CWE-601: URL Redirection to Untrusted Site
The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.
Also known as Open Redirect, Cross-site Redirect, Cross-domain Redirect.
A kind of CWE-610 Externally Controlled Reference to a Resource in Another Sphere.
From the CWE List. © The MITRE Corporation.
Newest
- sourcegraphOpen redirect vulnerability in Sourcegraph6.1 Medium
- prestashopOpen redirection when using back parameter of PrestaShop4.1 Medium
- openmrsIn OpenMRS 2.9 and prior, the export functionality of the Data Exchange Module does not properly...6.1 Medium
- openmrsIn OpenMRS 2.9 and prior, he import functionality of the Data Exchange Module does not properly...6.1 Medium
- broadcom ca api developer portal, ca technologies api developer portal +1 moreCA API Developer Portal 4.3.1 and earlier handles 404 requests in an insecure manner, which...6.1 Medium
- broadcom ca api developer portal, ca technologies api developer portal +1 moreCA API Developer Portal 4.3.1 and earlier handles loginRedirect page redirects in an insecure...6.1 Medium
- broadcom ca api developer portal, ca technologies api developer portal +1 moreCA API Developer Portal 4.3.1 and earlier handles homeRedirect page redirects in an insecure...6.1 Medium
- vmware vrealize log insightOpen Redirect vulnerability exists in VMware vRealize Log Insight prior to 8.1.0 due to improper...6.1 Medium
- sap se business objects business intelligence platform, sap businessobjects business intelligence platform +1 moreSAP Business Objects Business Intelligence Platform (AdminTools), versions 4.1, 4.2, allows an...6.1 Medium
- sap se business objects business intelligence platform, sap businessobjects business intelligence platform +1 moreThe open document of SAP Business Objects Business Intelligence Platform, versions 4.1, 4.2,...6.1 Medium
- sap netweaver as abap business server pages, sap se netweaver as abap (business server pages test application it00) +1 moreSAP NetWeaver AS ABAP Business Server Pages Test Application IT00, versions 700, 701, 702, 730,...6.1 Medium
- stormshield network securityStormshield Network Security 310 3.7.10 devices have an auth/lang.html?rurl= Open Redirect...6.1 Medium
- cross domain local storage project domain local storageOpen Redirect in xdLocalStorage6.1 Medium
- rankmath seoThe Rank Math plugin through 1.0.40.2 for WordPress allows unauthenticated remote attackers to...6.1 Medium
- getgrav gravOpen Redirect in Grav6.1 Medium
- revive-adserver revive adserverAn Open Redirect vulnerability was discovered in Revive Adserver version < 5.0.5 and reported by...6.1 Medium
- apache http server, broadcom brocade fabric operating system, canonical ubuntu linux +11 more +13 moreIn Apache HTTP Server 2.4.0 to 2.4.41, redirects configured with mod_rewrite that were intended...6.1 Medium
ecstaticnpmOpen Redirect in ecstaticNo score- centreonOpen redirect via parameter ‘p’ in login.php in Centreon (19.04.4 and below) allows an attacker...6.1 Medium
- [unknown] moodleMoodle open redirect vulnerability3.1 Low
- halvotec raquest** DISPUTED ** An issue was discovered in Halvotec RaQuest 10.23.10801.0. The login page of the...5.2 Medium
- fortinet fortiosAn improper input validation vulnerability in FortiOS 6.2.1, 6.2.0, 6.0.8 and below until 5.4.0...6.1 Medium
- micro focus international service managerThere is an improper restriction of rendered UI layers or frames vulnerability in Micro Focus...5.4 Medium
- mozilla webthings gatewayOpen redirect in Mozilla WebThings Gateway5.4 Medium
- ibm sterling b2b integratorIBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 5.2.6.5 could allow a remote...6.8 Medium
- debian linux, fedoraproject fedora, openidc mod auth openidc +1 more +3 moreA flaw was found in mod_auth_openidc before version 2.4.1. An open redirect issue exists in URLs...6.1 Medium
- netsweeperOpen redirect vulnerability in remotereporter/load_logfiles.php in Netsweeper before 4.0.5 allows...6.1 Medium
- lenovo ez media & backup center ix2, ez media & backup center ix2-dl, ez media \& backup center ix2-dl firmware +1 more +3 moreA vulnerability in the web interface of Lenovo EZ Media & Backup Center, ix2 & ix2-dl version 4.1...6.1 Medium
- telaen project telaenOpen Redirection Vulnerability in the redir.php script in Telaen before 1.3.1 allows remote...6.1 Medium
- oauth2 proxy project proxy, pusher oauth2 proxy +1 moreOpen Redirect in OAuth2 Proxy5.9 Medium
- united-security-providers secure entry serverSecure Entry Server before 4.7.0 contains a URI Redirection vulnerability which could allow...6.1 Medium
- ibm security secret serverIBM Security Secret Server 10.7 could allow a remote attacker to conduct phishing attacks, using...7.4 High
- plonePlone Open Redirect Vulnerability6.1 Medium
- tencent wechatThis vulnerability allows remote attackers redirect users to an external resource on affected...4.3 Medium
- chamilo lmsChamilo LMS through 1.9.10.2 allows a link_goto.php?link_url= open redirect, a related issue to...6.1 Medium
- mybbMyBB before 1.8.22 allows an open redirect on login.6.1 Medium
- verison media athenzAthenz vulnerable to Open Redirect6.1 Medium
- six apart ltd movable type series, sixapart movable type +1 moreOpen redirect vulnerability in Movable Type series Movable Type 7 r.4602 (7.1.3) and earlier ...6.1 Medium
- ricoh limedio, ricoh company, ltd. library information management system limedio +1 moreOpen redirect vulnerability in Library Information Management System LIMEDIO all versions allows...6.1 Medium
- alfasado powercmsOpen redirect vulnerability in PowerCMS 5.12 and earlier (PowerCMS 5.x), 4.42 and earlier ...6.1 Medium
- crushftpCrushFTP through 8.3.0 is vulnerable to credentials theft via URL redirection.6.1 Medium
- zohocorp manageengine adselfservice plusAn open redirect vulnerability was discovered in Zoho ManageEngine ADSelfService Plus 5.x before...6.1 Medium
- apple shazam, shazam-android, shazam-ios +2 moreAn issue existed in the parsing of URL schemes. This issue was addressed with improved URL...6.1 Medium
- zulip serverThe image thumbnailing handler in Zulip Server versions 1.9.0 to before 2.0.8 allowed an open...6.1 Medium
- jboss keycloak keycloakJBoss KeyCloak Open Redirect6.1 Medium
- mediawiki, debian linux +1 morePossible to circumvent title-blacklist6.1 Medium
- microsoft visual studio live share, visual studio 2019, visual studio 2019 version 16.4 (includes 16.0 - 16.3) +1 more +3 moreA spoofing vulnerability exists in Visual Studio Live Share when a guest connected to a Live...6.1 Medium
- jetbrains ktorURL Redirection to Untrusted Site (Open Redirect) in Ktor6.1 Medium
- erlang erlang\/otpinets in Erlang possibly 22.1 and earlier follows RFC 3875 section 4.1.18 and therefore does not...6.1 Medium
- yaws, debian linux +1 moreyaws before 2.0.4 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and...6.1 Medium
- Show moreLoading…