CWE-601: URL Redirection to Untrusted Site
The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.
Also known as Open Redirect, Cross-site Redirect, Cross-domain Redirect.
A kind of CWE-610 Externally Controlled Reference to a Resource in Another Sphere.
From the CWE List. © The MITRE Corporation.
Newest
- readthedocs read the docsRead the Docs before 3.5.1 has an Open Redirect if certain user-defined redirects are used. This...6.1 Medium
- optergy enterprise, proton +1 moreOptergy Proton/Enterprise devices allow Open Redirect.6.1 Medium
- canonical ubuntu linux, fedoraproject fedora, mod auth mellon project auth mellon +1 more +3 moremod_auth_mellon through 0.14.2 has an Open Redirect via the login?ReturnTo= substring, as...6.1 Medium
- moodleMoodle Open Redirect Vulnerability3.1 Low
- ibm security access managerIBM Security Access Manager 9.0.1 through 9.0.6 could allow a remote attacker to conduct phishing...6.8 Medium
- forgerock access management, openam +1 moreOAuth 2.0 Authorization Server of ForgeRock Access Management (OpenAM) 13.5.0-13.5.1 and Access...6.1 Medium
- pivotal software spring security oauth, spring security oauth, oracle banking corporate lending +2 moreOpen Redirector in spring-security-oauth24.2 Medium
- micro focus solutions business managerMicro Focus Solution Business Manager versions prior to 11.4.2 is susceptible to open redirect.6.1 Medium
- ibm jazz for service managementIBM Jazz for Service Management 1.1.3, 1.1.3.1, and 1.1.3.2 could allow a remote attacker to...7.4 High
- fortinet fortiosA Host Header Redirection vulnerability in Fortinet FortiOS all versions below 6.0.5 under SSL...6.1 Medium
- samsung galaxy s9, galaxy s9 firmware +1 moreThis vulnerability allows remote attackers to execute arbitrary code on vulnerable installations...6.5 Medium
- odooOdoo Version <= 8.0-20160726 and Version 9 is affected by: CWE-601: Open redirection. The impact...5.4 Medium
- gitlabAn Improper Input Validation issue was discovered in GitLab Community and Enterprise Edition...7.5 High
- cybozu garoon, cybozu, inc. cybozu garoon +1 moreOpen redirect vulnerability in Cybozu Garoon 4.2.4 to 4.10.1 allows remote attackers to redirect...6.1 Medium
- gitlabAn Open Redirect issue was discovered in GitLab Community and Enterprise Edition before 11.7.8,...6.1 Medium
- bosch video management system, video recording manager, divar ip 2000 firmware +1 more +3 moreAn Open Redirect vulnerability located in the webserver affects several Bosch hardware and...6.1 Medium
- seagate nas osArbitrary Redirect in echo-server.html in Seagate NAS OS version 4.3.15.1 allows attackers to...6.1 Medium
- revive adserver, revive-adserver revive adserver +1 moreA user having access to the UI of a Revive Adserver instance could be tricked into clicking on a...5.4 Medium
- google chrome, debian linux, fedoraproject fedora +2 more +4 moreInsufficient policy enforcement in service workers in Google Chrome prior to 74.0.3729.108...5.4 Medium
- polarisft intellect core bankingAn issue was discovered in the Core and Portal modules in Polaris FT Intellect Core Banking 9.7.1...6.1 Medium
- ibm storediqIBM StoredIQ 7.6 could allow a remote attacker to conduct phishing attacks, using an open...7.4 High
- cloudfoundry uaa release, cloud foundry uaa release (oss), pivotal application service +2 moreUAA redirect-uri allows wildcard in the subdomain8.7 High
- rockwell automation compactlogix 5370 l1 controllers, compactlogix 5370 l2 controllers, compactlogix 5370 l3 controllers +8 more +10 moreIn Rockwell Automation MicroLogix 1400 Controllers Series A, All Versions Series B, v15.002 and...6.1 Medium
- ibm content navigatorIBM Content Navigator 2.0.3 and 3.0CD could allow a remote attacker to conduct phishing attacks,...6.8 Medium
- tibco activematrix bpm, silver fabric enabler, tibco software inc. activematrix bpm distribution for tibco silver fabric +1 more +3 moreTIBCO ActiveMatrix BPM Open Redirect Vulnerability4.7 Medium
- search-guard search guardThe floragunn Search Guard plugin before 6.x-16 for Kibana allows URL injection for login...6.1 Medium
- elggElgg open redirect6.1 Medium
- jupyter notebookJupyter Notebook open redirect vulnerability6.1 Medium
- qasymphony qtest managerqTest Portal in QASymphony qTest Manager 9.0.0 has an Open Redirect via the /portal/loginform...6.1 Medium
- synology web stationMissing custom error page vulnerability in Synology Web Station before 2.1.3-0139 allows remote...7.1 High
- atlassian crowdThe login resource of CrowdId in Atlassian Crowd before version 3.0.2 and from version 3.1.0...6.1 Medium
- jupyter jupyterhub, notebook +1 moreOpen Redirect vulnerability in jupyterhub and notebook6.1 Medium
- [unknown] moodleMoodle Stored HTML in assignment submission comments allowed links to be opened directly4.3 Medium
- ibm content navigatorIBM Content Navigator 3.0CD could allow attackers to direct web traffic to a malicious site. If...6.3 Medium
- canonical ubuntu linux, fedoraproject fedora, mod auth mellon project auth mellon +2 more +4 moreA vulnerability was found in mod_auth_mellon before v0.14.2. An open redirect in the logout URL...5.8 Medium
- get-simple. getsimplecmsGetSimpleCMS 3.3.13 has an Open Redirect via the admin/index.php redirect parameter.6.1 Medium
- opentext documentum webtopXSS and/or a Client Side URL Redirect exists in OpenText Documentum Webtop 5.3 SP2. The parameter...6.1 Medium
- openid connectDoorkeeper-openid_connect contains Open Redirect6.1 Medium
- dotcmsdotCMS before 5.0.2 has open redirects via the html/common/forward_js.jsp FORWARD_URL parameter...6.1 Medium
- pivotal software spring security oauth, spring security oauth, oracle banking corporate lending +2 moreOpen Redirect in spring-security-oauth26.5 Medium
- microsoft office, excel viewer, office compatibility pack +3 more +5 moreA security feature bypass vulnerability exists when Microsoft Office does not validate URLs.An...5.5 Medium
- ibm cloud privateIBM Cloud Private 3.1.1 could allow a remote attacker to conduct phishing attacks, using an open...6.8 Medium
- ibm infosphere information governance catalog, infosphere information server on cloud +1 moreIBM InfoSphere Information Governance Catalog 11.3, 11.5, and 11.7 could allow a remote attacker...7.4 High
- avinetworks avi vantageAvi Vantage before 17.2.13 uses an invalid URL encoding during a redirect operation, aka AV-33959.6.1 Medium
- zabbix, debian linux +1 moreZabbix before 2.2.21rc1, 3.x before 3.0.13rc1, 3.1.x and 3.2.x before 3.2.10rc1, and 3.3.x and 3...6.1 Medium
- openam consortium (open source edition), osstech openam +1 moreOpen redirect vulnerability in OpenAM (Open Source Edition) 13.0 allows remote attackers to...6.1 Medium
- labkey server, tenable labkey server community edition +1 moreAn open redirect vulnerability in LabKey Server Community Edition before 18.3.0-61806.763 via the...6.1 Medium
- kaine wise chatThe Wise Chat plugin before 2.7 for WordPress mishandles external links because rendering/filters...6.1 Medium
- ec-cubeEC-CUBE Open redirect vulnerability6.1 Medium
- thimpress learnpressOpen redirect vulnerability in LearnPress prior to version 3.1.0 allows remote attackers to...6.1 Medium
- Show moreLoading…