google login vulnerabilities and exploits

(subscribe to this query)

The Google Login Plugin (versions 1.0 and 1.1) allows malicious anonymous users to authenticate successfully against Jenkins instances that are supposed to be locked down to a particular Google Apps domain through client-side request modification.

Jenkins Google Login 1.1 Jenkins Google Login 1.0

Jenkins Google Login Plugin 1.4 up to and including 1.6 (both inclusive) improperly determines that a redirect URL after login is legitimately pointing to Jenkins.

Jenkins Google Login

Jenkins Google Login Plugin 1.7 and previous versions uses a non-constant time comparison function when checking whether the provided and expected token are equal, potentially allowing malicious users to use statistical methods to obtain a valid token.

Jenkins Google Login

A session fixaction vulnerability exists in Jenkins Google Login Plugin 1.3 and older in GoogleOAuth2SecurityRealm.java that allows unauthorized malicious users to impersonate another user if they can control the pre-authentication session.

Jenkins Google Login

An open redirect vulnerability exists in Jenkins Google Login Plugin 1.3 and older in GoogleOAuth2SecurityRealm.java that allows malicious users to redirect users to an arbitrary URL after successful login.

Jenkins Google Login

The Login for Google Apps WordPress plugin prior to 3.4.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in ...

Wp-glogin Login For Google Apps

Cross-Site Request Forgery (CSRF) vulnerability in miniOrange WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) plugin <= 7.5.14 versions.

Miniorange Wordpress Social Login And Register \\(discord\\, Google\\, Twitter\\, Linkedin\\)

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in miniOrange WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) plugin <= 7.5.14 versions.

Miniorange Wordpress Social Login And Register \\(discord\\, Google\\, Twitter\\, Linkedin\\)

The WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 7.6.4. This is due to insufficient encryption on the user being supplied during a login validated through the...

Miniorange Wordpress Social Login And Register \\(discord\\, Google\\, Twitter\\, Linkedin\\)

2 Github repositories

The Login With OTP Over SMS, Email, WhatsApp and Google Authenticator WordPress plugin prior to 1.0.8 does not escape its settings, allowing high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed

Miniorange Login With Otp Over Sms\\, Email\\, Whatsapp And Google Authenticator

1 2 3 4 5 6 NEXT »

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook