CWE-601: URL Redirection to Untrusted Site
The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.
Also known as Open Redirect, Cross-site Redirect, Cross-domain Redirect.
A kind of CWE-610 Externally Controlled Reference to a Resource in Another Sphere.
From the CWE List. © The MITRE Corporation.
Newest
- moodleA vulnerability was found in Moodle 3.7 to 3.7.1, 3.6 to 3.6.5, 3.5 to 3.5.7 and earlier...6.1 Medium
- moodleA vulnerability was found in Moodle 3.7 to 3.7.1, 3.6 to 3.6.5, 3.5 to 3.5.7 and earlier...6.1 Medium
- sap netweaver application server java, sap se netweaver application server java (applications based on web dynpro java) +1 moreSAP Netweaver Application Server Java (Applications based on WebDynpro Java) versions 7.00, 7.10,...4.7 Medium
- inetsoftware i-net clear reportsI-Net Software Clear Reports 20.10.136 web application accepts a user-controlled input that...6.1 Medium
- zope products.pluggableauthserviceURL Redirection to Untrusted Site ('Open Redirect') in Products.PluggableAuthService5.7 Medium
- mozilla pollbotOpen redirect in pollbot7.4 High
- element-hq synapse, fedoraproject fedora +1 moreOpen redirects on some federation and push requests3.1 Low
- aio-libs aiohttp, debian linux, fedoraproject fedora +2 moreOpen redirect vulnerability in aiohttp3.1 Low
- asus askey rtf8115vw firmwareAskey RTF8115VW BR_SV_g11.11_RTF_TEF001_V6.54_V014 devices allow injection of a Host HTTP header.6.1 Medium
- mbconnectline mbconnect24, mymbconnect24 +1 moreAn issue was discovered in MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 through 2.6.2. There is...6.1 Medium
- f5 big-ip advanced web application firewall, big-ip application security manager +1 moreOn BIG-IP Advanced WAF and ASM version 15.1.x before 15.1.0.2, 15.0.x before 15.0.1.4, 14.1.x...6.1 Medium
- fedoraproject fedora, rails https://github.com/rails/rails, rubyonrails rails +2 moreActionpack Open Redirect Vulnerability6.1 Medium
- keycloak, redhat openshift application runtimes, single sign-on +1 more +3 moreOIDC Logout redirect in keycloak3.3 Low
- open-emr openemr, phpgacl +1 moreAn open redirect vulnerability exists in the return_page redirection functionality of phpGACL 3.3...6.1 Medium
- sap web dynpro abap, sap se netweaver as abap (web dynpro abap) +1 moreSAP Web Dynpro ABAP allow an attacker to redirect users to a malicious site due to Reverse...4.7 Medium
- sap ui5SAP UI5, versions - 1.38.49, 1.52.49, 1.60.34, 1.71.31, 1.78.18, 1.84.5, 1.85.4, 1.86.1, allows...4.7 Medium
- b2evolutionOpen redirect vulnerability in b2evolution CMS version prior to 6.11.6 allows an attacker to...6.1 Medium
- google slashifyOpen redirect in Slashify6.1 Medium
- jetbrains hubIn JetBrains Hub before 2020.1.12629, an open redirect was possible.6.1 Medium
- oauth2 proxy project proxy, oauth2-proxy +1 moreSubdomain checking of whitelisted domains could allow unintended redirects4.7 Medium
- rsa archerArcher before 6.8 P2 (6.8.0.2) is affected by an open redirect vulnerability. A remote privileged...4.6 Medium
- keycloak gatekeeper project gatekeeper, louketo keycloak gatekeeper, redhat mobile application platform +2 moreThe logout endpoint /oauth/logout?redirect=url can be abused to redirect logged in users to...6.1 Medium
- revive-adserver revive adserverRevive Adserver before 5.1.0 is vulnerable to open redirects via the `dest`, `oadest`, and/or ...6.1 Medium
- cisco smart software manager on-premCisco Smart Software Manager Satellite Open Redirect Vulnerability4.6 Medium
- cisco webex meetingsCisco Webex Meetings Open Redirect Vulnerability4.7 Medium
- dell wyse management suiteDell Wyse Management Suite versions prior to 3.1 contain an open redirect vulnerability. A remote...6.1 Medium
- changing inc. nhiservisignadapterCHANGING Inc. NHIServiSignAdapter Windows Versions - Information Leakage -27.5 High
- changing inc. nhiservisignadapterCHANGING Inc. NHIServiSignAdapter Windows Versions - Information Leakage -17.5 High
- crossbar autobahnOpen Redirect in autobahn6.1 Medium
- f5 big-ip apm, big-ip access policy manager +1 moreIn versions 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, 14.1.0-14.1.3, 13.1.0-13.1.3.4, 12.1.0-12.1.5.2,...6.1 Medium
- ibm security secret serverIBM Security Secret Server 10.6 could allow a remote attacker to conduct phishing attacks, using...7.4 High
- jupyter server, jupyter-server jupyter server +1 moreOpen redirect vulnerability6.1 Medium
- spiceworksHost Header Injection in Spiceworks 7.5.7.0 allowing the attacker to render arbitrary links that...6.1 Medium
- mitel micollabThe online help portal of Mitel MiCollab before 9.2 could allow an attacker to redirect a user to...6.1 Medium
- ibm tivoli netcool impact, tivoli netcool\/impact +1 moreIBM Tivoli Netcool Impact 7.1.0.0 through 7.1.0.19 Interim Fix 7 could allow a remote attacker to...5.3 Medium
- mozilla firefoxWhen a user typed a URL in the address bar or the search bar and quickly hit the enter key, a...6.1 Medium
- keycloakKeycloak vulnerable to Server-Side Request Forgery5.3 Medium
- sap solution manager, sap se solution manager (trace analysis) +1 moreSAP Solution Manager (Trace Analysis), version - 720, allows for misuse of a parameter in the...3.4 Low
- openstack horizon, debian linux +1 moreOpenStack Horizon Open redirect in workflow forms6.1 Medium
- elastic kibana, redhat openshift container platform +1 moreThe elasticsearch-operator does not validate the namespace where kibana logging resource is created and due to that it is possible to replace the original openshift-logging console link (kibana consol…6.1 Medium
- jupyter server, jupyter-server jupyter server +1 moreOpen redirect in Jupyter Server4.1 Medium
- seeddmsOpen redirect in SeedDMS 6.0.13 via the dropfolderfileform1 parameter to out/out.AddDocument.php.6.1 Medium
- jupyter notebook, debian linux +1 moreOpen redirect in Jupyter Notebook4.4 Medium
- salesagility suitecrmSuiteCRM through 7.11.13 has an Open Redirect in the Documents module via a crafted SVG document.6.1 Medium
- palletsprojects werkzeugOpen Redirect in werkzeug6.1 Medium
- puncsky touchbase.aiOpen Redirect in touchbase.ai4.7 Medium
bitlyshortenerPyPIUpdate bitlyshortener to >=0.5.0 to prevent generating some invalid short URLsNo score- octopus deployIn Octopus Deploy through 2020.4.2, an attacker could redirect users to an external site via a...6.1 Medium
- cisco firepower management center, secure firewall management center +1 moreCisco Firepower Management Center Software Open Redirect Vulnerability4.7 Medium
- sap netweaver application server javaSAP NetWeaver AS Java, versions - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, Start Page allows an...4.7 Medium
- Show moreLoading…