CWE-601: URL Redirection to Untrusted Site
The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.
Also known as Open Redirect, Cross-site Redirect, Cross-domain Redirect.
A kind of CWE-610 Externally Controlled Reference to a Resource in Another Sphere.
From the CWE List. © The MITRE Corporation.
Newest
- nextcloud talk, kiteworks security-advisories +1 moreGeolocation preview links can be set to arbitrary links in nextcloud talk4.7 Medium
- archivy archivy/archivy, archivy project archivy +1 moreOpen Redirect in archivy/archivy3.4 Low
- medialize medialize/uri.js, uri.js project uri.js +1 moreOpen Redirect in medialize/uri.js8.0 High
- nitely nitely/spirit, spirit-project spirit +1 moreMultiple Open Redirect in nitely/spirit4.3 Medium
- dlink dir-850l firmwareDLink DIR850 ET850-1.08TRb03 is affected by an incorrect access control vulnerability through URL...6.1 Medium
- openstack nova, openstack-nova, redhat openstack platform +2 moreOpen Redirect in CPython that affects users of OpenStack Nova6.1 Medium
- fluture-js fluture-nodeUnauthorized forwarding of confidential headers in fluture-node2.6 Low
- cherwell service managementAn issue was discovered in the web application in Cherwell Service Management (CSM) 10.2.3. It...6.1 Medium
- cherwell service managementAn issue was discovered in the web application in Cherwell Service Management (CSM) 10.2.3....6.1 Medium
- karma project karmaOpen Redirect5.4 Medium
- jetbrains teamcityIn JetBrains TeamCity before 2021.2.1, a redirection to an external site was possible.6.1 Medium
- hewlett packard enterprise hpe oneview global dashboard, hpe oneview global dashboard +1 moreA remote URL redirection vulnerability was discovered in HPE OneView Global Dashboard version(s):...6.1 Medium
- alltube project alltube, rudloff rudloff/alltube +1 moreOpen Redirect on Rudloff/alltube in rudloff/alltube4.7 Medium
- mozilla pollbotopen redirect in pollbot6.1 Medium
- jenkins gitlab authentication, jenkins project gitlab authentication plugin +1 moreOpen redirect vulnerability in Jenkins GitLab Authentication Plugin5.4 Medium
- microweber, microweber microweber/microweber +1 moreOpen Redirect in microweber/microweber4.3 Medium
- noptin, unknown wordpress newsletter plugin – noptin +1 moreNoptin < 1.6.5 - Open Redirect6.1 Medium
- magnolia-cms magnolia cmsCross-Site Request Forgery in Magnolia CMS8.8 High
- microweber, microweber microweber/microweber +1 moreOpen Redirect in microweber/microweber4.3 Medium
- xwiki, xwiki xwiki-platform +1 moreOpen Redirect in xwiki-platform4.7 Medium
- siemens sinema remote connect serverA vulnerability has been identified in SINEMA Remote Connect Server (All versions < V2.0)....6.1 Medium
- giteaOpen redirect in Gitea6.1 Medium
- octopus server, deploy +1 moreIn affected Octopus Server versions when the server HTTP and HTTPS bindings are configured to...6.1 Medium
- seeddmsOpen Redirect vulnerability exists in SeedDMS 6.0.15 in out.Login.php, which llows remote...6.1 Medium
plone-app-contenttypesPyPICross-site Scripting and Open Redirect in plone.app.contenttypes4.3 Medium- twisted treq, debian linux +1 moreUnsafe handling of user-specified cookies in treq6.5 Medium
- adenza axiomsl controllerviewAdenza AxiomSL ControllerView through 10.8.1 allows redirection for SSO login URLs.6.1 Medium
- ploneCross-site Scripting and Open Redirect in Products.ATContentTypes4.3 Medium
- webp converter for media project converter for media, unknown webp converter for media – convert webp and avif & optimize images +1 moreWebP Converter for Media < 4.0.3 - Unauthenticated Open redirect6.1 Medium
- stellarwp event ticketsEvent Tickets < 5.2.2 - Open Redirect6.1 Medium
- alexander anycommentAnyComment < 0.3.5 - Open Redirect6.1 Medium
- node-fetch node-fetch/node-fetch, node-fetch project node-fetch, debian linux +1 more +3 moreExposure of Sensitive Information to an Unauthorized Actor in node-fetch/node-fetch8.8 High
- qnap qcalagentOpen Redirect Vulnerability in QcalAgent6.1 Medium
- digitalbazaar forgeForge: Denial of service in TLS record processing via call stack exhaustion7.5 High
- digitalbazaar forgeForge: AES-GCM authentication bypass via unvalidated tagLength option5.9 Medium
- digitalbazaar forgeForge: PKCS#12 MAC forgery and constant-key PBE via zero iteration count7.5 High
- digitalbazaar forgeForge: verifyCertificateChain() removes trusted CA certificates with the same subject from the CA store3.7 Low
- digitalbazaar forgeForge: Regular expression denial of service in PEM decoding (pem.decode)7.5 High
- digitalbazaar digitalbazaar/forge, forge +1 moreOpen Redirect in digitalbazaar/forge5.3 Medium
- shopwareOpen redirect in shopware6.8 Medium
- groupsession, japan total system co.,ltd. groupsession free edition, groupsession bycloud, groupsession zion +1 moreOpen redirect vulnerability in GroupSession Free edition ver5.1.1 and earlier, GroupSession...6.1 Medium
- tcman gimTCMAN GIM open redirect vulnerability6.1 Medium
- auth0 nextjs-auth0Open redirect in nextjs-auth06.4 Medium
- synacor zimbra collaboration suiteAn issue in /domain/service/.ewell-known/caldav of Zimbra Collaboration 8.8.12 allows attackers...6.1 Medium
- rails https://github.com/rails/rails, rubyonrails rails +1 moreactionpack Open Redirect in Host Authorization Middleware6.1 Medium
- openwhyd, openwhyd openwhyd/openwhyd +1 moreOpen Redirect in openwhyd/openwhyd7.3 High
- mozilla firefoxThe 'Copy Image Link' context menu action would copy the final image URL after redirects. By...6.1 Medium
- fortinet fortiwebA url redirection to untrusted site ('open redirect') in Fortinet FortiWeb version 6.4.1 and...4.1 Medium
- fortinet fortiwebA url redirection to untrusted site ('open redirect') in Fortinet FortiWeb version 6.4.1 and 6.4...4.3 Medium
- showdoc, star7th star7th/showdoc +1 moreOpen Redirect in star7th/showdoc6.5 Medium
- Show moreLoading…