CWE-601: URL Redirection to Untrusted Site
The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.
Also known as Open Redirect, Cross-site Redirect, Cross-domain Redirect.
A kind of CWE-610 Externally Controlled Reference to a Resource in Another Sphere.
From the CWE List. © The MITRE Corporation.
Newest
- fedora project infrastructure python-fedorapython-fedora vulnerable to an open redirect resulting in loss of CSRF protection6.1 Medium
- ellucian banner studentOpen redirect vulnerability in Ellucian (formerly SunGard) Banner Student 8.5.1.2 through 8.7...6.1 Medium
- ibm emptoris sourcingIBM Emptoris Sourcing 9.5 - 10.1.3 could allow a remote attacker to conduct phishing attacks,...6.1 Medium
- ibm emptoris sourcingIBM Emptoris Sourcing 9.5 - 10.1.3 could allow a remote attacker to conduct phishing attacks,...5.4 Medium
- crushftpCrushFTP before 7.8.0 and 8.x before 8.2.0 has a redirect vulnerability.6.1 Medium
- ibm curam social program management, cram social program management +1 moreIBM Curam Social Program Management 6.0, 6.1, 6.2, and 7.0 could allow a remote attacker to...6.1 Medium
- ibm security access manager, security access manager for web, security access manager for mobile +3 more +5 moreIBM Security Access Manager 6.1, 7.0, 8.0, and 9.0 e-community configurations may be affected by...6.1 Medium
- adobe flash player, flash player desktop runtime, redhat enterprise linux +2 more +4 moreAdobe Flash Player versions 26.0.0.137 and earlier have a security bypass vulnerability that...7.4 High
- git-scm gitA malicious third-party can give a crafted "ssh://..." URL to an unsuspecting victim, and an...8.8 High
- ibm emptoris supplier lifecycle management, emptoris strategic supply management +1 moreIBM Emptoris Supplier Lifecycle Management 10.0.x and 10.1.x could allow a remote attacker to...5.4 Medium
- ibm emptoris supplier lifecycle management, emptoris strategic supply management +1 moreIBM Emptoris Supplier Lifecycle Management 10.0.x and 10.1.x could allow a remote attacker to...5.4 Medium
- xoopsXOOPS Core 2.5.8 has a stored URL redirect bypass vulnerability in /modules/profile/index.php...6.1 Medium
- thycotic secret serverThe share function in Thycotic Secret Server before 10.2.000019 mishandles the Back Button,...5.4 Medium
- metinfo project metinfoThere is URL Redirector Abuse in MetInfo through 5.3.17 via the gourl parameter to member/login.php.6.1 Medium
- ibm rational rhapsody design manager, rhapsody design manager +1 moreIBM Rhapsody DM 5.0 and 6.0 could allow a remote attacker to conduct phishing attacks, using an...5.4 Medium
- finecmsdayrui FineCms 5.0.9 has URL Redirector Abuse via the url parameter in a sync action, related to...6.1 Medium
- ibm bigfix family, bigfix platform +1 moreIBM Tivoli Endpoint Manager could allow a remote attacker to conduct phishing attacks, using an...6.1 Medium
- oauth2 proxy project proxyOpen Redirect in oauth2_proxy6.1 Medium
- koozali sme serverKoozali Foundation SME Server versions 8.x, 9.x, 10.x are vulnerable to an open URL redirect...6.1 Medium
- phpmyadminphpMyAdmin Open Redirect6.1 Medium
- ibm emptoris sourcingIBM Emptoris Sourcing 9.5.x through 10.1.x could allow a remote attacker to conduct phishing...5.4 Medium
- ibm emptoris sourcingIBM Emptoris Sourcing 9.5.x through 10.1.x could allow a remote attacker to conduct phishing...6.1 Medium
- microsoft exchange server, microsoft corporation exchange server 2010 sp3, exchange server 2013 sp3, exchange server 2013 cu16, and exchange server 2016 cu5. +1 moreMicrosoft Exchange Server 2010 SP3, Exchange Server 2013 SP3, Exchange Server 2013 CU16, and...6.1 Medium
- ibm websphere commerce enterprise, websphere commerce +1 moreIBM WebSphere Commerce Enterprise, Professional, Express, and Developer 6.0, 7.0, and 8.0 could...6.1 Medium
- w3 eden, inc. wordpress download manager, w3eden download manager +1 moreOpen redirect vulnerability in WordPress Download Manager prior to version 2.9.51 allows remote...6.1 Medium
- emc rsa archer egrcEMC RSA Archer 5.4.1.3, 5.5.3.1, 5.5.2.3, 5.5.2, 5.5.1.3.1, 5.5.1.1 is affected by an open...6.1 Medium
- bbraun station firmwareAn open redirect issue was discovered in B. Braun Medical SpaceCom module, which is integrated...6.1 Medium
- elastic kibana, x-pack security +1 moreWith X-Pack installed, Kibana versions before 5.3.1 have an open redirect vulnerability on the...6.1 Medium
- elastic kibanaKibana versions before 4.6.3 and 5.0.1 have an open redirect vulnerability that would enable an...6.1 Medium
- piwigoAn open redirect vulnerability is present in Piwigo 2.9 and probably prior versions, allowing...6.1 Medium
- cisco unified communications domain managerA vulnerability in the web-based GUI of Cisco Unified Communications Domain Manager could allow...6.1 Medium
- fenrir inc. sleipnir 4 black edition for mac, sleipnir 4 for mac, fenrir-inc sleipnir +2 moreSleipnir 4 Black Edition for Mac 4.5.3 and earlier and Sleipnir 4 for Mac 4.5.3 and earlier (Mac...6.1 Medium
- hitachi device managerOpen Redirect vulnerability in Hitachi Device Manager before 8.5.2-01 allows remote attackers to...6.1 Medium
- hitachi device managerOpen Redirect vulnerability in Hitachi Device Manager before 8.5.2-01 and Hitachi Tuning Manager...6.1 Medium
- fortinet fortiportal, fortinet, inc. fortinet fortiportal +1 moreAn open redirect vulnerability in Fortinet FortiPortal 4.0.0 and below allows attacker to execute...6.1 Medium
- fortinet fortianalyzer firmware, fortimanager firmware, fortianalyzer, fortimanager +1 more +3 moreAn Open Redirect vulnerability in Fortinet FortiAnalyzer 5.4.0 through 5.4.2 and FortiManager 5.4...6.1 Medium
- cloudfoundry cf-release, cloud foundry, pivotal software cloud foundry elastic runtime +1 more +3 moreWith Cloud Foundry Runtime cf-release versions v209 or earlier, UAA Standalone versions 2.2.6 or...6.1 Medium
- ibm business process manager, business process manager advanced +1 moreIBM Business Process Manager 8.0 and 8.5 could allow a remote attacker to conduct phishing...5.4 Medium
- apple iphone os, mac os x +1 moreAn issue was discovered in certain Apple products. iOS before 10.3.2 is affected. macOS before 10...6.1 Medium
- apache juddiModerate severity vulnerability that affects org.apache.juddi:juddi-client6.1 Medium
- wordpress, debian linux +1 moreIn WordPress before 4.7.5, there is improper handling of post meta data values in the XML-RPC API.8.6 High
- wow new media moodboard liteOpen redirect vulnerability in the proxyimages function in wowproxy.php in the Wow Moodboard Lite...6.1 Medium
- splunk, splunk enterprise, splunk inc. light +2 moreOpen redirect vulnerability in Splunk Enterprise 6.4.x prior to 6.4.3, Splunk Enterprise 6.3.x...6.1 Medium
- splunk, splunk enterprise, splunk inc. light +2 moreOpen redirect vulnerability in Splunk Enterprise 6.4.x prior to 6.4.2, Splunk Enterprise 6.3.x...6.1 Medium
- broadcom advanced secure gateway, symantec corporation asg, proxysg +1 more +3 moreSymantec Advanced Secure Gateway (ASG) 6.6, ASG 6.7 prior to 6.7.2.1, ProxySG 6.5 prior to 6.5.10...6.1 Medium
- ibm websphere portalIBM WebSphere Portal 8.5 and 9.0 could allow a remote attacker to conduct phishing attacks, using...8.8 High
- opsviewOpen redirect vulnerability in Opsview Monitor Pro (Prior to 5.1.0.162300841, prior to 5.0.2...6.1 Medium
- proxmox mail gatewayOpen redirect vulnerability in Proxmox Mail Gateway prior to hotfix 4.0-8-097d26a9 allows remote...6.1 Medium
- oracle applications frameworkVulnerability in the Oracle Applications Framework component of Oracle E-Business Suite ...5.4 Medium
- opera mini, browser +1 moreOpera Mini 13 and Opera Stable 36 allow remote attackers to spoof the displayed URL via a crafted...6.1 Medium
- Show moreLoading…