Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

6 records

Vendor: miniOrange Component: Miniorange 2fa Clear all filters
TI-2025-06062 CVE-2025-6675 · GHSA-9c75-x9m5-346w

Enterprise MFA - TFA for Drupal - Critical - Access bypass - SA-CONTRIB-2025-082

Priority LOW 24

Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Enterprise MFA - TFA for Drupal allows Authentication Bypass.This issue affects Enterprise MFA - TFA for Drupal: from 0.0.0 before 4.8.0, f…

CVSS 3.1MEDIUM 4.8 Network No auth No interaction EPSS 0.00235 Published 2025-06-26 Fixed in 4.8.0, 5.2.1 CWE-288
TI-2025-30207 CVE-2025-47710 · GHSA-h8vr-q495-8mwj

Enterprise MFA - TFA for Drupal - Critical - Access bypass - SA-CONTRIB-2025-056

Priority LOW 35

Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Enterprise MFA - TFA for Drupal allows Authentication Bypass.This issue affects Enterprise MFA - TFA for Drupal: from 0.0.0 before 4.7.0, f…

CVSS 3.1HIGH 7.4 Network No auth No interaction EPSS 0.00389 Published 2025-05-14 Fixed in 4.7.0, 5.2.0 CWE-288
TI-2025-30206 CVE-2025-47709 · GHSA-mqhr-6wmj-4wqg

Enterprise MFA - TFA for Drupal - Critical - Access bypass - SA-CONTRIB-2025-055

Priority LOW 34

Missing Authorization vulnerability in Drupal Enterprise MFA - TFA for Drupal allows Forceful Browsing.This issue affects Enterprise MFA - TFA for Drupal: from 0.0.0 before 4.7.0, from 5.0.0 before 5.2.0.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00253 Published 2025-05-14 Fixed in 4.7.0, 5.2.0 CWE-862
TI-2025-30205 CVE-2025-47708 · GHSA-p3vf-h5cf-xmjr

Enterprise MFA - TFA for Drupal - Critical - Cross Site Request Forgery - SA-CONTRIB-2025-054

Priority LOW 39

Cross-Site Request Forgery (CSRF) vulnerability in Drupal Enterprise MFA - TFA for Drupal allows Cross Site Request Forgery.This issue affects Enterprise MFA - TFA for Drupal: from 0.0.0 before 4.7.0, from 5.0.0 before 5…

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00201 Published 2025-05-14 Fixed in 4.7.0, 5.2.0 CWE-352
TI-2025-30204 CVE-2025-47707 · GHSA-p24g-cj72-gpfv

Enterprise MFA - TFA for Drupal - Moderately critical - Access bypass - SA-CONTRIB-2025-053

Priority LOW 33

Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Enterprise MFA - TFA for Drupal allows Authentication Bypass.This issue affects Enterprise MFA - TFA for Drupal: from 0.0.0 before 4.7.0, f…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00424 Published 2025-05-14 Fixed in 4.7.0, 5.2.0 CWE-288
TI-2025-30203 CVE-2025-47706 · GHSA-pwfh-8xv9-vgc2

Enterprise MFA - TFA for Drupal - Moderately critical - Access bypass - SA-CONTRIB-2025-052

Priority LOW 22

Authentication Bypass by Capture-replay vulnerability in Drupal Enterprise MFA - TFA for Drupal allows Remote Services with Stolen Credentials.This issue affects Enterprise MFA - TFA for Drupal: from 0.0.0 before 4.7.0,…

CVSS 3.1MEDIUM 4.8 Network No auth No interaction EPSS 0.00282 Published 2025-05-14 Fixed in 4.7.0, 5.2.0 CWE-294