miniOrange

Records129All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical28CVSS 9.0–10.0

CVSS high39CVSS 7.0–8.9

Exploited now

miniOrange records in CISA KEV

No miniOrange vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Active Directory Integration / Ldap Integration 6 records HIGH Google Authenticator 6 records MEDIUM Miniorange 2fa 6 records LOW Oauth Single Sign On 4 records HIGH Saml Sp Single Sign On 3 records LOW Wordpress Social Login And Register (discord, Google, Twitter, Linkedin) 3 records HIGH Malware Scanner 2 records LOW Otp Verification With Firebase 2 records MEDIUM

Records

6 records in Active Directory Integration / Ldap Integration · all components

TI-2023-04605 CVE-2023-5003 · GHSA-2vvx-5g27-9gvj

Active Directory Integration < 4.1.10 - Unauthenticated Log Disclosure

HIGH 72

The Active Directory Integration / LDAP Integration WordPress plugin before 4.1.10 stores sensitive LDAP logs in a buffer file when an administrator wants to export said logs.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.26633 Published 2023-10-16 Fixed in 4.1.10

TI-2023-00770 CVE-2023-0812 · GHSA-7rw4-5qwp-72w6

Active Directory Integration / LDAP Integration < 4.1.1 - Unauthenticated Data Disclosure

HIGH 66

The Active Directory Integration / LDAP Integration WordPress plugin before 4.1.1 does not have proper authorization or nonce values for some POST requests, leading to unauthenticated data disclosure.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00819 Published 2023-05-15 Fixed in 4.1.1

TI-2023-03221 CVE-2023-3447 · GHSA-wxg4-73q7-87rm

Active Directory Integration / LDAP Integration <= 4.1.5 - Authenticated (Subscriber+) LDAP Injection

MEDIUM 40

The Active Directory Integration / LDAP Integration plugin for WordPress is vulnerable to LDAP Injection in versions up to, and including, 4.1.5.

CVSS 3.1HIGH 7.6 Network Low privileges No interaction EPSS 0.00528 Published 2023-06-29 No fix listed CWE-90

TI-2023-02332 CVE-2023-2484 · GHSA-c6h8-w2p9-jcrc

Active Directory Integration / LDAP Integration <= 4.1.4 - Authenticated (Administrator+) SQL Injection

LOW 35

The Active Directory Integration plugin for WordPress is vulnerable to time-based SQL Injection via the orderby and order parameters in versions up to, and including, 4.1.4 due to insufficient escaping on the user suppli…

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00847 Published 2023-06-09 No fix listed CWE-89

TI-2023-04159 CVE-2023-4506 · GHSA-jpx4-gr7j-qv9p

Active Directory Integration / LDAP Integration <= 4.1.10 - LDAP Passback

LOW 31

The Active Directory Integration / LDAP Integration plugin for WordPress is vulnerable to LDAP Passback in versions up to, and including, 4.1.10.

CVSS 3.1MEDIUM 6.5 Network High privileges No interaction EPSS 0.00911 Published 2023-09-26 No fix listed CWE-306

TI-2023-02429 CVE-2023-2599 · GHSA-267v-vcrf-m92x

Active Directory Integration / LDAP Integration <= 4.1.4 - Cross-Site Request Forgery to SQL Injection

LOW 29

The Active Directory Integration plugin for WordPress is vulnerable to Cross-Site Request Forgery leading to time-based SQL Injection via the orderby and order parameters in versions up to, and including, 4.1.4 due to mi…

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00424 Published 2023-06-09 No fix listed CWE-352

Open these records in search →