miniOrange

Records129All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical28CVSS 9.0–10.0

CVSS high39CVSS 7.0–8.9

Exploited now

miniOrange records in CISA KEV

No miniOrange vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Active Directory Integration / Ldap Integration 6 records HIGH Google Authenticator 6 records MEDIUM Miniorange 2fa 6 records LOW Oauth Single Sign On 4 records HIGH Saml Sp Single Sign On 3 records LOW Wordpress Social Login And Register (discord, Google, Twitter, Linkedin) 3 records HIGH Malware Scanner 2 records LOW Otp Verification With Firebase 2 records MEDIUM

Records

6 records in Google Authenticator · all components

TI-2022-04534 CVE-2022-4943 · GHSA-rg8p-4m72-g4mp

miniOrange's Google Authenticator <= 5.6.5 - Missing Authorization to Plugin Settings Change

MEDIUM 40

The miniOrange's Google Authenticator plugin for WordPress is vulnerable to authorization bypass due to a missing capability check when changing plugin settings in versions up to, and including, 5.6.5.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0055 Published 2023-10-20 No fix listed CWE-862

TI-2022-20660 CVE-2022-42461 · GHSA-gpw5-5rh2-qhcm

WordPress miniOrange's Google Authenticator plugin <= 5.6.1 - Broken Access Control vulnerability

LOW 39

Broken Access Control vulnerability in miniOrange's Google Authenticator plugin <= 5.6.1 on WordPress.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00701 Published 2022-11-18 No fix listed CWE-264

TI-2022-21926 CVE-2022-44589 · GHSA-hwcx-3vrw-26jm

WordPress miniOrange's Google Authenticator Plugin <= 5.6.1 is vulnerable to Sensitive Data Exposure

LOW 36

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in miniOrange miniOrange's Google Authenticator – WordPress Two Factor Authentication – 2FA , Two Factor, OTP SMS and Email | Passwordless login.Th…

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.00694 Published 2023-12-29 No fix listed CWE-200

TI-2022-00165 CVE-2022-0229 · GHSA-93c5-xvhq-3947

miniOrange's Google Authenticator < 5.5 - Unauthenticated Arbitrary Options Deletion

LOW 36

The miniOrange's Google Authenticator WordPress plugin before 5.5 does not have proper authorisation and CSRF checks when handling the reconfigureMethod, and does not validate the parameters passed to it properly.

CVSS 3.1HIGH 8.1 Network No auth User interaction EPSS 0.00549 Published 2022-03-21 Fixed in 5.5 CWE-352

TI-2022-01203 CVE-2022-1321 · GHSA-fx6c-r92h-hc9p

miniOrange's Google Authenticator < 5.5.6 - Admin+ Stored Cross-Site Scripting

LOW 23

The miniOrange's Google Authenticator WordPress plugin before 5.5.6 does not sanitise and escape some of its settings, leading to malicious users with administrator privileges to store malicious Javascript code leading t…

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00587 Published 2022-06-27 Fixed in 5.5.6 CWE-79

TI-2022-00780 CVE-2022-0875 · GHSA-vwfv-wx8q-xqpc

miniOrange Google Authenticator < 1.0.5 - CSRF to Stored Cross-Site Scripting

LOW 20

The Google Authenticator WordPress plugin before 1.0.5 does not have CSRF check when saving its settings, and does not sanitise as well as escape them, allowing attackers to make a logged in admin change them and perform…

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.00429 Published 2022-06-27 Fixed in 1.0.5 CWE-352

Open these records in search →