CWE-601: URL Redirection to Untrusted Site
The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.
Also known as Open Redirect, Cross-site Redirect, Cross-domain Redirect.
A kind of CWE-610 Externally Controlled Reference to a Resource in Another Sphere.
From the CWE List. © The MITRE Corporation.
Newest
- zitadelZITADEL: Account Takeover Due to Improper Instance Validation in V2 Login8.1 High
- line corporation central dogmaCentral Dogma's Login Function Has an Open Redirect Vulnerability6.1 Medium
- splunk, splunk cloud platform, enterprise +2 moreURL validation bypass through Views Dashboard in Splunk Enterprise3.5 Low
- fit2cloud jumpserverJumpServer has an Open Redirect Vulnerability5.5 Medium
- fleetdm fleet, mir robot +1 moreOpen redirect in web server of MiR robots and MiR fleet6.1 Medium
- frank goossens wp youtube lyteWordPress WP YouTube Lyte plugin <= 1.7.28 - Open Redirection vulnerability3.4 Low
- automated logic webctrl, carrier i-vu +1 moreALC WebCTRL Carrier i-Vu Open Redirect via URL parameter8.6 High
- solarwinds observability self-hostedSolarWinds Observability Self-Hosted Open Redirection Vulnerability4.8 Medium
- backdropcms backdrop cmsBackdrop CMS Host Header Injection vulnerability6.1 Medium
- google chromeInappropriate implementation in Lens in Google Chrome on iOS prior to 136.0.7103.59 allowed a...6.3 Medium
- jitsi jitsi-meetJitsi Meet has DOM Redirect on Microsoft OAuth Flow2.7 Low
- cisco digital network architecture center (dna center)Cisco Catalyst Center Software HTTP Open Redirect Vulnerability4.7 Medium
- splunk, splunk cloud platform, enterprise +2 moreOpen Redirect on Web Login endpoint in Splunk Enterprise3.1 Low
- sap se s/4hana landscape (sap e-recruiting bsp)Open Redirect vulnerabilities in SAP S/4HANA landscape (SAP E-Recruiting BSP)6.1 Medium
- sap business connectorOpen Redirect vulnerability in SAP Business Connector6.1 Medium
- onlookAn Open Redirect vulnerability exists in the OAuth callback handler in file onlook/apps/web...6.5 Medium
- red hat single sign-on 7Rhsso: open redirect6.1 Medium
- simonw datasetteOpen redirect endpoint in Datasette2.7 Low
- leepeuker movaryMovary unvalidated Referer header allows open redirect and phishing5.1 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal is vulnerable to DNS rebinding attacks5.1 Medium
- leepeuker movaryMovary vulnerable to an open redirect5.1 Medium
- axiomthemes anubisAnubis vulnerable to possible XSS via redir parameter when using subrequest auth mode5.1 Medium
pdf2zhPyPIByaidu PDFMathTranslate vulnerable to open redirect6.1 Medium- zitadelZITADEL Vulnerable to Account Takeover via Malicious Forwarded Header Injection8.1 High
- privatebinPrivateBin persistent HTML injection in attachment filename enables redirect and defacement5.8 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal Vulnerable to Open Redirect via the _com_liferay_layout_admin_web_portlet_GroupPagesPortlet_redirect parameter6.9 Medium
- crm perks wp gravity forms zoho crm and biginWordPress WP Gravity Forms Zoho CRM and Bigin plugin <= 1.2.8 - Open Redirection vulnerability4.7 Medium
- makeplane planePlane Vulnerable to Cross-Site Scripting via Open Redirect in ?next_path Parameter8.1 High
- molgenis emx2Open redirection vulnerability in MOLGENIS EMX25.1 Medium
- crm perks wp gravity forms hubspotWordPress WP Gravity Forms HubSpot Plugin <= 1.2.5 - Open Redirection Vulnerability4.7 Medium
- oracle scriptingVulnerability in the Oracle Scripting product of Oracle E-Business Suite (component:...6.1 Medium
- koajs koaKoa Vulnerable to Open Redirect via Trailing Double-Slash (//) in back Redirect Logic4.3 Medium
- drawing-captcha drawing-captcha-appDrawing-Captcha APP Host Header Injection in `/register` and `/confirm-email` Endpoints8.8 High
- elated-themes frappeFrappe has an Open Redirect on Login Page6.1 Medium
- reflex-dev reflexOpen Redirect in reflex-dev/reflex3.1 Low
- adobe connectAdobe Connect | URL Redirection to Untrusted Site ('Open Redirect') (CWE-601)4.3 Medium
- fortinet fortios, fortiproxy, fortisase +1 more +3 moreAn URL Redirection to Untrusted Site vulnerabilities [CWE-601] in FortiOS 7.6.0 through 7.6.2, 7...2.5 Low
- labredescefetrj wegiaWeGIA Open Redirect Vulnerability in `control.php` endpoint `nextPage` parameter (metodo=listarTodos nomeClasse=AlmoxarifeControle)4.8 Medium
- creativemindssolutions cm registration – tailored tool for seamless login and invitation-based registrationsCM Registration – Tailored tool for seamless login and invitation-based registrations <= 2.5.6 - Open Redirect4.7 Medium
- newforma project centerNewforma Info Exchange (NIX) open URL redirect via /DownloadWeb/hyperlinkredirect.aspx5.3 Medium
- red hat ai inference server, enterprise linux ai (rhel ai) +1 moreVllm: server side request forgery (ssrf) in mediaconnector7.1 High
- logo software inc. cloudOpen Redirect in Logo Software's Logo Cloud5.5 Medium
- labredescefetrj wegiaWeGIA: Open Redirect Vulnerability in `control.php` endpoint4.8 Medium
- absolute secure accessOpen Redirect in Secure Access prior to 14.105.5 Medium
- knime business hubOpen redirect vulnerability in KNIME Business Hub5.3 Medium
- weblateWeblate integration with Anubis can lead to Open Redirect via redir parameter2.1 Low
- No product listedAccount Takeover in Corezoid 6.6.0 in the OAuth2 implementation via an open redirect in the...7.5 High
- esri portal for arcgisBUG-000174150 - Unvalidated redirect in Portal for ArcGIS.6.1 Medium
- esri portal for arcgisBUG-000174149 - The Portal for ArcGIS has an unvalidated redirect.6.1 Medium
- esri portal for arcgisBUG-000171009 - URL manipulation vulnerability in Portal for ArcGIS.6.1 Medium
- Show moreLoading…