CWE-601: URL Redirection to Untrusted Site
The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.
Also known as Open Redirect, Cross-site Redirect, Cross-domain Redirect.
A kind of CWE-610 Externally Controlled Reference to a Resource in Another Sphere.
From the CWE List. © The MITRE Corporation.
Newest
oro/platformPackagistOroPlatform Forced Redirect to External Website6.1 Mediumoro/crmPackagistOroCRM Forced Redirect to External Website6.1 Mediumdrupal/drupalPackagistDrupal core Open Redirect vulnerability4.3 Mediumdrupal/drupalPackagistDrupal Anonymous Open Redirect5.8 Mediumdrupal/drupalPackagistDrupal External URL injection through URL aliases leading to Open RedirectNo scoredrupal/corePackagistDrupal core Open Redirect vulnerability4.3 Mediumdrupal/corePackagistDrupal Anonymous Open Redirect5.8 Mediumdrupal/corePackagistDrupal External URL injection through URL aliases leading to Open RedirectNo score- cisco network services orchestratorA vulnerability in the web-based management interface of Cisco Crosswork Network Services...4.7 Medium
- mozilla firefoxWhen a network error occurred during page load, the prior content could have remained in view...7.5 High
- wpcompress wp compress, aresit wp compress – instant performance & speed optimization +1 moreWP Compress – Image Optimizer [All-In-One] <= 6.20.01 - Missing Authorization6.5 Medium
- wpcompress wp compress, aresit wp compress – instant performance & speed optimization +1 moreWP Compress – Image Optimizer [All-In-One] <= 6.20.01 - Open Redirect via css4.3 Medium
- elated-themes frappeFrappe vuilnerable to an open redirect on login page6.1 Medium
- reputeinfosystems armember – membership plugin, content restriction, member levels, user profile & user signupARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup <= 4.0.30 - Open Redirect6.1 Medium
- illid share this imageWordPress Share This Image plugin <= 1.97 - Open Redirection vulnerability4.7 Medium
- wifire hotspotAn issue in Wifire Hotspot v.4.5.3 allows a local attacker to execute arbitrary code via a...8.8 High
- viewerjsAn issue was discovered in ViewerJS 0.5.8. A script from the component loads content via URL TAGs...4.7 Medium
- deepen bajracharya video conferencing with zoomWordPress Video Conferencing with Zoom plugin <= 4.4.4 - Open Redirection vulnerability4.7 Medium
- bigbluebutton greenlightBigBlueButton Greenlight Open Redirect vulnerability9.1 Critical
- bigbluebutton greenlightBigBlueButton Greenlight Open Redirect vulnerability9.1 Critical
- portainerPortainer before 2.20.0 allows redirects when the target is not index.yaml.9.1 Critical
- foliovision fv flowplayer video player, fv flowplayer video player flowplayer video player +1 moreWordPress FV Player plugin <= 7.5.44.7212 - Unvalidated Redirects and Forwards vulnerability4.1 Medium
cgPyPIcg vulnerable to an Open Redirect Vulnerability on Referer Header6.1 Medium- solarwinds platformSolarWinds Platform Arbitrary Open Redirection Vulnerability7.0 High
- red hat migration toolkit for applications 6, migration toolkit for applications 7, amq broker 7 +18 more +20 moreKeycloak: xss via assertion consumer service url in saml post-binding flow6.0 Medium
- red hat build of keycloak 22Keycloak: path traversal in the redirect validation7.1 High
- oracle peoplesoft enterprise peopletools, oracle corporation peoplesoft enterprise pt peopletools +1 moreVulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component:...6.1 Medium
- spring framework, vmware spring framework +1 moreCVE-2024-22262: Spring Framework URL Parsing with Host Validation8.1 High
- gradio-app gradio-app/gradio, gradio project gradio +1 moreSSRF Vulnerability in gradio-app/gradio6.5 Medium
- freshworks freshdesk (official)WordPress Freshdesk (official) plugin <= 2.3.6 - Open Redirection vulnerability4.7 Medium
- corezoidOpen Redirect vulnerability in Corezoid Process Engine v6.5.0 allows attackers to redirect to...4.3 Medium
- wp oauth server oauth server, wp-oauth wp oauth server +1 moreWordPress WP OAuth Server (OAuth Authentication) plugin <= 4.3.3 - Open Redirection vulnerability4.7 Medium
- app cheap builder, appcheap app builder +1 moreWordPress App Builder plugin <= 3.8.7 - Open Redirection vulnerability4.7 Medium
- sipwise next generation communication platformAn Open Redirect vulnerability was found in Sipwise C5 NGCP Dashboard below mr11.5.1. The Open...3.1 Low
- instantcms, instantsoft icms2 +1 moreInstantCMS Open Redirect vulnerability3.5 Low
- No product listedVMware SD-WAN Orchestrator contains an open redirect vulnerability. A malicious actor may be...7.1 High
- gbgplc instinctA DOM-based open redirection in the returnUrl parameter of INSTINCT UI Web Client 6.5.0 allows...7.3 High
- jetbrains teamcityIn JetBrains TeamCity before 2024.03 open redirect was possible on the login page6.1 Medium
- uncanny owl toolkit for learndash, uncannyowl uncanny toolkit for learndash +1 moreWordPress Uncanny Toolkit for LearnDash plugin <= 3.6.4.3 - Open Redirection vulnerability4.7 Medium
- @clerk expressExpress.js Open Redirect in malformed URLs6.1 Medium
- cdexOpen redirection in CDeX7.1 High
- travelpayouts, unknown travelpayouts: all travel brands in one place +1 moreTravelpayouts <= 1.1.15 - Open Redirect6.1 Medium
- avsystem unified management platformAn open redirect in the Login/Logout functionality of web management in AVSystem Unified...5.4 Medium
- spring framework, vmware spring framework, netapp active iq unified manager +2 moreCVE-2024-22259: Spring Framework URL Parsing with Host Validation (2nd report)8.1 High
- directusURL Redirection to Untrusted Site in OAuth2/OpenID in directus5.4 Medium
- peering-manager peering manager, peering-manager +1 moreOpen redirection using the return_url parameter in Peering Manager3.5 Low
- rejetto http file serverMultiple vulnerabilities in Rejetto's Http File Server6.5 Medium
- nteractNteract Remote Code Execution vulnerability9.8 Critical
- jhpyle docassembleDocassemble open redirect6.1 Medium
- espocrmEspoCRM weakness in "Forgot password"5.9 Medium
- Show moreLoading…