CWE-601: URL Redirection to Untrusted Site
The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.
Also known as Open Redirect, Cross-site Redirect, Cross-domain Redirect.
A kind of CWE-610 Externally Controlled Reference to a Resource in Another Sphere.
From the CWE List. © The MITRE Corporation.
Newest
- flask-user project flask-userOpen Redirect5.4 Medium
- zimbra collaborationAn issue was discovered in ProxyServlet.java in the /proxy servlet in Zimbra Collaboration Suite...9.8 Critical
- zimbra collaborationAn open redirect vulnerability exists in the /preauth Servlet in Zimbra Collaboration Suite...6.1 Medium
- php-fusionThe component /php-fusion/infusions/shoutbox_panel/shoutbox_archive.php in PHP-Fusion 9.03.60...5.4 Medium
- jenkins cas, jenkins project cas plugin +1 moreOpen redirect vulnerability in Jenkins CAS Plugin6.1 Medium
- andrewburian powermuxURL Redirection to Untrusted Site ('Open Redirect') in github.com/AndrewBurian/powermux4.7 Medium
- machformMachform prior to version 16 is vulnerable to an open redirect in Safari_init.php due to an...6.1 Medium
- umbraco cmsUmbraco CMS before 7.15.7 is vulnerable to Open Redirection due to insufficient url sanitization...6.1 Medium
- avaya aura experience portal, experience portal +1 moreURL redirection to untrusted site possible in Avaya Aura Experience Portal4.4 Medium
- get-simple getsimplecmsGetSimpleCMS <=3.3.15 has an open redirect in admin/changedata.php via the redirect function to...6.1 Medium
- gitpodUnvalidated redirects6.1 Medium
- kaspersky lab vanilla forumsIt was found in vanilla forums before 2.0.10 a potential linkbait vulnerability in dispatcher.6.1 Medium
- asken, asken inc. あすけんダイエット (asken diet) for android +1 moreImproper authorization in handler for custom URL scheme vulnerability in ????????? (asken diet)...6.1 Medium
- advantech webaccess\/scadaAdvantech WebAccess/SCADA Versions 9.0.1 and prior is vulnerable to redirection, which may allow...6.1 Medium
- posimyth the plus addons for elementor, unknown the plus addons for elementor page builder +1 moreThe Plus Addons for Elementor Page Builder < 4.1.10 - Open Redirect6.1 Medium
- flask unchained project unchainedOpen Redirect5.4 Medium
- zblogcn z-blogphpOpen Redirect in Z-BlogPHP v1.5.2 and earlier allows remote attackers to obtain sensitive...6.1 Medium
- chiyu-tech bf-430 firmware, bf-431 firmware, bf-450m firmware +11 more +13 moreAn open redirect vulnerability exists in BF-630, BF-450M, BF-430, BF-431, BF631-W, BF830-W,...6.1 Medium
- cisco webex meetings server, webex meetings online +1 moreCisco Webex Meetings and Webex Meetings Server File Redirect Vulnerability4.7 Medium
- apache dubboOpen Redirect or SSRF vulnerability usage of parseURL6.1 Medium
- tenancy multi-tenantOpen Redirect in tenancy4.3 Medium
- trailing-slash project trailing-slashOpen Redirect5.4 Medium
- cisco finesse, unified contact center express +1 moreCisco Finesse Open Redirect Vulnerability4.7 Medium
- prometheusArbitrary redirects under /new endpoint6.5 Medium
- smartstore smartstorenetSmartstore (aka SmartStoreNET) before 4.1.0 allows CommonController.ClearCache,...6.1 Medium
- flask-middleware flask-securityOpen Redirect Vulnerability3.1 Low
- koa-remove-trailing-slashes project koa-remove-trailing-slashesOpen Redirect5.4 Medium
- acymailing, acymailing newsletter via smtp, sendinblue, sendgrid, mailgun - acymailing smtp newsletter +1 moreAcyMailing < 7.5.0 - Unauthenticated Open Redirect6.1 Medium
- sap gui for windowsIn specific situations SAP GUI for Windows, versions - 7.60, 7.70 forwards a user to specific...3.4 Low
- cisco integrated management controller, c125 m5 firmware, c220 m5 firmware +23 more +25 moreCisco Integrated Management Controller Open Redirect Vulnerability4.7 Medium
- rails https://github.com/rails/rails, rubyonrails rails +1 morePossible Open Redirect Vulnerability in Action Pack6.1 Medium
- opnsenseAn open redirect issue was discovered in OPNsense through 20.1.5. The redirect parameter "url" in...6.1 Medium
- arubanetworks airwaveA remote URL redirection vulnerability was discovered in Aruba AirWave Management Platform...6.1 Medium
- gnu wget, broadcom brocade fabric operating system firmware, netapp 500f firmware +3 more +5 moreGNU Wget through 1.21.1 does not omit the Authorization header upon a redirect to a different...6.1 Medium
- homeautomation project homeautomationIn HomeAutomation 3.3.2 input passed via the 'redirect' GET parameter in 'api.php' script is not...6.1 Medium
- apache supersetApache Superset Open Redirect6.1 Medium
- autheliaAuthelia allows open redirects on the logout endpoint5.7 Medium
- element-hq synapse, fedoraproject fedora +1 moreOpen redirect via transitional IPv6 addresses on dual-stack networks6.3 Medium
- kiboit phastpressPhastPress < 1.111 - Open Redirect6.1 Medium
- ninjaforms ninja forms, unknown ninja forms contact form – the drag and drop form builder for wordpress +1 moreNinja Forms < 3.4.34 - Administrator Open Redirect6.1 Medium
- apple macos, macos server +1 moreAn issue existed in the parsing of URLs. This issue was addressed with improved input validation....6.1 Medium
- pomeriumpomerium_signature is not verified in middleware in github.com/pomerium/pomerium6.1 Medium
- pomeriumJWT leak via Open Redirect in Programmatic access6.1 Medium
- episerver findAn Open Redirect vulnerability in EpiServer Find before 13.2.7 allows an attacker to redirect...6.1 Medium
- ilch cmsAn open redirect vulnerability in Ilch CMS version 2.1.42 allows attackers to redirect users to...5.4 Medium
- tableau serverTableau Server fails to validate certain URLs that are embedded in emails sent to Tableau Server...6.1 Medium
- mcafee epolicy orchestrator, mcafee,llc mcafee epolicy orchestrator (epo) +1 moreMcAfee ePO unvalidated URL redirect vulnerability6.3 Medium
- vivo appstoreAppStore Remote Download and Installation Vulnerability8.2 High
- openmicroscopy omero.web, ome omero-web +1 moreOpen Redirect in OMERO.web4.8 Medium
- typo3, typo3 typo3.cms +1 moreOpen Redirection in Login Handling4.7 Medium
- Show moreLoading…