CWE-601: URL Redirection to Untrusted Site
The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.
Also known as Open Redirect, Cross-site Redirect, Cross-domain Redirect.
A kind of CWE-610 Externally Controlled Reference to a Resource in Another Sphere.
From the CWE List. © The MITRE Corporation.
Newest
- showdoc, star7th star7th/showdoc +1 moreOpen Redirect in star7th/showdoc6.5 Medium
- cryptshare serverAn open redirect through HTML injection in confidential messages in Cryptshare before 5.1.0...5.4 Medium
- getredash redashVulnerability in Redash OAuth2 flows due to misuse of state field (should be a nonce)6.8 Medium
- dell cloudlink, emc cloud link +1 moreDell EMC CloudLink 7.1 and all prior versions contain a HTML and Javascript Injection...5.4 Medium
- elastic kibanaAn open redirect flaw was found in Kibana versions before 7.13.0 and 6.8.16. If a logged in user...6.1 Medium
- google android, chrome, debian linux +2 more +4 moreInsufficient validation of untrusted input in Intents in Google Chrome on Android prior to 95.0...6.1 Medium
- oppiaOppia 3.1.4 does not verify that certain URLs are valid before navigating to them.6.1 Medium
- cisco webex video mesh, collaboration meeting rooms +1 moreCisco Webex Video Mesh Arbitrary Site Redirection Vulnerability5.4 Medium
- replicated classicAn open redirect vulnerability exists in Replicated Classic versions prior to 2.53.1 that could...6.1 Medium
- cisco firepower management center, firepower management center virtual appliance, secure firewall threat defense +1 more +3 moreCisco Firepower Management Center Software Cross-Site Scripting and Open Redirect Vulnerabilities4.8 Medium
- cisco firepower management center, firepower management center virtual appliance, secure firewall threat defense +1 more +3 moreCisco Firepower Management Center Software Cross-Site Scripting and Open Redirect Vulnerabilities4.8 Medium
- firefly-iii firefly-iii/firefly-iii, firefly iii +1 moreOpen Redirect in firefly-iii/firefly-iii5.0 Medium
- cybozu, inc. cybozu remote service, cybozu remote service manager +1 moreOpen redirect vulnerability in Cybozu Remote Service 3.0.0 to 3.1.9 allows remote attackers to...6.1 Medium
- sonicwall sonicosA Host Header Redirection vulnerability in SonicOS potentially allows a remote attacker to...6.1 Medium
- fastify fastify-staticDOS and Open Redirect with user input8.8 High
- cisco orbitalCisco Orbital Open Redirect Vulnerability4.7 Medium
- fastify fastify-staticURL Redirection to Untrusted Site ('Open Redirect') in fastify-static6.1 Medium
- netscout ngeniusoneNETSCOUT Systems nGeniusONE version 6.3.0 build 1196 allows URL redirection in redirector.5.4 Medium
- place placeos authenticationPlaceOS Authentication Service before 1.29.10.0 allows app/controllers/auth/sessions_controller...6.1 Medium
- f5 big-ip apm, big-ip access policy manager +1 moreOn version 14.1.x before 14.1.4.4 and all versions of 13.1.x, an open redirect vulnerability...6.1 Medium
- micro focus netiq access manager, microfocus access manager +1 moreOpen Redirection vulnerability in NetIQ Access Manager versions prior to version 4.5.4 and 5.0.14.9 Medium
- thoughtbot clearanceOpen Redirect7.6 High
- dpgaspar flask-appbuilderURL Redirection to Untrusted Site ('Open Redirect') in Flask-AppBuilder7.2 High
- eyoucmsEyouCMS 1.5.4 is vulnerable to Open Redirect. An attacker can redirect a user to a malicious url...6.1 Medium
- microfocus network automationOpen Redirect vulnerability in Micro Focus Network Automation, affecting Network Automation...6.1 Medium
- kubernetesHoles in EndpointSlice Validation Enable Host Network Hijack2.7 Low
- debian linux, fedoraproject fedora, openidc mod auth openidc +2 moreURL Redirection to Untrusted Site ('Open Redirect') in mod_auth_openidc4.7 Medium
- kyle phillips nested pagesNested Pages <= 3.1.15 Open Redirect4.7 Medium
- rails https://github.com/rails/rails, rubyonrails rails +1 moreOpen Redirect in ActionPack6.1 Medium
- atlassian data center, jira, jira server +1 more +3 moreAffected versions of Atlassian Jira Server and Data Center allow remote attackers to redirect...4.8 Medium
- apple ipados, macos, tvos +4 more +6 moreModerate: webkit2gtk3 security, bug fix, and enhancement update7.4 High
- nagios xiAn open redirect vulnerability exists in Nagios XI before version 5.8.5 that could lead to...6.1 Medium
- vercel next.jsOpen Redirect in Next.js versions below 11.1.06.9 Medium
- cloudfoundry cf-deployment, user account and authentication +1 moreUAA server versions prior to 75.4.0 are vulnerable to an open redirect vulnerability. A malicious...6.1 Medium
- sap netweaver knowledge management, sap se netweaver (knowledge management) +1 moreSAP NetWeaver Knowledge Management allows remote attackers to redirect users to arbitrary...6.1 Medium
- uninett mod auth mellonA flaw was found in mod_auth_mellon where it does not sanitize logout URLs properly. This issue...6.1 Medium
- liferay portal, digital experience platform +1 moreLiferay Portal and Liferay DXP Allows Arbitrary Redirect of Users to External URLs6.1 Medium
- dell emc idrac9 firmware, integrated dell remote access controller (idrac) +1 moreDell EMC iDRAC9 versions prior to 4.40.40.00 contain an open redirect vulnerability. A remote...6.1 Medium
- dell emc idrac9 firmware, integrated dell remote access controller (idrac) +1 moreDell EMC iDRAC9 versions prior to 4.40.40.00 contain an open redirect vulnerability. A remote...6.1 Medium
- plone isurlinportal, products.isurlinportal +1 moreURL Redirection to Untrusted Site ('Open Redirect') in Products.isurlinportal6.5 Medium
- sylpheed project sylpheed, claws-mail, fedoraproject fedora +2 moretextview_uri_security_check in textview.c in Claws Mail before 3.18.0, and Sylpheed through 3.7.0...6.1 Medium
- dell avamar, emc avamar server +1 moreDell EMC Avamar Server contains an open redirect vulnerability. A remote unauthenticated attacker...6.1 Medium
- groupsession, groupsession bycloud, zion +2 moreOpen redirect vulnerability in GroupSession (GroupSession Free edition from ver2.2.0 to the...6.1 Medium
- unshiftio unshiftio/url-parse, url-parse project url-parse +1 moreOpen Redirect in unshiftio/url-parse5.3 Medium
- fedoraproject fedora, openidc mod auth openidc +1 moreOpen Redirect in oidc_validate_redirect_url()4.7 Medium
- learning digital orca hcmLearningdigital.com, Inc. Orca HCM - URL Redirection to Untrusted Site ('Open Redirect')6.1 Medium
- medialize medialize/uri.js, uri.js project uri.js +1 moreOpen Redirect in medialize/URI.js5.3 Medium
- ibm security verify access docker, security verify access +1 moreIBM Security Verify Access Docker 10.0.0 could allow a remote attacker to conduct phishing...4.5 Medium
- jamfJamf Pro before 10.30.1 allows for an unvalidated URL redirect vulnerability affecting Jamf Pro...6.1 Medium
- gvectors wpforo forumwpForo Forum < 1.9.7 - Open Redirect6.1 Medium
- Show moreLoading…