CWE-601 · URL Redirection to Untrusted Site (Open Redirect) (page 10)
Page 10 of 17 — CVEs classified under CWE-601, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-22263 | Medium | 5.4 | 2023-03-22 | Experience Manager versions 6.5.15.0 (and earlier) are affected by a URL Redirection to Untrusted Site ('Open Redirect') vulnerability. A low-privilege authent… |
CVE-2023-22262 | Medium | 5.4 | 2023-03-22 | Experience Manager versions 6.5.15.0 (and earlier) are affected by a URL Redirection to Untrusted Site ('Open Redirect') vulnerability. A low-privilege authent… |
CVE-2023-22261 | Medium | 5.4 | 2023-03-22 | Experience Manager versions 6.5.15.0 (and earlier) are affected by a URL Redirection to Untrusted Site ('Open Redirect') vulnerability. A low-privilege authent… |
CVE-2023-22260 | Medium | 5.4 | 2023-03-22 | Experience Manager versions 6.5.15.0 (and earlier) are affected by a URL Redirection to Untrusted Site ('Open Redirect') vulnerability. A low-privilege authent… |
CVE-2023-22259 | Medium | 5.4 | 2023-03-22 | Experience Manager versions 6.5.15.0 (and earlier) are affected by a URL Redirection to Untrusted Site ('Open Redirect') vulnerability. A low-privilege authent… |
CVE-2023-22258 | Medium | 5.4 | 2023-03-22 | Experience Manager versions 6.5.15.0 (and earlier) are affected by a URL Redirection to Untrusted Site ('Open Redirect') vulnerability. A low-privilege authent… |
CVE-2023-22257 | Medium | 5.4 | 2023-03-22 | Experience Manager versions 6.5.15.0 (and earlier) are affected by a URL Redirection to Untrusted Site ('Open Redirect') vulnerability. A low-privilege authent… |
CVE-2023-22256 | Medium | 5.4 | 2023-03-22 | Experience Manager versions 6.5.15.0 (and earlier) are affected by a URL Redirection to Untrusted Site ('Open Redirect') vulnerability. A low-privilege authent… |
CVE-2022-37940 | Medium | 5.3 | 2023-03-22 | Potential security vulnerabilities have been identified in the HPE FlexFabric 5700 Switch Series. These vulnerabilities could be remotely exploited to allow ho… |
CVE-2023-0681 | Medium | 4.3 | 2023-03-20 | Rapid7 InsightVM versions 6.6.178 and lower suffers from an open redirect vulnerability, whereby an attacker has the ability to redirect the user to a site of… |
CVE-2023-24892 | High | 8.2 | 2023-03-14 | Microsoft Edge (Chromium-based) Webview2 Spoofing Vulnerability |
CVE-2023-23395 | Low | 3.1 | 2023-03-14 | Microsoft SharePoint Server Spoofing Vulnerability |
CVE-2022-3381 | Medium | 4.3 | 2023-03-09 | An issue has been discovered in GitLab affecting all versions starting from 10.0 to 15.7.8, 15.8 prior to 15.8.4 and 15.9 prior to 15.9.2. A crafted URL could… |
CVE-2022-4317 | Medium | 5.0 | 2023-03-09 | An issue has been discovered in GitLab DAST analyzer affecting all versions starting from 1.47 before 3.0.51, which sends custom request headers in redirects. |
CVE-2023-24735 | Medium | 6.1 | 2023-03-06 | PMB v7.4.6 was discovered to contain an open redirect vulnerability via the component /opac_css/pmb.php. This vulnerability allows attackers to redirect victim… |
CVE-2023-22432 | Medium | 6.1 | 2023-03-06 | Open redirect vulnerability exists in web2py versions prior to 2.23.1. When using the tool, a web2py user may be redirected to an arbitrary website by accessin… |
CVE-2020-36665 | Medium | 5.5 | 2023-03-04 | A vulnerability was found in Artesãos SEOTools up to 0.17.1 and classified as critical. This issue affects the function eachValue of the file TwitterCards.php… |
CVE-2020-36664 | Medium | 5.5 | 2023-03-04 | A vulnerability has been found in Artesãos SEOTools up to 0.17.1 and classified as problematic. This vulnerability affects the function setTitle of the file SE… |
CVE-2020-36663 | Medium | 5.5 | 2023-03-04 | A vulnerability, which was classified as problematic, was found in Artesãos SEOTools up to 0.17.1. This affects the function makeTag of the file OpenGraph.php… |
CVE-2022-2837 | Medium | 6.1 | 2023-03-03 | A flaw was found in coreDNS. This flaw allows a malicious user to redirect traffic intended for external top-level domains (TLD) to a pod they control by creat… |
CVE-2023-27292 | Medium | 5.4 | 2023-02-28 | An open redirect vulnerability exposes OpenCATS to template injection due to improper validation of user-supplied GET parameters. |
CVE-2022-46784 | Medium | 6.1 | 2023-02-23 | SquaredUp Dashboard Server SCOM edition before 5.7.1 GA allows open redirection. (The issue was originally found in 5.5.1 GA.) |
CVE-2022-38779 | Medium | 6.1 | 2023-02-22 | An open redirect issue was discovered in Kibana that could lead to a user being redirected to an arbitrary website if they use a maliciously crafted Kibana URL. |
CVE-2022-0637 | Medium | 6.1 | 2023-02-16 | open redirect in pollbot (pollbot.services.mozilla.com) in versions before 1.4.6 |
CVE-2023-23860 | Medium | 6.1 | 2023-02-14 | SAP NetWeaver AS for ABAP and ABAP Platform - versions 740, 750, 751, 752, 753, 754, 755, 756, 757, 789, 790, allows an unauthenticated attacker to craft a lin… |
CVE-2023-23855 | Medium | 6.5 | 2023-02-14 | SAP Solution Manager - version 720, allows an authenticated attacker to redirect users to a malicious site due to insufficient URL validation. A successful att… |
CVE-2023-23853 | Medium | 6.1 | 2023-02-14 | An unauthenticated attacker in AP NetWeaver Application Server for ABAP and ABAP Platform - versions 700, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757… |
CVE-2022-38657 | High | 8.2 | 2023-02-12 | An open redirect to malicious sites can occur when accessing the "Feedback" action on the manager page. |
CVE-2023-22798 | Medium | 6.1 | 2023-02-09 | Prior to commit 51867e0d15a6d7f80d5b714fd0e9976b9c160bb0, https://github.com/brave/adblock-lists removed redirect interceptors on some websites like Facebook i… |
CVE-2023-22797 | Medium | 6.1 | 2023-02-09 | An open redirect vulnerability is fixed in Rails 7.0.4.1 with the new protection against open redirects from calling redirect_to with untrusted user input. In… |
CVE-2023-0748 | Medium | 6.4 | 2023-02-08 | Open Redirect in GitHub repository btcpayserver/btcpayserver prior to 1.7.6. |
CVE-2022-28923 | Medium | 6.1 | 2023-02-06 | Caddy v2.4.6 was discovered to contain an open redirection vulnerability which allows attackers to redirect users to phishing websites via crafted URLs. |
CVE-2023-22418 | Medium | 6.1 | 2023-02-01 | On versions 17.0.x before 17.0.0.2, 16.1.x before 16.1.3.3, 15.1.x before 15.1.7, 14.1.x before 14.1.5.3, and all versions of 13.1.x, an open redirect vulnerab… |
CVE-2022-44718 | Low | 3.5 | 2023-01-27 | An issue was discovered in NetScout nGeniusONE 6.3.2 build 904. Open Redirection can occur (issue 2 of 2). After successful login, an attacker must visit the v… |
CVE-2022-44717 | Low | 3.1 | 2023-01-27 | An issue was discovered in NetScout nGeniusONE 6.3.2 build 904. Open Redirection can occur (issue 1 of 2). After successful login, an attacker must visit the v… |
CVE-2023-24445 | Medium | 6.1 | 2023-01-26 | Jenkins OpenID Plugin 2.4 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins. |
CVE-2023-24044 | Medium | 6.1 | 2023-01-22 | A Host Header Injection issue on the Login page of Plesk Obsidian through 18.0.49 allows attackers to redirect users to malicious websites via a Host request h… |
CVE-2023-22298 | Medium | 6.1 | 2023-01-17 | Open redirect vulnerability in pgAdmin 4 versions prior to v6.14 allows a remote unauthenticated attacker to redirect a user to an arbitrary web site and condu… |
CVE-2022-43721 | Medium | 5.4 | 2023-01-16 | An authenticated attacker with update datasets permission could change a dataset link to an untrusted site, users could be redirected to this site when clickin… |
CVE-2015-10052 | Medium | 4.6 | 2023-01-15 | ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as problematic, was found in calesanz gibb-modul-151. This affects the function bearbeite… |
CVE-2022-3145 | Medium | 4.7 | 2023-01-12 | An open redirect vulnerability exists in Okta OIDC Middleware prior to version 5.0.0 allowing an attacker to redirect a user to an arbitrary URL. |
CVE-2022-39183 | Medium | 6.5 | 2023-01-12 | Moodle Plugin - SAML Auth may allow Open Redirect through unspecified vectors. |
CVE-2023-0042 | Medium | 6.1 | 2023-01-12 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.4 prior to 15.5.7, 15.6 prior to 15.6.4, and 15.7 prior to 15.7.2. GitLab… |
CVE-2023-22958 | Medium | 6.1 | 2023-01-11 | The Syracom Secure Login plugin before 3.1.1.0 for Jira may allow spoofing of 2FA PIN validation via the plugins/servlet/twofactor/public/pinvalidation target… |
CVE-2017-20164 | Medium | 6.3 | 2023-01-07 | A vulnerability was found in Symbiote Seed up to 6.0.2. It has been classified as critical. Affected is the function onBeforeSecurityLogin of the file code/ext… |
CVE-2022-3614 | Medium | 6.1 | 2023-01-03 | In affected versions of Octopus Deploy users of certain browsers using AD to sign-in to Octopus Server were able to bypass authentication checks and be redirec… |
CVE-2022-38208 | Medium | 6.1 | 2022-12-29 | There is an unvalidated redirect vulnerability in Esri Portal for ArcGIS 11 and below that may allow a remote, unauthenticated attacker to craft a URL that cou… |
CVE-2022-4720 | Medium | 6.1 | 2022-12-27 | Open Redirect in GitHub repository ikus060/rdiffweb prior to 2.5.5. |
CVE-2020-36627 | Medium | 5.5 | 2022-12-25 | A vulnerability was found in Macaron i18n. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file i18n.go… |
CVE-2022-45413 | Medium | 6.1 | 2022-12-22 | Using the <code>S.browser_fallback_url parameter</code> parameter, an attacker could redirect a user to a URL and cause SameSite=Strict cookies to be sent.<br>… |
CVE-2022-36316 | Medium | 6.1 | 2022-12-22 | When using the Performance API, an attacker was able to notice subtle differences between PerformanceEntries and thus learn whether the target URL had been sub… |
CVE-2022-34478 | Medium | 6.5 | 2022-12-22 | The <code>ms-msdt</code>, <code>search</code>, and <code>search-ms</code> protocols deliver content to Microsoft applications, bypassing the browser, when a us… |
CVE-2022-34474 | Medium | 6.1 | 2022-12-22 | Even when an iframe was sandboxed with <code>allow-top-navigation-by-user-activation</code>, if it received a redirect header to an external protocol the brows… |
CVE-2022-29912 | Medium | 6.1 | 2022-12-22 | Requests initiated through reader mode did not properly omit cookies with a SameSite attribute. This vulnerability affects Thunderbird < 91.9, Firefox ESR < 91… |
CVE-2022-29910 | Medium | 6.1 | 2022-12-22 | When closed or sent to the background, Firefox for Android would not properly record and persist HSTS settings.<br>*Note: This issue only affected Firefox for… |
CVE-2022-4644 | Medium | 6.1 | 2022-12-22 | Open Redirect in GitHub repository ikus060/rdiffweb prior to 2.5.4. |
CVE-2022-44488 | Low | 3.5 | 2022-12-19 | Adobe Experience Manager version 6.5.14 (and earlier) is affected by a URL Redirection to Untrusted Site ('Open Redirect') vulnerability. A low-privilege authe… |
CVE-2021-4260 | Medium | 6.3 | 2022-12-19 | A vulnerability was found in oils-js. It has been declared as critical. This vulnerability affects unknown code of the file core/Web.js. The manipulation leads… |
CVE-2022-47500 | Medium | 6.1 | 2022-12-19 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Apache Software Foundation Apache Helix UI component.This issue affects Apache Helix all r… |
CVE-2022-38662 | Medium | 6.1 | 2022-12-19 | In HCL Digital Experience, URLs can be constructed to redirect users to untrusted sites. |
CVE-2022-46288 | Medium | 6.1 | 2022-12-19 | Open redirect vulnerability in DENSHI NYUSATSU CORE SYSTEM v6 R4 and earlier allows a remote unauthenticated attacker to redirect a user to an arbitrary web si… |
CVE-2022-4589 | Medium | 5.5 | 2022-12-17 | A vulnerability has been found in cyface Terms and Conditions Module up to 2.0.9 and classified as problematic. Affected by this vulnerability is the function… |
CVE-2022-23527 | Medium | 4.7 | 2022-12-14 | mod_auth_openidc is an OpenID Certified™ authentication and authorization module for the Apache 2.x HTTP server. Versions prior to 2.4.12.2 are vulnerable to O… |
CVE-2022-41275 | Medium | 6.1 | 2022-12-13 | In SAP Solution Manager (Enterprise Search) - versions 740, and 750, an unauthenticated attacker can generate a link that, if clicked by a logged-in user, can… |
CVE-2022-41273 | Medium | 4.3 | 2022-12-13 | Due to improper input sanitization in SAP Sourcing and SAP Contract Lifecycle Management - version 1100, an attacker can redirect a user to a malicious website… |
CVE-2022-37927 | Medium | 6.1 | 2022-12-12 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Hewlett Packard Enterprise HPE OneView Global Dashboard (OVGD). |
CVE-2022-46683 | Medium | 6.1 | 2022-12-12 | Jenkins Google Login Plugin 1.4 through 1.6 (both inclusive) improperly determines that a redirect URL after login is legitimately pointing to Jenkins. |
CVE-2022-45917 | Medium | 6.1 | 2022-12-07 | ILIAS before 7.16 has an Open Redirect. |
CVE-2022-41559 | Critical | 9.3 | 2022-12-06 | The Web Client component of TIBCO Software Inc.'s TIBCO Nimbus contains an easily exploitable vulnerability that allows an unauthenticated attacker with networ… |
CVE-2022-43479 | Medium | 6.1 | 2022-12-05 | Open redirect vulnerability in SHIRASAGI v1.14.4 to v1.15.0 allows a remote unauthenticated attacker to redirect users to an arbitrary web site and conduct a p… |
CVE-2022-41965 | Medium | 5.7 | 2022-11-28 | Opencast is a free, open-source platform to support the management of educational audio and video content. Prior to Opencast 12.5, Opencast's Paella authentica… |
CVE-2021-22141 | Medium | 6.1 | 2022-11-18 | An open redirect flaw was found in Kibana versions before 7.13.0 and 6.8.16. If a logged in user visits a maliciously crafted URL, it could result in Kibana re… |
CVE-2022-38201 | Medium | 6.1 | 2022-11-15 | An unvalidated redirect vulnerability exists in Esri Portal for ArcGIS Quick Capture Web Designer versions 10.8.1 to 10.9.1. A remote, unauthenticated attacker… |
CVE-2022-45402 | Medium | 6.1 | 2022-11-15 | In Apache Airflow versions prior to 2.4.3, there was an open redirect in the webserver's `/login` endpoint. |
CVE-2022-3486 | Medium | 4.7 | 2022-11-09 | An open redirect vulnerability in GitLab EE/CE affecting all versions from 9.3 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2, allows an attac… |
CVE-2022-3280 | Low | 3.5 | 2022-11-09 | An open redirect in GitLab CE/EE affecting all versions from 10.1 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2 allows an attacker to trick u… |
CVE-2022-44560 | Medium | 5.3 | 2022-11-09 | The launcher module has an Intent redirection vulnerability. Successful exploitation of this vulnerability may cause launcher module data to be modified. |
CVE-2022-41215 | Medium | 4.7 | 2022-11-08 | SAP NetWeaver ABAP Server and ABAP Platform allows an unauthenticated attacker to redirect users to a malicious site due to insufficient URL validation. This c… |
CVE-2022-41207 | Medium | 6.1 | 2022-11-08 | SAP Biller Direct allows an unauthenticated attacker to craft a legitimate looking URL. When clicked by an unsuspecting victim, it will use an unsensitized par… |
CVE-2022-43985 | Medium | 6.1 | 2022-11-02 | In Apache Airflow versions prior to 2.4.2, there was an open redirect in the webserver's `/confirm` endpoint. |
CVE-2022-3797 | Medium | 6.3 | 2022-11-01 | A vulnerability was found in eolinker apinto-dashboard. It has been rated as problematic. This issue affects some unknown processing of the file /login. The ma… |
CVE-2022-28763 | High | 8.8 | 2022-10-31 | The Zoom Client for Meetings (for Android, iOS, Linux, macOS, and Windows) before version 5.12.2 is susceptible to a URL parsing vulnerability. If a malicious… |
CVE-2022-39021 | Medium | 6.1 | 2022-10-31 | U-Office Force login function has an Open Redirect vulnerability. An unauthenticated remote attacker can exploit this vulnerability to redirect user to arbitra… |
CVE-2022-39359 | Medium | 6.5 | 2022-10-26 | Metabase is data visualization software. Prior to versions 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, 1.42.6, 0.41.9, and 1.41.9, custom GeoJSON map URL address w… |
CVE-2022-38197 | Medium | 6.1 | 2022-10-25 | Esri ArcGIS Server versions 10.9.1 and below have an unvalidated redirect issue that may allow a remote, unauthenticated attacker to phish a user into accessin… |
CVE-2022-26954 | Medium | 6.1 | 2022-10-20 | Multiple open redirect vulnerabilities in NopCommerce 4.10 through 4.50.1 allow remote attackers to conduct phishing attacks by redirecting users to attacker-c… |
CVE-2022-41204 | High | 8.8 | 2022-10-11 | An attacker can change the content of an SAP Commerce - versions 1905, 2005, 2105, 2011, 2205, login page through a manipulated URL. They can inject code that… |
CVE-2022-3438 | Medium | 6.1 | 2022-10-10 | Open Redirect in GitHub repository ikus060/rdiffweb prior to 2.5.0a4. |
CVE-2022-40083 | Critical | 9.6 | 2022-09-28 | Labstack Echo v4.8.0 was discovered to contain an open redirect vulnerability via the Static Handler component. This vulnerability can be leveraged by attacker… |
CVE-2022-39258 | High | 8.1 | 2022-09-27 | mailcow is a mailserver suite. A vulnerability innversions prior to 2022-09 allows an attacker to craft a custom Swagger API template to spoof Authorize links… |
CVE-2022-28977 | Medium | 6.1 | 2022-09-22 | HtmlUtil.escapeRedirect in Liferay Portal 7.3.1 through 7.4.2, and Liferay DXP 7.0 fix pack 91 through 101, 7.1 fix pack 17 through 25, 7.2 fix pack 5 through… |
CVE-2022-40754 | Medium | 6.1 | 2022-09-21 | In Apache Airflow 2.3.0 through 2.3.4, there was an open redirect in the webserver's `/confirm` endpoint. |
CVE-2022-31735 | Medium | 6.1 | 2022-09-15 | OpenAM Consortium Edition version 14.0.0 provided by OpenAM Consortium contains an open redirect vulnerability (CWE-601). When accessing an affected server thr… |
CVE-2022-39814 | Medium | 6.1 | 2022-09-13 | In NOKIA 1350 OMS R14.2, an Open Redirect vulnerability occurs is the login page via next HTTP GET parameter. |
CVE-2022-25295 | Medium | 5.4 | 2022-09-11 | This affects the package github.com/gophish/gophish before 0.12.0. The Open Redirect vulnerability exists in the next query parameter. The application uses url… |
CVE-2022-36087 | Medium | 5.7 | 2022-09-09 | OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. In OAuthLib versions 3.1.1 until 3.2.1, an attacker providing malicious redir… |
CVE-2022-38131 | Medium | 6.1 | 2022-09-06 | RStudio Connect prior to 2023.01.0 is affected by an Open Redirect issue. The vulnerability could allow an attacker to redirect users to malicious websites. |
CVE-2021-29864 | Medium | 6.1 | 2022-08-30 | IBM Security Identity Manager 6.0 and 6.0.2 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to… |
CVE-2020-26938 | High | 7.2 | 2022-08-29 | In oauth2-server (aka node-oauth2-server) through 3.1.1, the value of the redirect_uri parameter received during the authorization and token request is checked… |
CVE-2022-27547 | Medium | 6.1 | 2022-08-29 | HCL iNotes is susceptible to a link to non-existent domain vulnerability. An attacker could use this vulnerability to trick a user into supplying sensitive inf… |