CWE-601: URL Redirection to Untrusted Site
The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.
Also known as Open Redirect, Cross-site Redirect, Cross-domain Redirect.
A kind of CWE-610 Externally Controlled Reference to a Resource in Another Sphere.
From the CWE List. © The MITRE Corporation.
Newest
- mozilla firefox, firefox esr, thunderbird +2 moreIf a site had been granted the permission to open popup windows, it could cause Select elements...6.1 Medium
- ibm security verify access, security verify access docker +1 moreIBM Security Verify Access HTTP open redirect6.8 Medium
- vtiger crmAn Open Redirect vulnerability in the page parameter of vTiger CRM v7.4.0 allows attackers to...6.1 Medium
- hitachi energy microscada sys600, hitachienergy microscada x sys600 +1 moreAn HTTP parameter may contain a URL value and could cause the web application to redirect the...4.3 Medium
- sir gnuboard, gnuboard gnuboard6 +1 moreThere is an Open Redirect vulnerability in Gnuboard v6.0.4 and below via the `url` parameter in...6.1 Medium
- opentext™ network node manager i (nnmi)Potential Open Redirect issues affect OpenText™ Network Node Manager i (NNMi).4.8 Medium
- opensearch-project security-dashboards-pluginOpenSearch Dashboards Security Plugin improper validation of nextUrl can lead to external redirect6.1 Medium
- joomla joomla\!, joomla! project cms +1 more[20240801] - Core - Inadequate validation of internal URLs6.1 Medium
- 3ds 3dexperience, dassault systèmes 3dswymer, dassault 3dswymer 3dexperience 2022 +2 more +4 moreURL redirection to untrusted site (open redirect) vulnerability affecting 3DPassport in 3DSwymer from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x8.1 High
- 3ds 3dexperience, dassault systèmes 3dswymer, dassault 3dswymer 3dexperience 2022 +2 more +4 moreReflected Cross-site Scripting (XSS) vulnerability affecting 3DSwymer from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x7.7 High
- dimitri grassi salon booking system, salon booking system booking system +1 moreWordPress Salon Booking System plugin <= 10.8.1 - Open Redirection vulnerability4.7 Medium
- scott paterson easy paypal buy now buttonWordPress Easy PayPal & Stripe Buy Now Button plugin <= 1.9 - Open Redirection vulnerability4.7 Medium
- pkp ojs, public knowledge project open journal systems +1 morepkp ojs signOut redirect6.9 Medium
- pylons webobWebOb's location header normalization during redirect leads to open redirect6.1 Medium
- microsoft dynamics 365, dynamics 365 (on-premises) version 9.1 +1 moreMicrosoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability8.2 High
- 1e platformThe Duende Identity Server based component in 1E Platform may allow URL redirections to untrusted websites.4.7 Medium
IdentityServer4NuGetIdentityServer Open Redirect vulnerability5.1 Medium- opensecurity mobile security framework, mobsf mobile-security-framework-mobsf +1 moreMobile Security Framework (MobSF) has an Open Redirect in Login Redirect5.2 Medium
- duende identityserverDuende IdentityServer Open Redirect vulnerability4.7 Medium
- openprojectOpenProject packaged installation has Open Redirect Vulnerability in Sign-In in default configuration4.7 Medium
- atlassian bitbucket data centerThere is a low severity open redirect vulnerability within affected versions of Bitbucket Data...3.1 Low
- cisco telepresence video communication server (vcs) expressway, telepresence video communication server +1 moreA vulnerability in the web-based management interface of Cisco Expressway Series could allow an...4.7 Medium
- unknown wps hide loginWPS Hide Login < 1.9.16.4 - Hidden Login Page Disclosure6.1 Medium
- citrix workspace app for html5, workspace +1 moreRedirection of users to a vulnerable URL in Citrix Workspace app for HTML54.8 Medium
- citrix netscaler adc, netscaler gateway, netscaler application delivery controller +2 moreOpen redirect vulnerability allows a remote unauthenticated attacker to redirect users to arbitrary websites5.1 Medium
- getoutline outlineAn issue in Outline <= v0.76.1 allows attackers to redirect a victim user to a malicious site via...6.1 Medium
- progress software corporation sitefinityURL Redirection to Arbitrary Site Exists in Sitefinity5.3 Medium
khoj-assistantPyPIKhoj Open Redirect Vulnerability in Login Page6.3 Medium- kodezen limited academy lmsWordPress Academy LMS plugin <= 2.0.4 - Open Redirection vulnerability3.5 Low
- imartinez imartinez/privategpt, privategpt +1 moreOpen Redirect in imartinez/privategpt4.3 Medium
- rocklobster contact form 7Contact Form 7 < 5.9.5 - Unauthenticated Open Redirect6.1 Medium
- magarsus consultancy sso (single sign on)Open Redirect in Magarsus Consultancy's SSO6.1 Medium
- dell powerprotect dd, data domain operating system +1 moreDell PowerProtect DD, versions prior to 8.0, LTS 7.13.1.0, LTS 7.10.1.30, LTS 7.7.5.40 contain an...3.5 Low
- octobercms octoberOctober Open Redirect for Administrator Accounts3.5 Low
- seopressSEOPress < 7.8 - Contributor+ Open Redirect6.1 Medium
- gradio-app gradio-app/gradio, gradio project gradio +1 moreOpen Redirect in gradio-app/gradio5.4 Medium
- myrecorp export wp page to static html\/css, recorp export wordpress pages to static html & pdf — static site export +1 moreExport WP Page to Static HTML/CSS <= 2.2.2 - Open Redirect7.1 High
- eg secure solutions inc. siteguard wp plugin, eg secure solutions siteguard +1 moreSiteGuard WP Plugin provides a functionality to customize the path to the login page wp-login.php...5.3 Medium
- elastic kibanaKibana open redirect issue6.1 Medium
- themify builder, themifyme themify builder +1 moreThemify Builder < 7.5.8 - Open Redirect6.1 Medium
- strapi@strapi/plugin-users-permissions leaks 3rd party authentication tokens and authentication bypass7.1 High
- salesagility suitecrm, suitecrm-core +1 moreSuiteCRM-Core Host Header Injection in /legacy4.3 Medium
- salesagility suitecrmSuiteCRM vulnerable to open redirects5.4 Medium
zendframework/zendframeworkPackagistZendframework Remote Address Spoofing Vector in `Zend\Http\PhpEnvironment\RemoteAddress`7.5 High- fortinet fortiauthenticatorA URL redirection to untrusted site ('open redirect') in Fortinet FortiAuthenticator version 6.6...5.8 Medium
- harborHarbor Open Redirect URL4.3 Medium
silverstripe/frameworkPackagistsilverstripe/framework BackURL validation bypass with malformed URLs7.5 Highsilverstripe/frameworkPackagistSilverstripe External redirection risk in Security?ReturnURL5.8 Mediumsilverstripe/frameworkPackagistSilverstripe X-Forwarded-Host request hostname injection7.2 High- umbraco cms, umbraco-cms +1 moreOpen Redirect Bypass Protection6.1 Medium
- Show moreLoading…