CWE-601: URL Redirection to Untrusted Site
The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.
Also known as Open Redirect, Cross-site Redirect, Cross-domain Redirect.
A kind of CWE-610 Externally Controlled Reference to a Resource in Another Sphere.
From the CWE List. © The MITRE Corporation.
Newest
- kubernetes, fedoraproject fedora +1 moreKubernetes API server follows unvalidated redirects from streaming Kubelet endpoints2.6 Low
- gitlabAn issue was discovered in GitLab Community and Enterprise Edition 10.7.4 through 12.4 in the...6.1 Medium
- kaspersky anti-virus, internet security, anti-virus, kaspersky internet security, kaspersky total security, kaspersky free anti-virus, kaspersky small office security, kaspersky security cloud +3 more +5 moreKaspersky Anti-Virus, Kaspersky Internet Security, Kaspersky Total Security, Kaspersky Free Anti...6.1 Medium
- posh project poshOpen redirect vulnerability in the password reset functionality in POSH 3.0 through 3.2.1 allows...6.1 Medium
- openfind mail2000Openfind MAIL2000 Webmail Pre-Auth Open Redirect6.1 Medium
- blackboard learnThe bb-auth-provider-cas authentication module within Blackboard Learn 2018-07-02 is susceptible...6.1 Medium
- [unknown] mod auth openidcmod_auth_openidc before version 2.4.0.1 is vulnerable to a None5.8 Medium
- popojicmsPopojiCMS 2.0.1 allows refer= Open Redirection.6.1 Medium
- ibm security directory serverIBM Security Directory Server 6.4.0 could allow a remote attacker to conduct phishing attacks,...7.4 High
- jetbrains youtrackJetBrains YouTrack versions before 2019.1.52545 allowed unbounded URL whitelisting because of...6.1 Medium
- prise adasAn issue was discovered in PRiSE adAS 1.7.0. The OPENSSO module does not properly check the goto...6.1 Medium
- spip, canonical ubuntu linux, debian linux +2 moreSPIP before 3.1.11 and 3.2 before 3.2.5 mishandles redirect URLs in ecrire/inc/headers.php with a...6.1 Medium
- ain smartbanner.jssmartbanner.js rel noopener XSS vulnerability1.3 Low
- shirasagi project shirasagiOpen redirect vulnerability in SHIRASAGI v1.7.0 and earlier allows remote attackers to redirect...6.1 Medium
- fujixerox apeosware management suite, apeosware management suite 2, fuji xerox co.,ltd. apeosware management suite and apeosware management suite 2 +2 moreOpen redirect vulnerability in ApeosWare Management Suite Ver.1.4.0.18 and earlier, and ApeosWare...6.1 Medium
- cybozu garoon, cybozu, inc. cybozu garoon +1 moreOpen redirect vulnerability in Cybozu Garoon 4.0.0 to 4.10.2 allows remote attackers to redirect...6.1 Medium
- wordpress, debian linux +1 moreIn WordPress before 5.2.3, validation and sanitization of a URL in wp_validate_redirect in wp...6.1 Medium
- alfrescoAn issue was discovered in Alfresco Community Edition versions below 5.2.6, 6.0.N and 6.1.N. The...6.1 Medium
- login or logout menu item project or logout menu itemThe login-or-logout-menu-item plugin before 1.2.0 for WordPress has no requirement for...6.1 Medium
- webcraftic simple 301 redirectsThe simple-301-redirects-addon-bulk-uploader plugin through 1.2.4 for WordPress has no...6.1 Medium
- wpexpertdeveloper wp private content plusThe wp-private-content-plus plugin before 2.0 for WordPress has no protection against option...7.5 High
- components for wp bakery page builder project for wp bakery page builderThe nd-shortcodes plugin before 6.0 for WordPress has a nopriv_ AJAX action that allows...6.1 Medium
- webcraftic simple 301 redirects-addon-bulk uploaderThe simple-301-redirects-addon-bulk-uploader plugin before 1.2.5 for WordPress has no protection...6.1 Medium
- booking project bookingThe nd-booking plugin before 2.5 for WordPress has a nopriv_ AJAX action that allows modification...6.1 Medium
- learning courses project coursesThe nd-learning plugin before 4.8 for WordPress has a nopriv_ AJAX action that allows...6.1 Medium
- travel management project managementThe nd-travel plugin before 1.7 for WordPress has a nopriv_ AJAX action that allows modification...6.1 Medium
- donations project donationsThe nd-donations plugin before 1.4 for WordPress has a nopriv_ AJAX action that allows...6.1 Medium
- watchguard firewareThe authentication applet in Watchguard Fireware 11.11 Operating System has reflected XSS (this...6.1 Medium
- httpieOpen Redirect in httpie8.8 High
- atlassian jira, jira server +1 moreThe ChangeSharedFilterOwner resource in Jira before version 7.13.6, from version 8.0.0 before...6.1 Medium
- atlassian jira, jira server +1 moreThe startup.jsp resource in Jira before version 7.13.6, from version 8.0.0 before version 8.2.3,...6.1 Medium
- floragunn search guard kibana plugin, search-guard search guard +1 moreSearch Guard Kibana Plugin versions before 5.6.8-7 and before 6.x.y-12 had an issue that an...6.1 Medium
- apache http serverIn Apache HTTP server 2.4.0 to 2.4.39, Redirects configured with mod_rewrite that were intended...6.1 Medium
- cisco webex meetings serverCisco Webex Meetings Server Open Redirection Vulnerability4.3 Medium
- jenkins project gitlab authentication plugin, jenkins gitlab oauth +1 moreJenkins Gitlab Authentication Plugin Open Redirect vulnerability6.1 Medium
- cpanelcPanel before 60.0.25 allows an open redirect via /cgi-sys/FormMail-clone.cgi (SEC-162).6.1 Medium
- cpanelcPanel before 64.0.21 allows demo accounts to redirect web traffic (SEC-245).5.0 Medium
- cpanelcPanel before 67.9999.103 allows an open redirect in /unprotected/redirect.html (SEC-300).7.4 High
- happypointcard happypoint, spc cloud happypoint mobile app +1 moreHappypoint mobile application information disclosure vulnerability7.8 High
- cpanelcPanel before 70.0.23 allows an open redirect via the /unprotected/redirect.html endpoint (SEC-392).6.1 Medium
- cpanelcPanel before 78.0.18 offers an open mail relay because of incorrect domain-redirect routing (SEC...4.3 Medium
- cpanelcPanel before 76.0.8 has an open redirect when resetting connections (SEC-462).6.1 Medium
- ash-aioASH-AIO before 2.0.0.3 allows an open redirect.6.1 Medium
- cisco small business 300 series managed switches, sf200-24 firmware, sf200-24fp firmware +55 more +57 moreCisco Small Business Series Switches Open Redirect Vulnerability4.7 Medium
- babel, cmsmadesimple bable\ +1 moreBabel: Multilingual site Babel All is affected by: Open Redirection. The impact is: Redirection...6.1 Medium
- microsoft asp.net coreOpen redirect in ASP.NET Core6.1 Medium
- eventum project eventumAn issue was discovered in Eventum 3.5.0. /htdocs/switch.php has an Open Redirect via the...6.1 Medium
- growi, inc. growiOpen redirect vulnerability in GROWI v3.4.6 and earlier allows remote attackersto redirect users...6.1 Medium
- joruri mail, sitebridge inc. joruri mail +1 moreOpen redirect vulnerability in Joruri Mail 2.1.4 and earlier allows remote attackers to redirect...6.1 Medium
- dotnetblogengine blogengine.netBlogEngine.NET 3.3.7.0 allows a Client Side URL Redirect via the ReturnUrl parameter, related to...6.1 Medium
- Show moreLoading…