CWE-601: URL Redirection to Untrusted Site
The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.
Also known as Open Redirect, Cross-site Redirect, Cross-domain Redirect.
A kind of CWE-610 Externally Controlled Reference to a Resource in Another Sphere.
From the CWE List. © The MITRE Corporation.
Newest
- iproom mmc+ server, mmc\+ +1 moreIProom MMC+ Server - URL Redirection to Untrusted Site (Open Redirect')6.1 Medium
- fluid-cloudnative fluid, typo3 fluid engine, typo3 +2 moreCross-Site Scripting in TYPO3 Fluid Engine4.7 Medium
- vercel next.jsOpen Redirect in Next.js4.7 Medium
- ory fositeOAuth2 Redirect URL validity does not respect query parameters and character casing for loopback addresses6.1 Medium
- ory fositeRedirect URL matching ignores character casing6.1 Medium
- mozilla firefox, firefox esr, thunderbird +2 more +4 moreBy exploiting an Open Redirect vulnerability on a website, an attacker could have spoofed the...6.1 Medium
- cisco managed services acceleratorCisco Managed Services Accelerator Open Redirect Vulnerability4.7 Medium
- ibm maximo asset management, control desk, maximo asset configuration manager +17 more +19 moreIBM Maximo Asset Management 7.6.0 and 7.6.1 could allow a remote attacker to conduct phishing...6.8 Medium
- yodobashi, yodobashi camera co.,ltd. app for android +1 moreYodobashi App for Android versions 1.8.7 and earlier allows remote attackers to lead a user to...6.1 Medium
apostrophenpmOpen Redirect in apostropheNo score- liferay portalOpen Redirect in Liferay Portal7.5 High
- digital bazaar node-forge, digitalbazaar forge +1 morePrototype Pollution9.8 Critical
- nitori, nitori holdings co., ltd. app for android and nitori app for ios +1 moreNITORI App for Android versions 6.0.4 and earlier and NITORI App for iOS versions 6.0.2 and...6.1 Medium
- joomla joomla\!An issue was discovered in Joomla! before 3.9.21. Lack of input validation in the vote feature of...6.1 Medium
- cybersolutions cybermailOpen redirect vulnerability in CyberMail Ver.6.x and Ver.7.x allows remote attackers to redirect...6.1 Medium
- redhat ovirt-engine, oracle virtualization +1 moreAn Open redirect vulnerability was found in ovirt-engine versions 4.4 and earlier, where it...5.3 Medium
- ibm security guardium insightsIBM Security Guardium Insights 2.0.1 could allow a remote attacker to conduct phishing attacks,...6.5 Medium
- ibm planning analyticsIBM Planning Analytics 2.0 could allow a remote attacker to conduct phishing attacks, using an...6.8 Medium
- containous traefikOpen redirect in Traefik6.1 Medium
- schneider-electric software update utilityA CWE-601: URL Redirection to Untrusted Site ('Open Redirect') vulnerability exists in Schneider...4.7 Medium
- kubernetesPrivilege escalation from compromised node to cluster6.4 Medium
- verint impact 360An issue was discovered in Verint Impact 360 15.1. At wfo/control/signin, the rd parameter can...6.1 Medium
- atlassian jira, jira server +1 moreThe login.jsp resource in Jira before version 8.5.2, and from version 8.6.0 before version 8.6.1...6.1 Medium
- shirasagi project shirasagiOpen redirect vulnerability in SHIRASAGI v1.13.1 and earlier allows remote attackers to redirect...6.1 Medium
- telefonica o2 businessThe O2 Business application 1.2.0 for Android exposes the canvasm.myo2.SplashActivity activity to...6.1 Medium
- oauth2 proxy proxy, pusher oauth2 proxy +1 moreOpen Redirect in OAuth2 Proxy4.3 Medium
- mattermost serverMattermost Server mishandles redirect denial action6.1 Medium
- mattermost serverMattermost Server does not safeguard against phishing via error page links6.1 Medium
- mattermost desktopAn issue was discovered in Mattermost Desktop App before 4.4.0. Attackers can open web pages in...6.1 Medium
- wso2 identity server, identity server as key manager +1 moreAn issue was discovered in WSO2 Identity Server through 5.10.0 and WSO2 IS as Key Manager through...6.1 Medium
- cisco umbrellaCisco Umbrella Open Redirect Vulnerability4.7 Medium
- wordpress, debian linux, fedoraproject fedora +1 more +3 moreOpen redirect in wp_validate_redirect() in WordPress5.7 Medium
- sap fiori, sap se fiori for sap s/4hana +1 moreSAP Fiori for SAP S/4HANA, versions - 100, 200, 300, 400, allows an attacker to redirect users to...5.4 Medium
- microsoft sharepoint enterprise server, sharepoint foundation, sharepoint server +2 moreAn open redirect vulnerability exists in Microsoft SharePoint that could lead to spoofing.To...6.1 Medium
- microsoft edge, edge (chromium-based) in ie mode on windows 10 for 32-bit systems, edge (chromium-based) in ie mode on windows 10 for x64-based systems +30 more +32 moreA spoofing vulnerability exists when theMicrosoft Edge (Chromium-based) in IE Mode improperly...6.1 Medium
- mediawikiMediaWiki Open Redirect vulnerability6.1 Medium
- drupal, drupal core +1 moreDrupal Core Open Redirect vulnerability6.1 Medium
- verbb knock knockKnock Knock plugin Open redirection vulnerability6.1 Medium
- microsoft edge, edge (edgehtml-based) +1 moreMicrosoft Edge Spoofing Vulnerability4.3 Medium
- rcos submittySubmitty through 20.04.01 has an open redirect via authentication/login?old= during an invalid...6.1 Medium
- pivotal concourseConcourse Open Redirect in the /sky/login endpoint7.6 High
- palo alto networks pan-osPAN-OS: GlobalProtect registration open redirect5.3 Medium
- dkd direct mailOpen redirect in direct_mail6.1 Medium
- oauth2 proxy proxy, pusher oauth2 proxy +1 moreOpen Redirect in OAuth2 Proxy7.1 High
- cisco firepower management center, secure firewall management center +1 moreCisco Firepower Management Center Open Redirect Vulnerability4.3 Medium
- cisco content security management appliance (sma), content security management appliance +1 moreCisco Content Security Management Appliance Open Redirect Vulnerabilities6.1 Medium
- glpi-project glpibypass of manageRedirect in GLPI6.1 Medium
- go-macaron macaron, fedoraproject fedora +1 moregopkg.in/macaron.v1 Open Redirect vulnerability6.1 Medium
- dell rsa archer, rsa archer +1 moreRSA Archer, versions prior to 6.7 P1 (6.7.0.1), contain a URL redirection vulnerability. A remote...4.6 Medium
- hcl connectionsHCL Connections v5.5, v6.0, and v6.5 contains an open redirect vulnerability which could be...6.1 Medium
- Show moreLoading…