticator plugin to the latest available version at leas...
miniOrange's Google Authenticator < 5.6.2 - Subscriber+ Settings Update
The plugin does not have authorisation check when updating its settings, which could allow any authenticated users, such as subscriber to update them...
CVE-2022-3082
The miniOrange Discord Integration WordPress plugin before 2.1.6 does not have authorisation and CSRF in some of its AJAX actions, allowing any logged in users, such as subscriber to call them, and disable the app for example...
Cross site request forgery (csrf)
The miniOrange Discord Integration WordPress plugin before 2.1.6 does not have authorisation and CSRF in some of its AJAX actions, allowing any logged in users, such as subscriber to call them, and disable the app for example...
CVE-2022-3082 miniOrange Discord Integration < 2.1.6 - Subscriber+ App Disabling
The miniOrange Discord Integration WordPress plugin before 2.1.6 does not have authorisation and CSRF in some of its AJAX actions, allowing any logged in users, such as subscriber to call them, and disable the app for example...
CVE-2022-3082 miniOrange Discord Integration < 2.1.6 - Subscriber+ App Disabling
The miniOrange Discord Integration WordPress plugin before 2.1.6 does not have authorisation and CSRF in some of its AJAX actions, allowing any logged in users, such as subscriber to call them, and disable the app for example...
CVE-2022-3082
CVE-2022-3082 affects the miniOrange Discord Integration WordPress plugin, versions prior to 2.1.6. The issue is insufficient authorization and CSRF protection in certain AJAX actions, allowing any logged-in user (e.g., subscribers) to invoke these actions and potentially disable the app. The doc...
CVE-2022-3082: Cross-Site Request Forgery (CSRF)
The miniOrange Discord Integration WordPress plugin before 2.1.6 does not have authorisation and CSRF in some of its AJAX actions, allowing any logged in users, such as subscriber to call them, and disable the app for example...
WordPress Plugin miniOrange Discord Integration 访问控制错误漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. An Access Control Error vulnerability exist...
PT-2022-20334 · Miniorange · Miniorange Discord Integration Wordpress Plugin
Name of the Vulnerable Software and Affected Versions: miniOrange Discord Integration WordPress plugin versions prior to 2.1.6 Description: The issue concerns a lack of authorization and CSRF protection in certain AJAX actions of the plugin, allowing any logged-in user, such as a subscriber, to...
WordPress miniOrange Discord Integration plugin <= 2.1.5 - Authenticated App Disabling vulnerability
Authenticated App Disabling vulnerability discovered by Lana Codes in WordPress miniOrange Discord Integration plugin versions = 2.1.5. Solution Update the WordPress miniOrange Discord Integration plugin to the latest available version at least 2.1.6...
miniOrange Discord Integration < 2.1.6 - Subscriber+ App Disabling
The plugin does not have authorisation and CSRF in some of its AJAX actions, allowing any logged in users, such as subscriber to call them, and disable the app for example PoC Run the below command in the developer console of the web browser while being on the blog as any user, such as subscriber...
CVE-2022-34858
Authentication Bypass vulnerability in miniOrange OAuth 2.0 client for SSO plugin = 1.11.3 at WordPress...
CVE-2022-34858
Authentication Bypass vulnerability in miniOrange OAuth 2.0 client for SSO plugin = 1.11.3 at WordPress...
CVE-2022-34149
Authentication Bypass vulnerability in miniOrange WP OAuth Server plugin = 3.0.4 at WordPress...
CVE-2022-34149
Authentication Bypass vulnerability in miniOrange WP OAuth Server plugin = 3.0.4 at WordPress...