Miniorange vulnerabilities, page 5

93 vulnerabilities

Known vulnerabilities in Miniorange products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 54 products.

7.2HighCVE-2023-4238miniorange · prevent_files_\/_folders_access +2 morePrevent files / folders access < 2.5.2 - Admin+ Arbitrary File UploadThe Prevent files / folders access WordPress plugin before 2.5.2 does not validate files to be uploaded, which could allow attackers to upload arbitrary files such as PHP on the server.EPSS1.60%7.5HighCVE-2023-4506cyberlord92 · active directory integration / ldap integration +2 moreActive Directory Integration / LDAP Integration <= 4.1.10 - LDAP PassbackThe Active Directory Integration / LDAP Integration plugin for WordPress is vulnerable to LDAP Passback in versions up to, and including, 4.1.10. This is due to insufficient validation when changing the LDAP server. This makes it possible for authenticated attackers, with administrative access and above, to change the LDAP server and retrieve the credentials for the original LDAP server.EPSS0.91%5.4MediumCVE-2023-4757miniorange · staff_\/_employee_business_directory_for_active_directory +2 moreStaff / Employee Business Directory for Active Directory < 1.2.3 - Improper escaping of LDAP entriesThe Staff / Employee Business Directory for Active Directory WordPress plugin before 1.2.3 does not sanitize and escape data returned from the LDAP server before rendering it in the page, allowing users who can control their entries in the LDAP directory to inject malicious javascript which could be used against high-privilege users such as a site admin.EPSS0.46%5.3MediumCVE-2023-25455miniorange · wordpress_social_login_and_register_\(discord\,_google\,_twitter\,_linkedin\) +1 moreWordPress WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) plugin <= 7.6.0 - Arbitrary Content Deletion vulnerabilityMissing Authorization vulnerability in miniOrange WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn): from n/a through 7.6.0.EPSS0.76%5.9MediumCVE-2023-37986miniorange · yourmembership single sign on – ym sso login +2 moreWordPress YourMembership Single Sign On Plugin <= 1.1.3 is vulnerable to Cross Site Scripting (XSS)Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in miniOrange YourMembership Single Sign On – YM SSO Login plugin <= 1.1.3 versions.EPSS0.36%6.5MediumCVE-2023-37987miniorange · yourmembership single sign on +1 moreWordPress YourMembership Single Sign On plugin <= 1.1.3 - Broken Access Control vulnerabilityMissing Authorization vulnerability in miniOrange YourMembership Single Sign On allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects YourMembership Single Sign On: from n/a through 1.1.3.EPSS0.60%7.5HighCVE-2023-5003miniorange · active_directory_integration_\/_ldap_integration +3 moreActive Directory Integration < 4.1.10 - Unauthenticated Log DisclosureThe Active Directory Integration / LDAP Integration WordPress plugin before 4.1.10 stores sensitive LDAP logs in a buffer file when an administrator wants to export said logs. Unfortunately, this log file is never removed, and remains accessible to any users knowing the URL to do so.EPSS26.63%6.5MediumCVE-2023-24375miniorange · wordpress_social_login_and_register_\(discord\,_google\,_twitter\,_linkedin\) +1 moreWordPress WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) plugin <= 7.5.14 - Broken Access Control vulnerabilityMissing Authorization vulnerability in miniOrange WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn): from n/a through 7.5.14.EPSS0.44%9.8CriticalCVE-2023-6036miniorange · web3_-_crypto_wallet_login_\&_nft_token_gating +2 moreWeb3 – Crypto wallet Login & NFT token gating < 3.0.0 - Authentication BypassThe Web3 WordPress plugin before 3.0.0 is vulnerable to an authentication bypass due to incorrect authentication checking in the login flow in functions 'handle_auth_request' and 'hadle_login_request'. This makes it possible for non authenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the username.EPSS1.77%9.8CriticalCVE-2023-3249cyberlord92 · web3 – crypto wallet login & nft token gating +2 moreWeb3 – Crypto wallet Login & NFT token gating <= 2.6.0 - Authentication BypassThe Web3 – Crypto wallet Login & NFT token gating plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.6.0. This is due to incorrect authentication checking in the 'hidden_form_data' function. This makes it possible for authenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the username.EPSS1.10%7.6HighCVE-2023-3447cyberlord92 · active directory integration / ldap integration +2 moreActive Directory Integration / LDAP Integration <= 4.1.5 - Authenticated (Subscriber+) LDAP InjectionThe Active Directory Integration / LDAP Integration plugin for WordPress is vulnerable to LDAP Injection in versions up to, and including, 4.1.5. This is due to insufficient escaping on the supplied username value. This makes it possible for attackers, with an existing account on a vulnerable WordPress instance, to extract potentially sensitive information from the LDAP directory.EPSS0.53%8.8HighCVE-2023-23706miniorange · wordpress_social_login_and_register_\(discord\,_google\,_twitter\,_linkedin\) +1 moreWordPress WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) Plugin <= 7.5.14 is vulnerable to Cross Site Request Forgery (CSRF)Cross-Site Request Forgery (CSRF) vulnerability in miniOrange WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) plugin <= 7.5.14 versions.EPSS0.26%5.9MediumCVE-2023-23710miniorange · wordpress_social_login_and_register_\(discord\,_google\,_twitter\,_linkedin\) +1 moreWordPress WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) plugin <= 7.5.14 is vulnerable to Cross Site Scripting (XSS)Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in miniOrange WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) plugin <= 7.5.14 versions.EPSS0.37%7.5HighCVE-2023-23749miniorange · ldap_integration_with_active_directory_and_openldap +1 moreExtension - miniorange - LDAP Integration - LDAP Injection (username)The 'LDAP Integration with Active Directory and OpenLDAP - NTLM & Kerberos Login' extension is vulnerable to LDAP Injection since is not properly sanitizing the 'username' POST parameter. An attacker can manipulate this paramter to dump arbitrary contents form the LDAP Database.EPSS0.56%