CWE-601: URL Redirection to Untrusted Site
The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.
Also known as Open Redirect, Cross-site Redirect, Cross-domain Redirect.
A kind of CWE-610 Externally Controlled Reference to a Resource in Another Sphere.
From the CWE List. © The MITRE Corporation.
Newest
- huawei emui, harmonyos +1 moreThe launcher module has an Intent redirection vulnerability. Successful exploitation of this...5.3 Medium
- gitlabAn open redirect vulnerability in GitLab EE/CE affecting all versions from 9.3 prior to 15.3.5,...4.7 Medium
- gitlabAn open redirect in GitLab CE/EE affecting all versions from 10.1 prior to 15.3.5, 15.4 prior to...3.5 Low
- sap financial consolidationSAP Financial Consolidation - version 1010, does not sufficiently encode user-controlled input...6.1 Medium
- sap financial consolidationDue to insufficient input validation, SAP Financial Consolidation - version 1010, allows an...6.5 Medium
- sap se netweaver abap server and abap platform, sap netweaver application server abap +1 moreSAP NetWeaver ABAP Server and ABAP Platform allows an unauthenticated attacker to redirect users...4.7 Medium
- sap financial consolidationDue to insufficient input validation, SAP Financial Consolidation - version 1010, allows an...5.4 Medium
- sap biller directSAP Biller Direct allows an unauthenticated attacker to craft a legitimate looking URL. When...6.1 Medium
- hewlett packard enterprise (hpe) hpe oneview global dashboard (ovgd), hpe oneview global dashboard +1 moreURL Redirection to Untrusted Site ('Open Redirect') vulnerability in Hewlett Packard Enterprise...6.1 Medium
- apache airflowApache Airflow prior to 2.4.2 has an open redirect6.1 Medium
- eolink apinto-dashboardeolinker apinto-dashboard login redirect6.3 Medium
- zoom meetings, zoom video communications inc client for meetings (for android, ios, linux, macos, and windows), zoom rooms for conference rooms +3 more +5 moreImproper URL parsing in Zoom Clients8.8 High
- e-excellence u-office forcee-Excellence Inc. U-Office Force - Open Redirect6.1 Medium
- metabaseMetabase's GeoJSON validation doesn't prevent redirects to blocked URLs6.5 Medium
- esri arcgis serverBUG-000148347 Unvalidated redirect issues in ArcGIS Server.6.1 Medium
- nopcommerceMultiple open redirect vulnerabilities in NopCommerce 4.10 through 4.50.1 allow remote attackers...6.1 Medium
- sap commerceAn attacker can change the content of an SAP Commerce - versions 1905, 2005, 2105, 2011, 2205,...8.8 High
- cert vince, cert/cc vince - the vulnerability information and coordination environment +1 moreAn HTML injection vulnerability exists in CERT/CC VINCE software prior to version 1.50.45.4 Medium
- cert vince, cert/cc vince - the vulnerability information and coordination environment +1 moreAn HTML injection vulnerability exists in CERT/CC VINCE software prior to version 1.50.45.4 Medium
- ikus-soft rdiffweb, ikus060 ikus060/rdiffweb +1 moreOpen Redirect in ikus060/rdiffweb5.7 Medium
- labstack echoLabstack Echo Open Redirect vulnerability9.6 Critical
- mailcow mailcow-dockerized, mailcow\ +1 moremailcow-dockerized critical information misrepresentation can lead to phishing attacks through Swagger UI8.1 High
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal and Liferay DXP HtmlUtil.escapeRedirect Can Be Circumvented6.1 Medium
- apache airflowOpen Redirect6.1 Medium
- osstech openam, openam consortium (openam consortium edition) +1 moreOpenAM Consortium Edition version 14.0.0 provided by OpenAM Consortium contains an open redirect...6.1 Medium
- nokia 1350 optical management systemIn NOKIA 1350 OMS R14.2, an Open Redirect vulnerability occurs is the login page via next HTTP...6.1 Medium
- getgophish gophishOpen Redirect5.4 Medium
- oauthlib, fedoraproject fedora +1 moreOAuthLib vulnerable DoS when attacker provides malicious IPV6 URI5.7 Medium
- rstudio connectRStudio Connect is affected by an Open Redirect issue. The vulnerability could allow an attacker...6.1 Medium
- ibm security identity managerIBM Security Identity Manager 6.0 and 6.0.2 could allow a remote attacker to conduct phishing...6.8 Medium
- oauth2-server project oauth2-serveroauth2-server through 3.1.1 vulnerable to Open Redirect7.2 High
- hcl software inotes, hcltech hcl inotes, domino +2 moreHCL iNotes is susceptible to a link to non-existent domain vulnerability.6.1 Medium
- python, fedoraproject fedora, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp +2 more +4 morePython 3.x through 3.10 has an open redirection vulnerability in lib/http/server.py due to no...7.4 High
- cert vince, cert/cc vince - the vulnerability information and coordination environment +1 moreAn open redirect vulnerability exists in CERT/CC VINCE software prior to version 1.50.06.1 Medium
- bookwyrm-social bookwyrmURL Redirection to Untrusted Site ('Open Redirect') in bookwyrm7.1 High
- zoom, zoom video communications inc client for meetings (for android, ios, linux, macos, and windows), zoom virtual desktop infrastructure +1 more +3 moreImproper URL parsing in Zoom Clients9.6 Critical
- vmware identity manager, one access, access connector +1 more +3 moreVMware Workspace ONE Access and Identity Manager contain a URL injection vulnerability. A...9.8 Critical
- flask-middleware flask-securityOpen Redirect5.4 Medium
- dspaceURL Redirection to Untrusted Site in Dspace JSPUI7.1 High
- citirx citrix application delivery management (citrix adc) and citrix gateway, citrix application delivery controller firmware, gateway +2 moreUnauthenticated redirection to a malicious website6.1 Medium
- mozilla firefoxWhen using the Performance API, an attacker was able to notice subtle differences between...6.1 Medium
- twinkle toes software bookedOpen redirect vulnerability in Booked versions prior to 3.3 allows a remote unauthenticated...6.1 Medium
- moodle, fedoraproject fedora +1 moreMoodle Open redirect risk in mobile auto-login feature6.1 Medium
- nodejs undiciUncleared cookies on cross-host/cross-origin redirect in undici3.7 Low
- bestpractical request trackerBest Practical Request Tracker (RT) before 5.0.3 has an Open Redirect via a ticket search.6.1 Medium
- samsung cameraIntent redirection vulnerability using implict intent in Camera prior to versions 12.0.01.64 ,12...5.3 Medium
- portswigger burp suiteA URL disclosure issue was discovered in Burp Suite before 2022.6. If a user views a crafted...4.3 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreThe <code>ms-msdt</code>, <code>search</code>, and <code>search-ms</code> protocols deliver...6.5 Medium
- mozilla firefoxEven when an iframe was sandboxed with <code>allow-top-navigation-by-user-activation</code>, if...6.1 Medium
- gitlabAn open redirect vulnerability in GitLab EE/CE affecting all versions from 11.1 prior to 14.10.5,...4.7 Medium
- Show moreLoading…