CWE-601: URL Redirection to Untrusted Site
The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.
Also known as Open Redirect, Cross-site Redirect, Cross-domain Redirect.
A kind of CWE-610 Externally Controlled Reference to a Resource in Another Sphere.
From the CWE List. © The MITRE Corporation.
Newest
- cybozu garoonThe "Scheduler" function in Cybozu Garoon before 4.2.2 allows remote attackers to redirect users...6.1 Medium
- ibm marketing platformIBM Marketing Platform 10.0 could allow a remote attacker to conduct phishing attacks, caused by...5.4 Medium
- mediawiki, debian linux +1 moreSpecial:Search allows redirects to any interwiki link6.1 Medium
- mediawiki, debian linux +1 moreSpecial:UserLogin?returnto=interwiki:foo will redirect to external sites6.1 Medium
- jivesoftware jiveJive before 2016.3.1 has an open redirect from the external-link.jspa page.6.1 Medium
- cisco integrated management controller, unified computing system +1 moreA vulnerability in the web interface of Cisco Integrated Management Controller (IMC) Software...6.1 Medium
- cisco registered envelope serviceA vulnerability in the web interface of the Cisco Registered Envelope Service could allow an...6.1 Medium
- djangoproject djangoDjango open redirect6.1 Medium
- djangoproject djangoDjango open redirect and possible XSS attack via user-supplied numeric redirect URLs6.1 Medium
- jensenofscandinavia al3g firmware, al5000ac firmware, al59300 firmware +2 moreJensen of Scandinavia AS Air:Link 3G (AL3G) version 2.23m (Rev. 3), Air:Link 5000AC (AL5000AC)...6.1 Medium
- jensenofscandinavia al3g firmware, al5000ac firmware, al59300 firmware +2 moreJensen of Scandinavia AS Air:Link 3G (AL3G) version 2.23m (Rev. 3), Air:Link 5000AC (AL5000AC)...6.1 Medium
- apple iphone osAn issue was discovered in certain Apple products. iOS before 10.3 is affected. The issue...7.5 High
- netflix security monkeyNetflix Security Monkey Open Redirect vulnerability6.1 Medium
- plonePlone Open Redirect Vulnerability6.1 Medium
- cpanel cgiecho, cgiemail +1 morecgiemail and cgiecho allow remote attackers to inject HTTP headers via a newline character in the...6.1 Medium
- cpanelOpen redirect vulnerability in cgiemail and cgiecho allows remote attackers to redirect users to...6.1 Medium
- flexerasoftware flexnet publisherOpen redirect vulnerability in the lmadmin component in Flexera FlexNet Publisher (aka Flex...6.1 Medium
- cisco secure access control systemA vulnerability in the web interface of the Cisco Secure Access Control System (ACS) could allow...6.1 Medium
- kabona ab webdatorcentralAn issue was discovered in Kabona AB WebDatorCentral (WDC) application prior to Version 3.4.0....6.1 Medium
- cisco prime service catalogA vulnerability in the web framework of Cisco Prime Service Catalog could allow an authenticated,...5.4 Medium
- hcl software bigfix inventory, ibm license metric tool +1 moreIBM BigFix Inventory v9 could allow a remote attacker to conduct phishing attacks, using an open...6.1 Medium
- ibm sterling b2b integratorIBM Sterling B2B Integrator Standard Edition could allow a remote attacker to conduct phishing...6.1 Medium
- opera browserCharacters from languages are such as Arabic, Hebrew are displayed from RTL (Right To Left) order...6.1 Medium
- cisco webex meeting centerA vulnerability in a URL parameter of Cisco WebEx Meeting Center could allow an unauthenticated,...5.4 Medium
- mozilla firefoxWebExtensions could use the "mozAddonManager" API by modifying the CSP headers on sites with the...6.1 Medium
- s9y serendipityOpen redirect vulnerability in comment.php in Serendipity through 2.0.5 allows remote attackers...6.1 Medium
- puppet enterpriseOpen redirect vulnerability in the Console in Puppet Enterprise 2015.x and 2016.x before 2016.4.0...6.1 Medium
- puppet enterpriseOpen redirect vulnerability in the Console in Puppet Enterprise before 2015.2.1 allows remote...6.1 Medium
- pivotal software cloud foundry elastic runtime, cloud foundry ops manager +1 moreAn open redirect vulnerability has been detected with some Pivotal Cloud Foundry Elastic Runtime...7.4 High
- open-xchange appsuiteAn issue was discovered in Open-Xchange OX AppSuite before 7.8.0-rev27. The "defer" servlet...7.4 High
- ibm filenet workplaceOpen redirect vulnerability in IBM FileNet Workplace 4.0.2 through 4.0.2.14 IF001 allows remote...6.8 Medium
- mozilla firefoxRedirection from an HTTP connection to a "data:" URL assigns the referring site's origin to the ...8.8 High
- drupalDrupal Open Redirect6.8 Medium
- ibm cloud orchestratorOpen redirect vulnerability in IBM Cloud Orchestrator 2.4.x before 2.4.0 FP3 allows remote...6.8 Medium
- flask-oidc project flask-oidcflask-oidc Open Redirect vulnerability7.4 High
- pivotal software cloud foundry, cloudfoundry cloud foundry uaa bosh, pivotal software cloud foundry elastic runtime +2 more +4 moreThe OAuth authorization implementation in Pivotal Cloud Foundry (PCF) before 242; UAA 2.x before...5.3 Medium
- ibm tealeaf customer experienceOpen redirect vulnerability in the web portal in IBM Tealeaf Customer Experience before 8.7.1...6.8 Medium
- ibm security privileged identity manager virtual applianceIBM WebSphere Application Server (WAS) Liberty, as used in IBM Security Privileged Identity...6.8 Medium
- pivotal cloud foundry elastic runtimeMultiple open redirect vulnerabilities in Pivotal Cloud Foundry (PCF) Elastic Runtime before 1.6...7.4 High
- ibm filenet workplaceOpen redirect vulnerability in IBM FileNet Workplace 4.0.2 before 4.0.2.14 allows remote...6.8 Medium
- python, debian linux, fedoraproject fedora +2 moreThe CGIHandler class in Python before 2.7.12 does not protect against the HTTP_PROXY variable...6.1 Medium
- apple safariSafari in Apple iOS before 9.3.3 allows remote attackers to spoof the displayed URL via an HTTP...5.4 Medium
- php, debian linux, drupal +9 more +11 moreHTTP Proxy header vulnerability8.1 High
- jenkins, redhat openshift +1 moreJenkins affected by Open Redirect Vulnerability7.4 High
- drupal, debian linux +1 moreDrupal Open redirect vulnerability in the drupal_goto function7.4 High
- typo3TYPO3 allows remote attackers to embed Flash videos from external domain6.1 Medium
- drupal, jquery update project update, labjs project labjs +2 moreOpen redirect vulnerability in the Overlay module in Drupal 7.x before 7.41, the jQuery Update...6.1 Medium
- apache ambariApache Ambari Open Redirect5.8 Medium
- novius-os novius osOpen redirect vulnerability in Novius OS 5.0.1 (Elche) allows remote attackers to redirect users...5.8 Medium
- silverstripeSilverstripe CMS Open Redirect5.8 Medium
- Show moreLoading…