CWE-601: URL Redirection to Untrusted Site
The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.
Also known as Open Redirect, Cross-site Redirect, Cross-domain Redirect.
A kind of CWE-610 Externally Controlled Reference to a Resource in Another Sphere.
From the CWE List. © The MITRE Corporation.
Newest
- mybbMyBB 1.8.15, when accessed with Microsoft Edge, mishandles 'target="_blank" rel="noopener"' in A...6.1 Medium
- impinj r420 rfid reader firmwareAn issue was discovered on the Impinj Speedway Connect R420 RFID Reader before 2.2.2. The...4.3 Medium
- jenkins google loginJenkins Google Login Plugin Open Redirect vulnerability6.1 Medium
- dell emc rsa authentication manager security console, operation console and self-service console, rsa authentication manager +1 moreRSA Authentication Manager Security Console, Operation Console and Self-Service Console, version...6.1 Medium
- blackboard learnBlackboard Learn (Since at least 17th of October 2017) has allowed Unvalidated Redirects on any...6.1 Medium
- wordpress, debian linux +1 moreBefore WordPress 4.9.5, the URL validator assumed URLs with the hostname localhost were on the...6.1 Medium
- wordpress, debian linux +1 moreBefore WordPress 4.9.5, the redirection URL for the login page was not validated or sanitized if...6.1 Medium
- wolfcms wolf cmsOpen redirect vulnerability in the login[redirect] parameter login functionality in WolfCMS 0.8.3...4.8 Medium
- elastic kibanaThe fix in Kibana for ESA-2017-23 was incomplete. With X-Pack security enabled, Kibana versions...6.1 Medium
- netiq identity managerIDM URL Redirection attack2.1 Low
- open-auditAn issue was discovered in Open-AudIT Professional 2.1. It is possible to inject a malicious...6.1 Medium
- microsoft exchange serverMicrosoft Exchange Server 2010 Service Pack 3 Update Rollup 20, Microsoft Exchange Server 2013...6.5 Medium
- emc rsa archerEMC RSA Archer, versions prior to 6.2.0.8, contains a redirect vulnerability in the QuickLinks...6.1 Medium
- soconnect sowifi hotspot firmwareOpen redirect vulnerability in the SO Connect SO WIFI hotspot web interface, prior to version 140...6.1 Medium
- netiq access managerUnvalidated Redirect in NetIQ Access Manager after upgrading to NAM 4.3 AC and IDP URLs5.4 Medium
- bonitasoft bonita bpm portalMultiple open redirect vulnerabilities in Bonita BPM Portal before 6.5.3 allow remote attackers...6.1 Medium
- drupal, drupal core, drupal.org drupal core +1 more +3 moreDrupal external link injection vulnerability4.7 Medium
- f-secure radarF-Secure Radar (on-premises) before 2018-02-15 has an Unvalidated Redirect via the ReturnUrl...6.1 Medium
- hewlett packard enterprise icewall federation agentA Remote Unauthorized Disclosure of Information vulnerability in HPE IceWall Federation Agent...6.1 Medium
- progress sitefinityAuthenticate/SWT in Progress Sitefinity 9.1 has an open redirect issue in which an authentication...6.1 Medium
- ibm emptoris sourcingOpen redirect vulnerability in IBM Emptoris Sourcing 10.0.0.x before 10.0.0.1_iFix3, 10.0.1.x...5.4 Medium
- simplesamlphpSimpleSAMLphp Open redirection protection bypass6.1 Medium
- apple icloud, itunes, safari +4 more +6 moreAn issue was discovered in certain Apple products. iOS before 11.2 is affected. Safari before 11...6.1 Medium
- groupsessionOpen redirect vulnerability in GroupSession version 4.7.0 and earlier allows an attacker to...6.1 Medium
- vbulletinvBulletin 3.x.x and 4.2.x through 4.2.5 has an open redirect via the redirector.php url parameter.6.1 Medium
- cisco prime infrastructureA vulnerability in the web interface of Cisco Prime Infrastructure could allow an unauthenticated...6.1 Medium
- ibm security access manager, security access manager firmware, security access manager for mobile +1 more +3 moreIBM Security Access Manager Appliance 8.0.0 and 9.0.0 could allow a remote attacker to conduct...6.1 Medium
- ibm security key lifecycle managerIBM Tivoli Key Lifecycle Manager 2.5, 2.6, and 2.7 could allow a remote attacker to conduct...6.1 Medium
- plonePlone Open Redirect6.1 Medium
- ploneProducts.CMFPlone Open Redirect Vulnerability6.1 Medium
- furikake project furikakeWordpress plugin Furikake version 0.1.0 is vulnerable to an Open Redirect The furikake-redirect...6.1 Medium
- ibm maximo asset management, maximo asset management essentials +1 moreIBM Maximo Asset Management 7.5 and 7.6 could allow a remote attacker to conduct phishing attacks...6.1 Medium
- sap startup service, kernel +1 moreURL redirection vulnerability in SAP's Startup Service, SAP KERNEL 32 NUC, SAP KERNEL 32 Unicode,...6.1 Medium
- elastic kibanaThe Kibana fix for CVE-2017-8451 was found to be incomplete. With X-Pack installed, Kibana...6.1 Medium
- google chrome, debian linux, redhat enterprise linux desktop +2 more +4 moreInsufficient policy enforcement in Resource Timing API in Google Chrome prior to 63.0.3239.84...6.5 Medium
- adobe robohelpAdobe RoboHelp has an Open Redirect vulnerability. This affects versions before RH12.0.4.460 and...6.1 Medium
- cisco data center network managerMultiple vulnerabilities in Cisco Data Center Network Manager (DCNM) Software could allow a...6.1 Medium
- phoenixframework phoenixPhoenix Arbitrary URL Redirect6.1 Medium
- microsoft asp.net coreOpen redirect in ASP.NET Core8.8 High
- inedo buildmasterAn Open Redirect vulnerability in Inedo BuildMaster before 5.8.2 allows remote attackers to...6.1 Medium
- zurmo crmAn Open URL Redirect issue exists in Zurmo 3.2.1.57987acc3018 via an http: URL in the redirectUrl...4.8 Medium
- micro focus hp arcsight esm, hp arcsight esm express, hp arcsight enterprise security manager +1 more +3 moreA URL redirection to untrusted site vulnerability in HP ArcSight ESM and HP ArcSight ESM Express,...6.1 Medium
- web2pyOpen redirect vulnerability in gluon/tools.py in Web2py 2.9.11 allows remote attackers to...6.1 Medium
- cloudfoundry cf-release, pivotal routing-release +1 moreIn Cloud Foundry router routing-release all versions prior to v0.163.0 and cf-release all...6.1 Medium
- opentext documentum webtop, documentum administrator +1 moreMultiple open redirect vulnerabilities in OpenText Documentum Webtop 6.8.0160.0073 allow remote...6.1 Medium
- opentext documentum administrator, documentum webtop +1 moreMultiple open redirect vulnerabilities in OpenText Documentum Administrator 7.2.0180.0055 allow...6.1 Medium
- xceedium xsuiteOpen redirect vulnerability in Xsuite 2.4.4.5 and earlier allows remote attackers to redirect...6.1 Medium
- wordpressBefore version 4.8.2, WordPress was susceptible to an open redirect attack in wp-admin/edit-tag...5.4 Medium
- joomla joomla\!Open redirect vulnerability in Joomla! CMS 3.0.0 through 3.4.1.6.1 Medium
- phpbbphpBB Open Redirect6.1 Medium
- Show moreLoading…