CVSS: 9.0EPSS: 0%CPEs: 1EXPL: 1CVE-2022-34155 – WordPress OAuth Single Sign On – SSO (OAuth Client) Plugin <= 6.23.3 is vulnerable to Broken Authentication
https://notcve.org/view.php?id=CVE-2022-34155
24 May 2023 — Improper Authentication vulnerability in miniOrange OAuth Single Sign On – SSO (OAuth Client) plugin allows Authentication Bypass.This issue affects OAuth Single Sign On – SSO (OAuth Client): from n/a through 6.23.3. The OAuth Single Sign On – SSO (OAuth Client) plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on multiple AJAX functions in versions up to, and including, 6.23.3. This makes it possible for authenticated attackers with subscriber-level p... • https://lana.codes/lanavdb/071fa6eb-2e54-43a1-b37f-1e562988b7d4?_s_id=cve • CWE-287: Improper Authentication CWE-862: Missing Authorization •
CVSS: 7.8EPSS: 0%CPEs: 4EXPL: 4CVE-2023-1092 – OAuth Single Sign On - SSO (OAuth Client) - IdP Deletion via CSRF
https://notcve.org/view.php?id=CVE-2023-1092
28 Feb 2023 — The OAuth Single Sign On Free WordPress plugin before 6.24.2, OAuth Single Sign On Standard WordPress plugin before 28.4.9, OAuth Single Sign On Premium WordPress plugin before 38.4.9 and OAuth Single Sign On Enterprise WordPress plugin before 48.4.9 do not have CSRF checks when deleting Identity Providers (IdP), which could allow attackers to make logged in admins delete arbitrary IdP via a CSRF attack The OAuth Single Sign On – SSO (OAuth Client) plugin for WordPress is vulnerable to Cross-Site Request Fo... • https://wpscan.com/vulnerability/52e29f16-b6dd-4132-9bb8-ad10bd3c39d7 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 1CVE-2023-1093 – OAuth Single Sign On - SSO (OAuth Client) < 6.24.2 - IdP Discard via CSRF
https://notcve.org/view.php?id=CVE-2023-1093
15 Feb 2023 — The OAuth Single Sign On WordPress plugin before 6.24.2 does not have CSRF checks when discarding Identify providers (IdP), which could allow attackers to make logged in admins delete all IdP via a CSRF attack The OAuth Single Sign On – SSO (OAuth Client) plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 6.24.1. This is due to missing or incorrect nonce validation on the 'discard' case in the mooauth_client_applist_page function. This makes it possible for un... • https://wpscan.com/vulnerability/1e13b9ea-a3ef-483b-b967-6ec14bd6d54d • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 8.1EPSS: 0%CPEs: 1EXPL: 1CVE-2022-2133 – OAuth Single Sign On < 6.22.6 - Authentication Bypass
https://notcve.org/view.php?id=CVE-2022-2133
27 Jun 2022 — The OAuth Single Sign On WordPress plugin before 6.22.6 doesn't validate that OAuth access token requests are legitimate, which allows attackers to log onto the site with the only knowledge of a user's email address. El plugin OAuth Single Sign On de WordPress versiones anteriores a 6.22.6, no comprueba que las peticiones de token de acceso OAuth sean legítimas, lo que permite a atacantes entrar en el sitio con el único conocimiento de la dirección de correo electrónico de un usuario • https://wpscan.com/vulnerability/e76939ca-180f-4472-a26a-e0c36cfd32de • CWE-287: Improper Authentication •