CWE-601: URL Redirection to Untrusted Site
The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.
Also known as Open Redirect, Cross-site Redirect, Cross-domain Redirect.
A kind of CWE-610 Externally Controlled Reference to a Resource in Another Sphere.
From the CWE List. © The MITRE Corporation.
Newest
- epson ds-570w firmware, ds-780n firmware, ep-10va firmware +56 more +58 moreOpen redirect vulnerability in SEIKO EPSON printers and scanners (DS-570W firmware versions...6.1 Medium
- pivotal concoursePivotal Concourse allows malicious redirect urls on login7.6 High
- sensiolabs symfony, debian linux, fedoraproject fedora +2 moreSymfony Open Redirect6.1 Medium
- schneider electric se embedded web servers in all modicon m340, premium, quantum plcs and bmxnor0200, schneider-electric modicom bmxnor0200h firmware, modicom m340 firmware +2 more +4 moreA URL Redirection to Untrusted Site vulnerability exists in the embedded web servers in all...6.1 Medium
- schneider-electric ecostruxure energy expert, ecostruxure power monitoring expert, ecostruxure power scada operation +1 more +3 moreA URL redirection vulnerability exists in Power Monitoring Expert, Energy Expert (formerly Power...6.1 Medium
- siemens simatic wincc runtime, simatic hmi comfort outdoor panels firmware, simatic hmi comfort panels firmware +10 more +12 moreA vulnerability has been identified in SIMATIC HMI Comfort Panels 4" - 22" (All versions < V15...8.1 High
- ibm curam social program managementIBM Curam Social Program Management 6.0.5, 6.1.1, 6.2.0, 7.0.1, and 7.0.3 could allow a remote...6.8 Medium
- ninjaforms ninja formsAn open redirect in the Ninja Forms plugin before 3.3.19.1 for WordPress allows Remote Attackers...6.1 Medium
- dell avamar, emc avamar, emc integrated data protection appliance +2 more +4 moreDell EMC Avamar and Integrated Data Protection Appliance Open Redirection Vulnerability6.1 Medium
- access manager manager, microfocus access manager +1 moreAn open redirect vulnerability exists in the Access Manager Identity Provider prior to 4.4 SP3.6.1 Medium
- sap netweaver, netweaver (forums) +1 moreDue to insufficient URL Validation in forums in SAP NetWeaver versions 7.30, 7.31, 7.40, an...6.1 Medium
- keycloakKeycloak Open Redirect6.1 Medium
- atlassian jira, jira server +1 moreMany resources in Atlassian Jira before version 7.6.9, from version 7.7.0 before version 7.7.5,...6.1 Medium
- atlassian jira, jira server +1 moreThe XsrfErrorAction resource in Atlassian Jira before version 7.6.9, from version 7.7.0 before...6.1 Medium
- sv3c h.264 poe ip camera firmwareThe SV3C HD Camera (L-SERIES V2.3.4.2103-S50-NTD-B20170508B and V2.3.4.2103-S50-NTD-B20170823B)...6.1 Medium
- vbulletinvBulletin 5.4.3 has an Open Redirect.6.1 Medium
- cisco emergency responder, unified communications manager, unity connection +1 more +3 moreMultiple Cisco Unified Communications Products Open Redirect Vulnerability5.4 Medium
- apache tomcat, canonical ubuntu linux, debian linux +12 more +14 moreApache Tomcat Open Redirect vulnerability4.3 Medium
- btiteam xbtitAn issue was discovered in BTITeam XBTIT 2.5.4. The "returnto" parameter of account_change.php is...6.1 Medium
- dell emc unity, unityvsa, dell emc unity firmware +1 more +3 moreDell EMC Unity and UnityVSA versions prior to 4.3.1.1525703027 contains a URL Redirection...8.3 High
- ibm platform symphony, spectrum symphony +1 moreIBM Platform Symphony 7.1 Fix Pack 1 and 7.1.1 and IBM Spectrum Symphony 7.1.2 and 7.2.0.2 could...6.8 Medium
- ibm websphere portalIBM WebSphere Portal 7.0, 8.0, 8.5, and 9.0 could allow a remote attacker to conduct phishing...7.4 High
- oracle webcenter interactionAn issue was discovered in Oracle WebCenter Interaction Portal 10.3.3. The login function of the...6.1 Medium
- feed statistics project statisticsThe Feed Statistics plugin before 4.0 for WordPress has an Open Redirect via the feed-stats-url...6.1 Medium
- f5 big-ip apm, big-ip access policy manager +1 moreOn BIG-IP APM 11.6.0-11.6.3, an insecure AES ECB mode is used for orig_uri parameter in an...6.1 Medium
- eventum project eventumEventum before 3.4.0 has an open redirect vulnerability.6.1 Medium
- cremecrmAn issue was discovered in Creme CRM 1.6.12. The value of the cancel button uses the content of...6.1 Medium
- ivanti connect secure, pulsesecure pulse connect secure, pulse policy secure +2 moredownload.cgi in Pulse Secure Pulse Connect Secure 8.1RX before 8.1R13 and 8.3RX before 8.3R4 and...6.1 Medium
- sympa, debian linux +1 moresympa version 6.2.16 and later contains a CWE-601: URL Redirection to Untrusted Site ('Open...6.1 Medium
- btiteam xbtitAn issue was discovered in BTITeam XBTIT. The "returnto" parameter of the login page is...6.1 Medium
- hackerone url-parseOpen Redirect in url-parse10.0 Critical
- microfocus edirectory, micro focus netiq edirectory versions prior to 9.1.1 hf1 +1 moreUnvalidated redirect vulnerability in in NetIQ eDirectory before 9.1.1 HF1.6.1 Medium
- gogsOpen Redirect6.1 Medium
- hewlett packard enterprise hpe xp p9000 command view advanced edition software (cvae), hp xp 9000 command view +1 moreHPE XP P9000 Command View Advanced Edition Software (CVAE) has open URL redirection vulnerability...6.1 Medium
- hp icewall sso, hewlett packard enterprise hpe icewall dfw +1 moreA security vulnerability in HPE IceWall SSO Dfw 10.0 and 11.0 on RHEL, HP-UX, and Windows could...9.1 Critical
- djangoproject django, canonical ubuntu linux, debian linux +2 moreDjango open redirect6.1 Medium
- goodoldweb orange forumviews/auth.go in Orange Forum 1.4.0 allows Open Redirection via the next parameter to /login or ...6.1 Medium
- pagekitPagekit open redirect vulnerability6.1 Medium
- ibm inotesOpen redirect vulnerability in IBM iNotes before 8.5.3 Fix Pack 6 and 9.x before 9.0.1 allows...6.1 Medium
- fortinet fortianalyzer, fortimanager, fortimanager, fortianalyzer +1 more +3 moreAn open redirect vulnerability in Fortinet FortiManager 6.0.0, 5.6.5 and below versions,...6.1 Medium
- redirectionRedirection version 2.7.3 contains a ACE via file inclusion vulnerability in Pass-through mode...7.2 High
- cloud foundry uaa, pivotal software cloud foundry uaa, cloud foundry uaa-release +2 moreCloud Foundry UAA open redirect6.1 Medium
- sensiolabs symfony, debian linux +1 moreSymfony Open Redirect6.1 Medium
- sensiolabs symfony, debian linux +1 moreSymfony Open Redirect6.1 Medium
- st project st, hackerone st node module +1 moreOpen Redirect in st6.1 Medium
- hclsoftware connectionsIBM Connections 5.0, 5.5, and 6.0 could allow a remote attacker to conduct phishing attacks,...6.8 Medium
- hackerone hektoOpen Redirect in hekto6.1 Medium
- citrix xenmobile serverThere are Open Redirect Vulnerabilities in Citrix XenMobile Server 10.8 before RP2 and 10.7...6.1 Medium
- cloudera hueOpen redirect vulnerability in Cloudera HUE before 3.10.0 allows remote attackers to redirect...6.1 Medium
- iliasILIAS 5.1.x, 5.2.x, and 5.3.x before 5.3.5 redirects a logged-in user to a third-party site via...6.1 Medium
- Show moreLoading…