CWE-601: URL Redirection to Untrusted Site
The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.
Also known as Open Redirect, Cross-site Redirect, Cross-domain Redirect.
A kind of CWE-610 Externally Controlled Reference to a Resource in Another Sphere.
From the CWE List. © The MITRE Corporation.
Newest
- squaredup dashboard serverSquaredUp Dashboard Server SCOM edition before 5.7.1 GA allows open redirection. (The issue was...6.1 Medium
- elastic kibanaAn open redirect issue was discovered in Kibana that could lead to a user being redirected to an...6.1 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreAfter downloading a Windows <code>.url</code> shortcut from the local filesystem, an attacker...8.1 High
- sap netweaver as for abap and abap platform, netweaver application server abap +1 moreSAP NetWeaver AS for ABAP and ABAP Platform - versions 740, 750, 751, 752, 753, 754, 755, 756,...6.1 Medium
- sap solution managerSAP Solution Manager - version 720, allows an authenticated attacker to redirect users to a...6.5 Medium
- sap netweaver application server for abap and abap platform, netweaver application server abap +1 moreAn unauthenticated attacker in AP NetWeaver Application Server for ABAP and ABAP Platform -...6.1 Medium
- brave adblock-listsPrior to commit 51867e0d15a6d7f80d5b714fd0e9976b9c160bb0, https://github.com/brave/adblock-lists...6.1 Medium
- btcpayserver, btcpayserver btcpayserver/btcpayserver +1 moreOpen Redirect in btcpayserver/btcpayserver6.4 Medium
- caddyserver caddyOpen Redirect in Caddy6.1 Medium
- hcl software leap, hcltech hcl leap +1 moreAn open redirect to malicious sites affects HCL Leap8.2 High
- f5 big-ip, big-ip access policy manager, big-ip advanced firewall manager +10 more +12 moreBIG-IP APM virtual server vulnerability6.1 Medium
- miniorange wordpress saml sso premium, wordpress saml sso premium mulsitesite, wordpress saml sso standard +1 more +3 moreminiOrange WordPress SAML SSO multiple versions - Open Redirect in SSO login6.1 Medium
- netscout ngeniusoneAn issue was discovered in NetScout nGeniusONE 6.3.2 build 904. Open Redirection can occur (issue...3.5 Low
- netscout ngeniusoneAn issue was discovered in NetScout nGeniusONE 6.3.2 build 904. Open Redirection can occur (issue...3.1 Low
- jenkins openid, jenkins project openid plugin +1 moreOpen redirect vulnerability in Jenkins OpenID Plugin6.1 Medium
- plesk obsidianA Host Header Injection issue on the Login page of Plesk Obsidian through 18.0.49 allows...6.1 Medium
- rubyonrails rails, actionpack project actionpack, rails https://github.com/rails/rails +2 moreOpen Redirect Vulnerability in Action Pack6.1 Medium
- sylabs scs-library-client, singularity container services library +1 moreUser credentials leaked to third-party service via HTTP redirect in scs-library-client5.2 Medium
- pgadmin 4, pgadmin.org pgadmin 4, fedoraproject fedora +2 morepgAdmin 4 Open Redirect vulnerability6.1 Medium
- apache supersetApache Superset: Open Redirect Vulnerability5.4 Medium
- calesanz gibb-modul-151calesanz gibb-modul-151 login redirect4.6 Medium
- gitlabAn issue has been discovered in GitLab CE/EE affecting all versions starting from 11.4 prior to...6.1 Medium
- moodle plugin - saml auth plugin - saml auth, moodle saml authentication +1 moreMoodle Plugin - SAML Auth Open Redirect6.5 Medium
- syracom secure loginThe Syracom Secure Login plugin before 3.1.1.0 for Jira may allow spoofing of 2FA PIN validation...6.1 Medium
- okta oidc middleware@okta/oidc-middlewareOpen Redirect vulnerability4.7 Medium
- symbiote seedSymbiote Seed Login SecurityLoginExtension.php onBeforeSecurityLogin redirect6.3 Medium
- octopus serverIn affected versions of Octopus Deploy users of certain browsers using AD to sign-in to Octopus...6.1 Medium
- esri portal for arcgis, arcgis enterprise +1 moreUnvalidated redirect in Portal for ArcGIS6.1 Medium
- go-macaron i18nMacaron i18n i18n.go redirect5.5 Medium
hyper-staticfilecrates.iohyper-staticfile's location header incorporates user input, allowing open redirectNo score- ikus-soft rdiffweb, ikus060 ikus060/rdiffweb +1 moreOpen Redirect in ikus060/rdiffweb6.1 Medium
- ikus-soft rdiffweb, ikus060 ikus060/rdiffweb +1 moreOpen Redirect in ikus060/rdiffweb5.9 Medium
- mozilla firefoxWhen closed or sent to the background, Firefox for Android would not properly record and persist...6.1 Medium
- adobe experience manager, experience manager cloud service +1 moreAEM URL Redirection to Untrusted Site Security feature bypass3.5 Low
- apache helixApache Helix: Open redirect6.1 Medium
- japan construction information center denshi nyusatsu core system, jacic electronic bidding core system +1 moreOpen redirect vulnerability in DENSHI NYUSATSU CORE SYSTEM v6 R4 and earlier allows a remote...6.1 Medium
- oils-js project oils-jsoils-js Web.js redirect6.3 Medium
- cyface terms and conditions module, django terms and conditions project terms and conditions +1 morecyface Terms and Conditions Module views.py returnTo redirect5.5 Medium
- hcl software digital experience, hcltech hcl digital experience +1 moreHCL Digital Experience is susceptible to open redirects6.1 Medium
- debian linux, openidc mod auth openidc +1 moreOpen Redirect in oidc_validate_redirect_url()4.7 Medium
- sap solution manager (enterprise search), solution manager +1 moreIn SAP Solution Manager (Enterprise Search) - versions 740, and 750, an unauthenticated attacker...6.1 Medium
- sap sourcing, sourcing and sap contract lifecycle management, contract lifecycle manager +2 moreDue to improper input sanitization in SAP Sourcing and SAP Contract Lifecycle Management -...4.3 Medium
- jenkins google login, jenkins project google login plugin +1 moreJenkins Google Login Plugin Open Redirect vulnerability6.1 Medium
- iliasILIAS before 7.16 has an Open Redirect.6.1 Medium
- tibco nimbusTIBCO Nimbus Open Redirect Vulnerability9.3 Critical
- shirasagi project shirasagiOpen redirect vulnerability in SHIRASAGI v1.14.4 to v1.15.0 allows a remote unauthenticated...6.1 Medium
- apereo opencastOpencast Authenticated OpenRedirect Vulnerability5.7 Medium
- mozilla firefoxUsing the <code>S.browser_fallback_url parameter</code> parameter, an attacker could redirect a...6.1 Medium
- apache airflowApache Airflow: Open redirect during login6.1 Medium
- esri arcgis quickcapture, arcgis quickcapture +1 moreAn unvalidated redirect vulnerability exists in Esri ArcGIS Quick Capture Web Designer versions 10.8.1 to 10.9.1.6.1 Medium
- Show moreLoading…