CWE-601: URL Redirection to Untrusted Site
The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.
Also known as Open Redirect, Cross-site Redirect, Cross-domain Redirect.
A kind of CWE-610 Externally Controlled Reference to a Resource in Another Sphere.
From the CWE List. © The MITRE Corporation.
Newest
- devolutions serverTrueConf Server change-lang redirect3.5 Low
- microweber, microweber microweber/microweber +1 moreOpen Redirect in microweber/microweber4.3 Medium
- apifest oauth 2.0 serverApiFest OAuth 2.0 Server 0.3.1 does not validate the redirect URI in accordance with RFC 6749 and...6.1 Medium
- nagios xiIn Nagios XI through 5.8.5, an open redirect vulnerability exists in the login function that...6.1 Medium
- dahuasecurity asi7213x-t1 firmware, asi7213x firmware, asi7223x-a-t1 firmware +37 more +39 moreIf the user enables the https function on the device, an attacker can modify the user’s request...4.7 Medium
- web2pyOpen redirect in web2py6.1 Medium
- habiticaHabitica - Open redirect in login page5.8 Medium
- yuba u5cmsAn issue was discovered in u5cms verion 8.3.5 There is a URL redirection vulnerability that can...6.1 Medium
- maykinmedia open forms, open-formulieren open-forms +1 moreOpen Redirect in open-forms7.1 High
- apache dubbobypass of CVE-2021-256406.1 Medium
- caddyserver caddyOpen redirect in caddy6.1 Medium
- netapp e-series santricity os controllerE-Series SANtricity OS Controller Software 11.x versions through 11.70.2 are vulnerable to host...6.1 Medium
- nextauth.js next-authURL Redirection to Untrusted Site ('Open Redirect') in next-auth6.1 Medium
- grafanaGrafana Enterprise datasource network restrictions bypass via HTTP redirects6.6 Medium
- diagrams drawio, jgraph jgraph/drawio +1 moreExposure of Sensitive Information to an Unauthorized Actor in jgraph/drawio8.2 High
- acronis cyber protect 15, cyber protect +1 moreOpen redirect via user-controlled query parameter6.1 Medium
- sonicwall sma1000, sma 6200 firmware, sma 6210 firmware +3 more +5 moreSonicWall SMA1000 series firmware 12.4.0, 12.4.1-02965 and earlier versions accept a user...6.1 Medium
- sysaidSysaid – sysaid Open Redirect4.6 Medium
- ultimatemember ultimate member, ultimate member – user profile, registration, login, member directory, content restriction & membership plugin +1 moreUltimate Member <= 2.3.1 - Arbitrary Redirect4.3 Medium
- qnap qts, quts hero, qutscloud +2 moreOpen redirect4.3 Medium
- cisco roomos software, roomos, telepresence collaboration endpoint +2 moreCisco TelePresence Collaboration Endpoint and RoomOS Software Vulnerabilities6.5 Medium
- cisco roomos software, roomos, telepresence collaboration endpoint +2 moreCisco TelePresence Collaboration Endpoint and RoomOS Software Vulnerabilities6.5 Medium
- nopcommerceIn nopCommerce 4.50.1, an open redirect vulnerability can be triggered by luring a user to...6.1 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreRequests initiated through reader mode did not properly omit cookies with a SameSite attribute....6.1 Medium
- micro focus netiq access managerPotential open redirection vulnerability in NetIQ Access Manager versions prior to version 5.0.24.0 Medium
- nextcloud talk, kiteworks security-advisories +1 moreOpen Redirect in Nextcloud Talk4.3 Medium
- english wordpress admin project wordpress admin, unknown english wordpress admin +1 moreEnglish WordPress Admin < 1.5.2 - Unauthenticated Open Redirect6.1 Medium
- mi app storeAn intent redirection vulnerability in the Mi App Store product. This vulnerability is caused by...6.1 Medium
- mcafee web gateway, mcafee,llc secure web gateway +1 moreSWG URL redirection vulnerability6.1 Medium
- nextauth.js next-authDefault redirect callback vulnerable to open redirects6.1 Medium
- automated logic webctrl serverAutomated Logic WebCtrl Server Open Redirection Vulnerability5.2 Medium
- posthog, posthog posthog/posthog +1 moreOpen redirect vulnerability via endpoint authorize_and_redirect/?redirect= in posthog/posthog6.1 Medium
- b. braun melsungen ag data module compactplus, spacecom, battery pack with wi-fi +1 more +3 moreB. Braun SpaceCom, Battery Pack SP with Wi-Fi, and Data module compactplus5.4 Medium
- hubzillaAn open redirect vulnerability in Hubzilla before version 7.2 allows remote attackers to redirect...6.1 Medium
- sap netweaver abap, sap se netweaver abap server and abap platform +1 moreSAP NetWeaver ABAP Server and ABAP Platform - versions 740, 750, 787, allows an unauthenticated...4.7 Medium
- orangehrmOrangeHRM 4.10 is vulnerable to a Host header injection redirect via viewPersonalDetails endpoint.5.4 Medium
- orangehrmOrangeHRM 4.10 suffers from a Referer header injection redirect vulnerability.5.4 Medium
- wwbn avideoOpen redirect in wwbn/avideo6.1 Medium
- medialize medialize/uri.js, uri.js project uri.js +1 moreURL Confusion When Scheme Not Supplied in medialize/uri.js6.5 Medium
- auth0 express-openid-connect, express openid connect +1 moreOpen Redirect in express-openid-connect7.5 High
- joomla joomla\!, joomla! project cms +1 more[20220306] - Core - Inadequate validation of internal URLs6.1 Medium
- rsa archerArcher 6.x through 6.9 P2 (6.9.0.2) is affected by an open redirect vulnerability. A remote...5.4 Medium
- broadcom siteminder, symantec siteminder +1 moreNetegrity SiteMinder Login smpwservicescgi.exe redirect5.4 Medium
- gitlabAn issue has been discovered affecting GitLab versions prior to 13.5. An open redirect...4.7 Medium
- dpgaspar flask-appbuilderOpen Redirect in Flask-AppBuilder6.1 Medium
- gitea, go-gitea go-gitea/gitea +1 moreOpen Redirect on login in go-gitea/gitea7.2 High
- chshcms cscmsCscms Music Portal System v4.2 was discovered to contain a redirection vulnerability via the...5.4 Medium
- king-theme kingcomposer, unknown page builder: kingcomposer – free drag and drop page builder by king-theme +1 morePage Builder KingComposer <= 2.9.6 - Open Redirect6.1 Medium
- moodleMoodle reflected XSS6.1 Medium
- alltube project alltubeServer-Side Request Forgery (SSRF) and URL Redirection to Untrusted Site ('Open Redirect') in alltube7.3 High
- Show moreLoading…