CWE-601 · URL Redirection to Untrusted Site (Open Redirect) (page 12)
Page 12 of 17 — CVEs classified under CWE-601, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-18985 | Medium | 6.1 | 2021-12-15 | An issue in /domain/service/.ewell-known/caldav of Zimbra Collaboration 8.8.12 allows attackers to redirect users to any arbitrary website of their choosing. |
CVE-2021-3829 | Medium | 6.1 | 2021-12-10 | openwhyd is vulnerable to URL Redirection to Untrusted Site |
CVE-2021-43532 | Medium | 6.1 | 2021-12-08 | The 'Copy Image Link' context menu action would copy the final image URL after redirects. By embedding an image that triggered authentication flows - in conjun… |
CVE-2021-43064 | Medium | 4.3 | 2021-12-08 | A url redirection to untrusted site ('open redirect') in Fortinet FortiWeb version 6.4.1 and 6.4.0, version 6.3.15 and below, version 6.2.6 and below allows at… |
CVE-2021-36191 | Medium | 4.1 | 2021-12-08 | A url redirection to untrusted site ('open redirect') in Fortinet FortiWeb version 6.4.1 and below, 6.3.15 and below allows attacker to use the device as proxy… |
CVE-2021-4000 | Medium | 6.1 | 2021-12-03 | showdoc is vulnerable to URL Redirection to Untrusted Site |
CVE-2021-3989 | Medium | 6.1 | 2021-12-01 | showdoc is vulnerable to URL Redirection to Untrusted Site |
CVE-2021-42564 | Medium | 5.4 | 2021-11-30 | An open redirect through HTML injection in confidential messages in Cryptshare before 5.1.0 allows remote attackers (with permission to provide confidential me… |
CVE-2021-43777 | Medium | 6.8 | 2021-11-24 | Redash is a package for data visualization and sharing. In Redash version 10.0 and prior, the implementation of Google Login (via OAuth) incorrectly uses the `… |
CVE-2021-38000 | Medium | 6.1 | 2021-11-23 | Insufficient validation of untrusted input in Intents in Google Chrome on Android prior to 95.0.4638.69 allowed a remote attacker to arbitrarily browser to a m… |
CVE-2021-36332 | Medium | 5.4 | 2021-11-23 | Dell EMC CloudLink 7.1 and all prior versions contain a HTML and Javascript Injection Vulnerability. A remote low privileged attacker, may potentially exploit… |
CVE-2021-41733 | Medium | 6.1 | 2021-11-08 | Oppia 3.1.4 does not verify that certain URLs are valid before navigating to them. |
CVE-2021-1500 | Medium | 5.4 | 2021-11-04 | A vulnerability in the web-based management interface of Cisco Webex Video Mesh could allow an unauthenticated, remote attacker to redirect a user to a malicio… |
CVE-2021-43058 | Medium | 6.1 | 2021-11-01 | An open redirect vulnerability exists in Replicated Classic versions prior to 2.53.1 that could lead to spoofing. To exploit this vulnerability, an attacker co… |
CVE-2021-34764 | Medium | 4.8 | 2021-10-27 | Multiple vulnerabilities in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an attacker to execute a cross-s… |
CVE-2021-34763 | Medium | 4.8 | 2021-10-27 | Multiple vulnerabilities in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an attacker to execute a cross-s… |
CVE-2021-3851 | Medium | 5.4 | 2021-10-19 | firefly-iii is vulnerable to URL Redirection to Untrusted Site |
CVE-2021-22942 | Medium | 6.1 | 2021-10-18 | A possible open redirect vulnerability in the Host Authorization middleware in Action Pack >= 6.0.0 that could allow attackers to redirect users to a malicious… |
CVE-2021-22964 | High | 8.8 | 2021-10-14 | A redirect vulnerability in the `fastify-static` module version >= 4.2.4 and < 4.4.1 allows remote attackers to redirect Mozilla Firefox users to arbitrary web… |
CVE-2021-22963 | Medium | 6.1 | 2021-10-14 | A redirect vulnerability in the fastify-static module version < 4.2.4 allows remote attackers to redirect users to arbitrary websites via a double slash // fol… |
CVE-2021-20806 | Medium | 6.1 | 2021-10-13 | Open redirect vulnerability in Cybozu Remote Service 3.0.0 to 3.1.9 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attac… |
CVE-2021-20031 | Medium | 6.1 | 2021-10-12 | A Host Header Redirection vulnerability in SonicOS potentially allows a remote attacker to redirect firewall management users to arbitrary web domains. |
CVE-2021-34772 | Medium | 4.7 | 2021-10-06 | A vulnerability in the web-based management interface of Cisco Orbital could allow an unauthenticated, remote attacker to redirect users to a malicious webpage… |
CVE-2021-35205 | Medium | 5.4 | 2021-09-30 | NETSCOUT Systems nGeniusONE version 6.3.0 build 1196 allows URL redirection in redirector. |
CVE-2021-41826 | Medium | 6.1 | 2021-09-30 | PlaceOS Authentication Service before 1.29.10.0 allows app/controllers/auth/sessions_controller.rb open redirect. |
CVE-2021-23052 | Medium | 6.1 | 2021-09-14 | On version 14.1.x before 14.1.4.4 and all versions of 13.1.x, an open redirect vulnerability exists on virtual servers enabled with a BIG-IP APM access policy… |
CVE-2021-22526 | Medium | 4.9 | 2021-09-13 | Open Redirection vulnerability in NetIQ Access Manager prior to 5.0.1 and 4.5.4 |
CVE-2021-23435 | High | 7.6 | 2021-09-12 | This affects the package clearance before 2.5.0. The vulnerability can be possible when users are able to set the value of session[:return_to]. If the value us… |
CVE-2021-32805 | High | 7.2 | 2021-09-08 | Flask-AppBuilder is an application development framework, built on top of Flask. In affected versions if using Flask-AppBuilder OAuth, an attacker can share a… |
CVE-2021-39501 | Medium | 6.1 | 2021-09-07 | EyouCMS 1.5.4 is vulnerable to Open Redirect. An attacker can redirect a user to a malicious url via the Logout function. |
CVE-2021-38123 | Medium | 6.1 | 2021-09-07 | Open Redirect vulnerability in Micro Focus Network Automation, affecting Network Automation versions 10.4x, 10.5x, 2018.05, 2018.11, 2019.05, 2020.02, 2020.08… |
CVE-2021-25737 | Low | 2.7 | 2021-09-06 | A security issue was discovered in Kubernetes where a user may be able to redirect pod traffic to private networks on a Node. Kubernetes already prevents creat… |
CVE-2021-39191 | Medium | 4.7 | 2021-09-03 | mod_auth_openidc is an authentication/authorization module for the Apache 2.x HTTP server that functions as an OpenID Connect Relying Party, authenticating use… |
CVE-2021-38343 | Medium | 4.7 | 2021-08-30 | The Nested Pages WordPress plugin <= 3.1.15 was vulnerable to an Open Redirect via the `page` POST parameter in the `npBulkActions`, `npBulkEdit`, `npListingSo… |
CVE-2021-39112 | Medium | 4.8 | 2021-08-25 | Affected versions of Atlassian Jira Server and Data Center allow remote attackers to redirect users to a malicious URL via a reverse tabnapping vulnerability i… |
CVE-2021-30888 | High | 7.4 | 2021-08-24 | An information leakage issue was addressed. This issue is fixed in iOS 15.1 and iPadOS 15.1, macOS Monterey 12.0.1, iOS 14.8.1 and iPadOS 14.8.1, tvOS 15.1, wa… |
CVE-2021-37352 | Medium | 6.1 | 2021-08-13 | An open redirect vulnerability exists in Nagios XI before version 5.8.5 that could lead to spoofing. To exploit the vulnerability, an attacker could send a lin… |
CVE-2021-37699 | Medium | 6.9 | 2021-08-12 | Next.js is an open source website development framework to be used with the React library. In affected versions specially encoded paths could be used when page… |
CVE-2021-22098 | Medium | 6.1 | 2021-08-11 | UAA server versions prior to 75.4.0 are vulnerable to an open redirect vulnerability. A malicious user can exploit the open redirect vulnerability by social en… |
CVE-2021-33707 | Medium | 6.1 | 2021-08-10 | SAP NetWeaver Knowledge Management allows remote attackers to redirect users to arbitrary websites and conduct phishing attacks via a URL stored in a component… |
CVE-2021-33331 | Medium | 6.1 | 2021-08-03 | Open redirect vulnerability in the Notifications module in Liferay Portal 7.0.0 through 7.3.1, and Liferay DXP 7.0 before fix pack 94, 7.1 before fix pack 19 a… |
CVE-2021-21579 | Medium | 6.1 | 2021-08-03 | Dell EMC iDRAC9 versions prior to 4.40.40.00 contain an open redirect vulnerability. A remote unauthenticated attacker may exploit this vulnerability to redire… |
CVE-2021-21578 | Medium | 6.1 | 2021-08-03 | Dell EMC iDRAC9 versions prior to 4.40.40.00 contain an open redirect vulnerability. A remote unauthenticated attacker may exploit this vulnerability to redire… |
CVE-2021-32806 | Medium | 6.5 | 2021-08-02 | Products.isurlinportal is a replacement for isURLInPortal method in Plone. Versions of Products.isurlinportal prior to 1.2.0 have an Open Redirect vulnerabilit… |
CVE-2021-37746 | Medium | 6.1 | 2021-07-30 | textview_uri_security_check in textview.c in Claws Mail before 3.18.0, and Sylpheed through 3.7.0, does not have sufficient link checks before accepting a clic… |
CVE-2021-20789 | Medium | 6.1 | 2021-07-30 | Open redirect vulnerability in GroupSession (GroupSession Free edition from ver2.2.0 to the version prior to ver5.1.0, GroupSession byCloud from ver3.0.3 to th… |
CVE-2020-5329 | Medium | 6.1 | 2021-07-29 | Dell EMC Avamar Server contains an open redirect vulnerability. A remote unauthenticated attacker may exploit this vulnerability to redirect application users… |
CVE-2021-3664 | Medium | 5.3 | 2021-07-26 | url-parse is vulnerable to URL Redirection to Untrusted Site |
CVE-2021-32786 | Medium | 4.7 | 2021-07-22 | mod_auth_openidc is an authentication/authorization module for the Apache 2.x HTTP server that functions as an OpenID Connect Relying Party, authenticating use… |
CVE-2021-35966 | Medium | 6.1 | 2021-07-19 | The specific function of the Orca HCM digital learning platform does not filter input parameters properly, which causing the URL can be redirected to any websi… |
CVE-2021-3647 | Medium | 6.1 | 2021-07-16 | URI.js is vulnerable to URL Redirection to Untrusted Site |
CVE-2021-20534 | Low | 3.5 | 2021-07-15 | IBM Security Verify Access Docker 10.0.0 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to vi… |
CVE-2021-35037 | Medium | 6.1 | 2021-07-12 | Jamf Pro before 10.30.1 allows for an unvalidated URL redirect vulnerability affecting Jamf Pro customers who host their environments on-premises. An attacker… |
CVE-2021-24406 | Medium | 6.1 | 2021-07-06 | The wpForo Forum WordPress plugin before 1.9.7 did not validate the redirect_to parameter in the login form of the forum, leading to an open redirect issue aft… |
CVE-2021-23401 | Medium | 5.4 | 2021-07-05 | This affects all versions of package Flask-User. When using the make_safe_url function, it is possible to bypass URL validation and redirect a user to an arbit… |
CVE-2021-34807 | Medium | 6.1 | 2021-07-02 | An open redirect vulnerability exists in the /preauth Servlet in Zimbra Collaboration Suite through 9.0. To exploit the vulnerability, an attacker would need t… |
CVE-2020-23182 | Medium | 5.4 | 2021-07-02 | The component /php-fusion/infusions/shoutbox_panel/shoutbox_archive.php in PHP-Fusion 9.03.60 allows attackers to redirect victim users to malicious websites v… |
CVE-2021-32721 | Medium | 4.7 | 2021-06-29 | PowerMux is a drop-in replacement for Go's http.ServeMux. In PowerMux versions prior to 1.1.1, attackers may be able to craft phishing links and other open red… |
CVE-2021-20105 | Medium | 6.1 | 2021-06-29 | Machform prior to version 16 is vulnerable to an open redirect in Safari_init.php due to an improperly sanitized 'ref' parameter. |
CVE-2021-34254 | Medium | 6.1 | 2021-06-28 | Umbraco CMS before 7.15.7 is vulnerable to Open Redirection due to insufficient url sanitization on booting.aspx. |
CVE-2021-25655 | Medium | 4.4 | 2021-06-24 | A vulnerability in the system Service Menu component of Avaya Aura Experience Portal may allow URL Redirection to any untrusted site through a crafted attack… |
CVE-2020-18660 | Medium | 6.1 | 2021-06-23 | GetSimpleCMS <=3.3.15 has an open redirect in admin/changedata.php via the redirect function to the url parameter. |
CVE-2021-35206 | Medium | 6.1 | 2021-06-22 | Gitpod before 0.6.0 allows unvalidated redirects. |
CVE-2010-4266 | Medium | 6.1 | 2021-06-22 | It was found in vanilla forums before 2.0.10 a potential linkbait vulnerability in dispatcher. |
CVE-2021-32956 | Medium | 6.1 | 2021-06-18 | Advantech WebAccess/SCADA Versions 9.0.1 and prior is vulnerable to redirection, which may allow an attacker to send a maliciously crafted URL that could resul… |
CVE-2021-24358 | Medium | 6.1 | 2021-06-14 | The Plus Addons for Elementor Page Builder WordPress plugin before 4.1.10 did not validate a redirect parameter on a specifically crafted URL before redirectin… |
CVE-2021-22903 | Medium | 6.1 | 2021-06-11 | The actionpack ruby gem before 6.1.3.2 suffers from a possible open redirect vulnerability. Specially crafted Host headers in combination with certain "allowed… |
CVE-2021-23393 | Medium | 5.4 | 2021-06-11 | This affects the package Flask-Unchained before 0.9.0. When using the the _validate_redirect_url function, it is possible to bypass URL validation and redirect… |
CVE-2020-18268 | Medium | 6.1 | 2021-06-07 | Open Redirect in Z-BlogPHP v1.5.2 and earlier allows remote attackers to obtain sensitive information via the "redirect" parameter in the component "zb_system/… |
CVE-2021-31252 | Medium | 6.1 | 2021-06-04 | An open redirect vulnerability exists in BF-630, BF-450M, BF-430, BF-431, BF631-W, BF830-W, Webpass, and SEMAC devices from CHIYU Technology that can be exploi… |
CVE-2021-1525 | Medium | 4.7 | 2021-06-04 | A vulnerability in Cisco Webex Meetings and Cisco Webex Meetings Server could allow an unauthenticated, remote attacker to redirect users to a malicious file… |
CVE-2021-25640 | Medium | 6.1 | 2021-06-01 | In Apache Dubbo prior to 2.6.9 and 2.7.9, the usage of parseURL method will lead to the bypass of white host check which can cause open redirect or SSRF vulner… |
CVE-2021-32645 | Medium | 6.1 | 2021-05-27 | Tenancy multi-tenant is an open source multi-domain controller for the Laravel web framework. In some situations, it is possible to have open redirects where u… |
CVE-2021-23387 | Medium | 5.4 | 2021-05-24 | The package trailing-slash before 2.0.1 are vulnerable to Open Redirect via the use of trailing double slashes in the URL when accessing the vulnerable endpoin… |
CVE-2021-1358 | Medium | 4.7 | 2021-05-22 | A vulnerability in the web-based management interface of Cisco Finesse could allow an unauthenticated, remote attacker to redirect a user to an undesired web p… |
CVE-2021-29622 | Medium | 6.5 | 2021-05-19 | Prometheus is an open-source monitoring system and time series database. In 2.23.0, Prometheus changed its default UI to the New ui. To ensure a seamless trans… |
CVE-2020-36365 | Medium | 6.1 | 2021-05-19 | Smartstore (aka SmartStoreNET) before 4.1.0 allows CommonController.ClearCache, ClearDatabaseCache, RestartApplication, and ScheduleTaskController.Edit open re… |
CVE-2021-32618 | Low | 3.1 | 2021-05-17 | The Python "Flask-Security-Too" package is used for adding security features to your Flask application. It is an is an independently maintained version of Flas… |
CVE-2021-23384 | Medium | 5.4 | 2021-05-17 | The package koa-remove-trailing-slashes before 2.0.2 are vulnerable to Open Redirect via the use of trailing double slashes in the URL when accessing the vulne… |
CVE-2021-24288 | Medium | 6.1 | 2021-05-17 | When subscribing using AcyMailing, the 'redirect' parameter isn't properly sanitized. Turning the request from POST to GET, an attacker can craft a link contai… |
CVE-2021-27612 | Medium | 6.1 | 2021-05-11 | In specific situations SAP GUI for Windows until and including 7.60 PL9, 7.70 PL0, forwards a user to specific malicious website which could contain malware or… |
CVE-2021-1397 | Medium | 4.7 | 2021-05-06 | A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) Software could allow an unauthenticated, remote attacker… |
CVE-2020-13662 | Medium | 6.1 | 2021-05-05 | Open Redirect vulnerability in Drupal Core allows a user to be tricked into visiting a specially crafted link which would redirect them to an arbitrary externa… |
CVE-2020-23015 | Medium | 6.1 | 2021-05-03 | An open redirect issue was discovered in OPNsense through 20.1.5. The redirect parameter "url" in login page was not filtered and can redirect user to any webs… |
CVE-2021-29137 | Medium | 6.1 | 2021-04-29 | A remote URL redirection vulnerability was discovered in Aruba AirWave Management Platform version(s) prior to 8.2.12.1. Aruba has released patches for AirWave… |
CVE-2021-31879 | Medium | 6.1 | 2021-04-29 | GNU Wget through 1.21.1 does not omit the Authorization header upon a redirect to a different origin, a related issue to CVE-2018-1000007. |
CVE-2020-21998 | Medium | 6.1 | 2021-04-27 | In HomeAutomation 3.3.2 input passed via the 'redirect' GET parameter in 'api.php' script is not properly verified before being used to redirect users. This ca… |
CVE-2021-28125 | Medium | 6.1 | 2021-04-27 | Apache Superset up to and including 1.0.1 allowed for the creation of an external URL that could be malicious. By not checking user input for open redirects th… |
CVE-2021-29456 | Medium | 5.7 | 2021-04-21 | Authelia is an open-source authentication and authorization server providing 2-factor authentication and single sign-on (SSO) for your applications via a web p… |
CVE-2021-21392 | Medium | 6.3 | 2021-04-12 | Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant Messaging and VoIP… |
CVE-2021-24210 | Medium | 6.1 | 2021-04-05 | There is an open redirect in the PhastPress WordPress plugin before 1.111 that allows an attacker to malform a request to a page with the plugin and then redir… |
CVE-2021-24165 | Medium | 6.1 | 2021-04-05 | In the Ninja Forms Contact Form WordPress plugin before 3.4.34, the wp_ajax_nf_oauth_connect AJAX action was vulnerable to open redirect due to the use of a us… |
CVE-2020-9995 | Medium | 6.1 | 2021-04-02 | An issue existed in the parsing of URLs. This issue was addressed with improved input validation. This issue is fixed in macOS Server 5.11. Processing a malici… |
CVE-2021-29652 | Medium | 6.1 | 2021-04-02 | Pomerium from version 0.10.0-0.13.3 has an Open Redirect in the user sign-in/out process |
CVE-2021-29651 | Medium | 6.1 | 2021-04-02 | Pomerium before 0.13.4 has an Open Redirect (issue 1 of 2). |
CVE-2020-24550 | Medium | 6.1 | 2021-03-31 | An Open Redirect vulnerability in EpiServer Find before 13.2.7 allows an attacker to redirect users to untrusted websites via the _t_redirect parameter in a cr… |
CVE-2021-27352 | Medium | 5.4 | 2021-03-29 | An open redirect vulnerability in Ilch CMS version 2.1.42 allows attackers to redirect users to an attacker's site after a successful login. |
CVE-2021-1629 | Medium | 6.1 | 2021-03-26 | Tableau Server fails to validate certain URLs that are embedded in emails sent to Tableau Server users. |
CVE-2021-23888 | Medium | 6.3 | 2021-03-26 | Unvalidated client-side URL redirect vulnerability in McAfee ePolicy Orchestrator (ePO) prior to 5.10 Update 10 could cause an authenticated ePO user to load a… |
CVE-2020-12483 | High | 8.2 | 2021-03-23 | The appstore before 8.12.0.0 exposes some of its components, and the attacker can cause remote download and install apps through carefully constructed paramete… |