CWE-601 · URL Redirection to Untrusted Site (Open Redirect) (page 11)
Page 11 of 17 — CVEs classified under CWE-601, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-28861 | High | 7.4 | 2022-08-23 | Python 3.x through 3.10 has an open redirection vulnerability in lib/http/server.py due to no protection against multiple (/) at the beginning of URI path whic… |
CVE-2021-3639 | Medium | 6.1 | 2022-08-22 | A flaw was found in mod_auth_mellon where it does not sanitize logout URLs properly. This issue could be used by an attacker to facilitate phishing attacks by… |
CVE-2022-25799 | Medium | 6.1 | 2022-08-16 | An open redirect vulnerability exists in CERT/CC VINCE software prior to 1.50.0. An attacker could send a link that has a specially crafted URL and convince th… |
CVE-2022-35953 | High | 7.1 | 2022-08-12 | BookWyrm is a social network for tracking your reading, talking about books, writing reviews, and discovering what to read next. Some links in BookWyrm may be… |
CVE-2022-28755 | Critical | 9.6 | 2022-08-11 | The Zoom Client for Meetings (for Android, iOS, Linux, macOS, and Windows) before version 5.11.0 are susceptible to a URL parsing vulnerability. If a malicious… |
CVE-2022-31657 | Critical | 9.8 | 2022-08-05 | VMware Workspace ONE Access and Identity Manager contain a URL injection vulnerability. A malicious actor with network access may be able to redirect an authen… |
CVE-2021-23385 | Medium | 5.4 | 2022-08-02 | This affects all versions of package Flask-Security. When using the get_post_logout_redirect and get_post_login_redirect functions, it is possible to bypass UR… |
CVE-2022-31193 | High | 7.1 | 2022-08-01 | DSpace open source software is a repository application which provides durable access to digital resources. dspace-jspui is a UI component for DSpace. The JSPU… |
CVE-2022-27509 | Medium | 6.1 | 2022-07-28 | Unauthenticated redirection to a malicious website |
CVE-2022-30706 | Medium | 6.1 | 2022-07-26 | Open redirect vulnerability in Booked versions prior to 3.3 allows a remote unauthenticated attacker to redirect a user to an arbitrary web site and conduct a… |
CVE-2022-35652 | Medium | 6.1 | 2022-07-25 | An open redirect issue was found in Moodle due to improper sanitization of user-supplied data in mobile auto-login feature. A remote attacker can create a link… |
CVE-2022-31151 | Low | 3.7 | 2022-07-21 | Authorization headers are cleared on cross-origin redirect. However, cookie headers which are sensitive headers and are official headers found in the spec, rem… |
CVE-2022-25803 | Medium | 6.1 | 2022-07-14 | Best Practical Request Tracker (RT) before 5.0.3 has an Open Redirect via a ticket search. |
CVE-2022-33712 | Medium | 5.3 | 2022-07-12 | Intent redirection vulnerability using implict intent in Camera prior to versions 12.0.01.64 ,12.0.3.23, 12.0.0.98, 12.0.6.11, 12.0.3.19 in Android S(12) allow… |
CVE-2022-35406 | Medium | 4.3 | 2022-07-08 | A URL disclosure issue was discovered in Burp Suite before 2022.6. If a user views a crafted response in the Repeater or Intruder, it may be incorrectly interp… |
CVE-2022-2250 | Medium | 4.7 | 2022-07-01 | An open redirect vulnerability in GitLab EE/CE affecting all versions from 11.1 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1.1, allows an att… |
CVE-2017-20119 | Low | 3.5 | 2022-06-29 | A vulnerability classified as problematic has been found in TrueConf Server 4.3.7. This affects an unknown part of the file /admin/general/change-lang. The man… |
CVE-2022-2252 | Medium | 6.1 | 2022-06-29 | Open Redirect in GitHub repository microweber/microweber prior to 1.2.19. |
CVE-2020-26877 | Medium | 6.1 | 2022-06-29 | ApiFest OAuth 2.0 Server 0.3.1 does not validate the redirect URI in accordance with RFC 6749 and is susceptible to an open redirector attack. Specifically, it… |
CVE-2022-29272 | Medium | 6.1 | 2022-06-29 | In Nagios XI through 5.8.5, an open redirect vulnerability exists in the login function that could lead to spoofing. |
CVE-2022-30562 | Medium | 4.7 | 2022-06-28 | If the user enables the https function on the device, an attacker can modify the user’s request data packet through a man-in-the-middle attack ,Injection of a… |
CVE-2022-33146 | Medium | 6.1 | 2022-06-27 | Open redirect vulnerability in web2py versions prior to 2.22.5 allows a remote attacker to redirect a user to an arbitrary web site and conduct a phishing atta… |
CVE-2022-23078 | | 2022-06-22 | In habitica versions v4.119.0 through v4.232.2 are vulnerable to open redirect via the login page. | |
CVE-2022-32444 | Medium | 6.1 | 2022-06-17 | An issue was discovered in u5cms verion 8.3.5 There is a URL redirection vulnerability that can cause a user's browser to be redirected to another site via /lo… |
CVE-2022-31040 | High | 7.1 | 2022-06-13 | Open Forms is an application for creating and publishing smart forms. Prior to versions 1.0.9 and 1.1.1, the cookie consent page in Open Forms contains an open… |
CVE-2022-24969 | Medium | 6.1 | 2022-06-09 | bypass CVE-2021-25640 > In Apache Dubbo prior to 2.6.12 and 2.7.15, the usage of parseURL method will lead to the bypass of the white host check which can caus… |
CVE-2022-29718 | Medium | 6.1 | 2022-06-02 | Caddy v2.4 was discovered to contain an open redirect vulnerability. A remote unauthenticated attacker may exploit this vulnerability to redirect users to arbi… |
CVE-2022-23237 | Medium | 6.1 | 2022-06-02 | E-Series SANtricity OS Controller Software 11.x versions through 11.70.2 are vulnerable to host header injection attacks that could allow an attacker to redire… |
CVE-2022-29214 | Medium | 6.1 | 2022-05-21 | NextAuth.js (next-auth) is am open source authentication solution for Next.js applications. Prior to versions 3.29.3 and 4.3.3, an open redirect vulnerability… |
CVE-2022-29170 | Medium | 6.6 | 2022-05-20 | Grafana is an open-source platform for monitoring and observability. In Grafana Enterprise, the Request security feature allows list allows to configure Grafan… |
CVE-2022-1774 | Medium | 6.1 | 2022-05-18 | Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository jgraph/drawio prior to 18.0.7. |
CVE-2022-30992 | Medium | 6.1 | 2022-05-18 | Open redirect via user-controlled query parameter. The following products are affected: Acronis Cyber Protect 15 (Linux, Windows) before build 29240 |
CVE-2022-1702 | Medium | 6.1 | 2022-05-13 | SonicWall SMA1000 series firmware 12.4.0, 12.4.1-02965 and earlier versions accept a user-controlled input that specifies a link to an external site and uses t… |
CVE-2022-22797 | Medium | 4.6 | 2022-05-12 | Sysaid – sysaid Open Redirect - An Attacker can change the redirect link at the parameter "redirectURL" from"GET" request from the url location: /CommunitySSOR… |
CVE-2022-1209 | Medium | 4.3 | 2022-05-10 | The Ultimate Member plugin for WordPress is vulnerable to arbitrary redirects due to insufficient validation on supplied URLs in the social fields of the Profi… |
CVE-2021-44054 | Medium | 4.3 | 2022-05-05 | An open redirect vulnerability has been reported to affect QNAP device running QuTScloud, QuTS hero and QTS. If exploited, this vulnerability allows attackers… |
CVE-2022-20794 | Medium | 6.5 | 2022-05-04 | Multiple vulnerabilities in the web engine of Cisco TelePresence Collaboration Endpoint (CE) Software and Cisco RoomOS Software could allow a remote attacker t… |
CVE-2022-20764 | Medium | 6.5 | 2022-05-04 | Multiple vulnerabilities in the web engine of Cisco TelePresence Collaboration Endpoint (CE) Software and Cisco RoomOS Software could allow a remote attacker t… |
CVE-2022-27461 | Medium | 6.1 | 2022-05-04 | In nopCommerce 4.50.1, an open redirect vulnerability can be triggered by luring a user to authenticate to a nopCommerce page by clicking on a crafted link. |
CVE-2022-26326 | Medium | 4.0 | 2022-05-02 | Potential open redirection vulnerability when URL is crafted in specific format in NetIQ Access Manager prior to 5.0.2 |
CVE-2022-24887 | Medium | 4.3 | 2022-04-27 | Nextcloud Talk is a video and audio conferencing app for Nextcloud, a self-hosted productivity platform. Prior to versions 11.3.4, 12.2.2, and 13.0.0, when sha… |
CVE-2021-25111 | Medium | 6.1 | 2022-04-25 | The English WordPress Admin WordPress plugin before 1.5.2 does not validate the admin_custom_language_return_url before redirecting users o it, leading to an o… |
CVE-2020-14118 | Medium | 6.1 | 2022-04-21 | An intent redirection vulnerability in the Mi App Store product. This vulnerability is caused by the Mi App Store does not verify the validity of the incoming… |
CVE-2022-1254 | Medium | 6.1 | 2022-04-20 | A URL redirection vulnerability in Skyhigh SWG in main releases 10.x prior to 10.2.9, 9.x prior to 9.2.20, 8.x prior to 8.2.27, and 7.x prior to 7.8.2.31, and… |
CVE-2022-24858 | Medium | 6.1 | 2022-04-19 | next-auth v3 users before version 3.29.2 are impacted. next-auth version 4 users before version 4.3.2 are also impacted. Upgrading to 3.29.2 or 4.3.2 will patc… |
CVE-2022-1019 | Medium | 5.2 | 2022-04-19 | Automated Logic's WebCtrl Server Version 6.1 'Help' index pages are vulnerable to open redirection. The vulnerability allows an attacker to send a maliciously… |
CVE-2022-0645 | Medium | 6.1 | 2022-04-19 | Open redirect vulnerability via endpoint authorize_and_redirect/?redirect= in GitHub repository posthog/posthog prior to 1.34.1. |
CVE-2020-25154 | Medium | 5.4 | 2022-04-14 | An open redirect vulnerability in the administrative interface of the B. Braun Melsungen AG SpaceCom device Version L81/U61 and earlier, and the Data module co… |
CVE-2022-27256 | Medium | 6.1 | 2022-04-13 | A PHP Local File inclusion vulnerability in the Redbasic theme for Hubzilla before version 7.2 allows remote attackers to include arbitrary php files via the s… |
CVE-2022-28215 | Medium | 4.7 | 2022-04-12 | SAP NetWeaver ABAP Server and ABAP Platform - versions 740, 750, 787, allows an unauthenticated attacker to redirect users to a malicious site due to insuffici… |
CVE-2022-27110 | Medium | 5.4 | 2022-04-06 | OrangeHRM 4.10 is vulnerable to a Host header injection redirect via viewPersonalDetails endpoint. |
CVE-2022-27109 | Medium | 5.4 | 2022-04-06 | OrangeHRM 4.10 suffers from a Referer header injection redirect vulnerability. |
CVE-2022-27463 | Medium | 6.1 | 2022-04-05 | Open redirect vulnerability in objects/login.json.php in WWBN AVideo through 11.6, allows attackers to arbitrarily redirect users from a crafted url to the log… |
CVE-2022-1233 | Medium | 6.1 | 2022-04-04 | URL Confusion When Scheme Not Supplied in GitHub repository medialize/uri.js prior to 1.19.11. |
CVE-2022-24794 | High | 7.5 | 2022-03-31 | Express OpenID Connect is an Express JS middleware implementing sign on for Express web apps using OpenID Connect. Users of the `requiresAuth` middleware, eith… |
CVE-2022-23798 | Medium | 6.1 | 2022-03-30 | An issue was discovered in Joomla! 2.5.0 through 3.10.6 & 4.0.0 through 4.1.0. Inadequate validation of URLs could result into an invalid check whether an redi… |
CVE-2022-26950 | Medium | 5.4 | 2022-03-30 | Archer 6.x through 6.9 P2 (6.9.0.2) is affected by an open redirect vulnerability. A remote unprivileged attacker may potentially redirect legitimate users to… |
CVE-2005-10001 | Medium | 5.4 | 2022-03-28 | A vulnerability was found in Netegrity SiteMinder up to 4.5.1 and classified as critical. Affected by this issue is the file /siteminderagent/pwcgi/smpwservice… |
CVE-2022-0283 | Medium | 4.7 | 2022-03-28 | An issue has been discovered affecting GitLab versions prior to 13.5. An open redirect vulnerability was fixed in GitLab integration with Jira that a could cau… |
CVE-2022-24776 | Medium | 6.1 | 2022-03-24 | Flask-AppBuilder is an application development framework, built on top of the Flask web framework. Flask-AppBuilder contains an open redirect vulnerability whe… |
CVE-2022-1058 | Medium | 6.1 | 2022-03-24 | Open Redirect on login in GitHub repository go-gitea/gitea prior to 1.16.5. |
CVE-2022-27090 | Medium | 5.4 | 2022-03-21 | Cscms Music Portal System v4.2 was discovered to contain a redirection vulnerability via the backurl parameter. |
CVE-2022-0165 | Medium | 6.1 | 2022-03-14 | The Page Builder KingComposer WordPress plugin through 2.9.6 does not validate the id parameter before redirecting the user to it via the kc_get_thumbn AJAX ac… |
CVE-2021-32478 | Medium | 6.1 | 2022-03-11 | The redirect URI in the LTI authorization endpoint required extra sanitizing to prevent reflected XSS and open redirect risks. Moodle versions 3.10 to 3.10.3… |
CVE-2022-24739 | High | 7.3 | 2022-03-08 | alltube is an html front end for youtube-dl. On releases prior to 3.0.3, an attacker could craft a special HTML page to trigger either an open redirect attack… |
CVE-2021-41180 | Medium | 4.7 | 2022-03-08 | Nextcloud talk is a self hosting messaging service. In versions prior 12.1.2 an attacker is able to control the link of a geolocation preview in the Nextcloud… |
CVE-2022-0697 | Medium | 6.1 | 2022-03-06 | Open Redirect in GitHub repository archivy/archivy prior to 1.7.0. |
CVE-2022-0868 | Medium | 6.1 | 2022-03-06 | Open Redirect in GitHub repository medialize/uri.js prior to 1.19.10. |
CVE-2022-0869 | Medium | 6.1 | 2022-03-06 | Multiple Open Redirect in GitHub repository nitely/spirit prior to 0.12.3. |
CVE-2021-46379 | Medium | 6.1 | 2022-03-04 | DLink DIR850 ET850-1.08TRb03 is affected by an incorrect access control vulnerability through URL redirection to untrusted site. |
CVE-2021-3654 | Medium | 6.1 | 2022-03-02 | A vulnerability was found in openstack-nova's console proxy, noVNC. By crafting a malicious URL, noVNC could be made to redirect to any desired URL. |
CVE-2022-26158 | Medium | 6.1 | 2022-02-28 | An issue was discovered in the web application in Cherwell Service Management (CSM) 10.2.3. It accepts and reflects arbitrary domains supplied via a client-con… |
CVE-2022-26156 | Medium | 6.1 | 2022-02-28 | An issue was discovered in the web application in Cherwell Service Management (CSM) 10.2.3. Injection of a malicious payload within the RelayState= parameter o… |
CVE-2021-23495 | Medium | 5.4 | 2022-02-25 | The package karma before 6.3.16 are vulnerable to Open Redirect due to missing validation of the return_url query parameter. |
CVE-2022-24330 | Medium | 6.1 | 2022-02-25 | In JetBrains TeamCity before 2021.2.1, a redirection to an external site was possible. |
CVE-2021-29217 | Medium | 6.1 | 2022-02-24 | A remote URL redirection vulnerability was discovered in HPE OneView Global Dashboard version(s): Prior to 2.5. HPE has provided a software update to resolve t… |
CVE-2022-0692 | Medium | 6.1 | 2022-02-21 | Open Redirect on Rudloff/alltube in Packagist rudloff/alltube prior to 3.0.1. |
CVE-2022-25196 | Medium | 5.4 | 2022-02-15 | Jenkins GitLab Authentication Plugin 1.13 and earlier records the HTTP Referer header as part of the URL query parameters when the authentication process start… |
CVE-2022-0597 | Medium | 6.1 | 2022-02-15 | Open Redirect in Packagist microweber/microweber prior to 1.2.11. |
CVE-2021-25033 | Medium | 6.1 | 2022-02-14 | The WordPress Newsletter Plugin WordPress plugin before 1.6.5 does not validate the to parameter before redirecting the user to its given value, leading to an… |
CVE-2021-46366 | High | 8.8 | 2022-02-11 | An issue in the Login page of Magnolia CMS v6.2.3 and below allows attackers to exploit both an Open Redirect vulnerability and Cross-Site Request Forgery (CSR… |
CVE-2022-0560 | Medium | 6.1 | 2022-02-11 | Open Redirect in Packagist microweber/microweber prior to 1.2.11. |
CVE-2022-23618 | Medium | 4.7 | 2022-02-09 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions there is no protection against UR… |
CVE-2022-23102 | Medium | 6.1 | 2022-02-09 | A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V2.0). Affected products contain an open redirect vulnerability. An attacke… |
CVE-2021-45328 | Medium | 6.1 | 2022-02-08 | Gitea before 1.4.3 is affected by URL Redirection to Untrusted Site ('Open Redirect') via internal URLs. |
CVE-2022-23184 | Medium | 6.1 | 2022-02-07 | In affected Octopus Server versions when the server HTTP and HTTPS bindings are configured to localhost, Octopus Server will allow open redirects. |
CVE-2021-45408 | Medium | 6.1 | 2022-02-04 | Open Redirect vulnerability exists in SeedDMS 6.0.15 in out.Login.php, which llows remote malicious users to redirect users to malicious sites using the "refer… |
CVE-2022-22919 | Medium | 6.1 | 2022-01-30 | Adenza AxiomSL ControllerView through 10.8.1 allows redirection for SSO login URLs. |
CVE-2022-23599 | Medium | 4.3 | 2022-01-28 | Products.ATContentTypes are the core content types for Plone 2.1 - 4.3. Versions of Plone that are dependent on Products.ATContentTypes prior to version 3.0.6… |
CVE-2021-25074 | Medium | 6.1 | 2022-01-24 | The WebP Converter for Media WordPress plugin before 4.0.3 contains a file (passthru.php) which does not validate the src parameter before redirecting the user… |
CVE-2021-25028 | Medium | 6.1 | 2022-01-24 | The Event Tickets WordPress plugin before 5.2.2 does not validate the tribe_tickets_redirect_to parameter before redirecting the user to the given value, leadi… |
CVE-2021-24838 | Medium | 6.1 | 2022-01-17 | The AnyComment WordPress plugin before 0.3.5 has an API endpoint which passes user input via the redirect parameter to the wp_redirect() function without being… |
CVE-2022-0235 | Medium | 6.1 | 2022-01-16 | node-fetch is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor |
CVE-2021-38678 | Medium | 6.1 | 2022-01-14 | An open redirect vulnerability has been reported to affect QNAP device running QcalAgent. If exploited, this vulnerability allows attackers to redirect users t… |
CVE-2021-44528 | Medium | 6.1 | 2022-01-10 | A open redirect vulnerability exists in Action Pack >= 6.0.0 that could allow an attacker to craft a "X-Forwarded-Host" headers in combination with certain "al… |
CVE-2022-0122 | Medium | 6.1 | 2022-01-06 | forge is vulnerable to URL Redirection to Untrusted Site |
CVE-2022-21651 | Medium | 6.8 | 2022-01-05 | Shopware is an open source e-commerce software platform. An open redirect vulnerability has been discovered. Users may be arbitrary redirected due to incomplet… |
CVE-2021-20875 | Medium | 6.1 | 2021-12-24 | Open redirect vulnerability in GroupSession Free edition ver5.1.1 and earlier, GroupSession byCloud ver5.1.1 and earlier, and GroupSession ZION ver5.1.1 and ea… |
CVE-2021-40852 | Medium | 6.1 | 2021-12-17 | TCMAN GIM is affected by an open redirect vulnerability. This vulnerability allows the redirection of user navigation to pages controlled by the attacker. The… |
CVE-2021-43812 | Medium | 6.4 | 2021-12-16 | The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. Versions before 1.6.2 do not filter out certain returnTo param… |