CWE-601 · URL Redirection to Untrusted Site (Open Redirect) (page 13)
Page 13 of 17 — CVEs classified under CWE-601, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-21377 | Medium | 4.8 | 2021-03-23 | OMERO.web is open source Django-based software for managing microscopy imaging. OMERO.web before version 5.9.0 supports redirection to a given URL after perfor… |
CVE-2021-21338 | Medium | 4.7 | 2021-03-23 | TYPO3 is an open source PHP based web content management system. In TYPO3 before versions 6.2.57, 7.6.51, 8.7.40, 9.5.25, 10.4.14, 11.1.1 it has been discovere… |
CVE-2019-14831 | Medium | 6.1 | 2021-03-19 | A vulnerability was found in Moodle 3.7 to 3.7.1, 3.6 to 3.6.5, 3.5 to 3.5.7 and earlier unsupported versions, where forum subscribe link contained an open red… |
CVE-2019-14830 | Medium | 6.1 | 2021-03-19 | A vulnerability was found in Moodle 3.7 to 3.7.1, 3.6 to 3.6.5, 3.5 to 3.5.7 and earlier unsupported versions, where the mobile launch endpoint contained an op… |
CVE-2021-21491 | Medium | 6.1 | 2021-03-10 | SAP Netweaver Application Server Java (Applications based on WebDynpro Java) versions 7.00, 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, allow an attacker to redi… |
CVE-2020-28150 | Medium | 6.1 | 2021-03-09 | I-Net Software Clear Reports 20.10.136 web application accepts a user-controlled input that specifies a link to an external site, and uses the user supplied da… |
CVE-2021-21337 | Medium | 5.7 | 2021-03-08 | Products.PluggableAuthService is a pluggable Zope authentication and authorization framework. In Products.PluggableAuthService before version 2.6.0 there is an… |
CVE-2021-21354 | High | 7.4 | 2021-03-08 | Pollbot is open source software which "frees its human masters from the toilsome task of polling for the state of things during the Firefox release process." I… |
CVE-2021-21273 | Low | 3.1 | 2021-02-26 | Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant Messaging and VoIP… |
CVE-2021-21330 | Low | 3.1 | 2021-02-26 | aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. In aiohttp before version 3.7.4 there is an open redirect vulnerability. A mali… |
CVE-2021-3189 | Medium | 6.1 | 2021-02-19 | The slashify package 1.0.0 for Node.js allows open-redirect attacks, as demonstrated by a localhost:3000///example.com/ substring. |
CVE-2021-27404 | Medium | 6.1 | 2021-02-19 | Askey RTF8115VW BR_SV_g11.11_RTF_TEF001_V6.54_V014 devices allow injection of a Host HTTP header. |
CVE-2020-35560 | Medium | 6.1 | 2021-02-16 | An issue was discovered in MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 through 2.6.2. There is an unauthenticated open redirect in the redirect.php. |
CVE-2021-22984 | Medium | 6.1 | 2021-02-12 | On BIG-IP Advanced WAF and ASM version 15.1.x before 15.1.0.2, 15.0.x before 15.0.1.4, 14.1.x before 14.1.2.5, 13.1.x before 13.1.3.4, 12.1.x before 12.1.5.2… |
CVE-2021-22881 | Medium | 6.1 | 2021-02-11 | The Host Authorization middleware in Action Pack before 6.1.2.1, 6.0.3.5 suffers from an open redirect vulnerability. Specially crafted `Host` headers in combi… |
CVE-2020-13565 | Medium | 6.1 | 2021-02-10 | An open redirect vulnerability exists in the return_page redirection functionality of phpGACL 3.3.7, OpenEMR 5.0.2 and OpenEMR development version 6.0.0 (commi… |
CVE-2021-21478 | Medium | 6.1 | 2021-02-09 | SAP Web Dynpro ABAP allow an attacker to redirect users to a malicious site due to Reverse Tabnabbing vulnerabilities. |
CVE-2021-21476 | Medium | 6.1 | 2021-02-09 | SAP UI5 versions before 1.38.49, 1.52.49, 1.60.34, 1.71.31, 1.78.18, 1.84.5, 1.85.4, 1.86.1 allows an unauthenticated attacker to redirect users to a malicious… |
CVE-2020-22840 | Medium | 6.1 | 2021-02-09 | Open redirect vulnerability in b2evolution CMS version prior to 6.11.6 allows an attacker to perform malicious open redirects to an attacker controlled resourc… |
CVE-2021-25757 | Medium | 6.1 | 2021-02-03 | In JetBrains Hub before 2020.1.12629, an open redirect was possible. |
CVE-2021-21291 | Medium | 4.7 | 2021-02-02 | OAuth2 Proxy is an open-source reverse proxy and static file server that provides authentication using Providers (Google, GitHub, and others) to validate accou… |
CVE-2020-29537 | Medium | 4.6 | 2021-01-29 | Archer before 6.8 P2 (6.8.0.2) is affected by an open redirect vulnerability. A remote privileged attacker may potentially redirect legitimate users to arbitra… |
CVE-2020-1723 | Medium | 6.1 | 2021-01-28 | A flaw was found in Keycloak Gatekeeper (Louketo). The logout endpoint can be abused to redirect logged-in users to arbitrary web pages. Affected versions of K… |
CVE-2021-22873 | Medium | 6.1 | 2021-01-26 | Revive Adserver before 5.1.0 is vulnerable to open redirects via the `dest`, `oadest`, and/or `ct0` parameters of the lg.php and ck.php delivery scripts. Such… |
CVE-2021-1218 | Medium | 5.4 | 2021-01-20 | A vulnerability in the web management interface of Cisco Smart Software Manager satellite could allow an authenticated, remote attacker to redirect a user to a… |
CVE-2021-1310 | Medium | 4.7 | 2021-01-13 | A vulnerability in the web-based management interface of Cisco Webex Meetings could allow an unauthenticated, remote attacker to redirect a user to an untruste… |
CVE-2020-26979 | Medium | 6.1 | 2021-01-07 | When a user typed a URL in the address bar or the search bar and quickly hit the enter key, a website could sometimes capture that event and then redirect the… |
CVE-2020-29498 | Medium | 6.1 | 2021-01-04 | Dell Wyse Management Suite versions prior to 3.1 contain an open redirect vulnerability. A remote unauthenticated attacker could potentially exploit this vulne… |
CVE-2020-25846 | High | 7.5 | 2020-12-31 | The digest generation function of NHIServiSignAdapter has not been verified for source file path, which leads to the SMB request being redirected to a maliciou… |
CVE-2020-25845 | High | 7.5 | 2020-12-31 | Multiple functions of NHIServiSignAdapter failed to verify the users’ file path, which leads to the SMB request being redirected to a malicious host, resulting… |
CVE-2020-35678 | Medium | 6.1 | 2020-12-27 | Autobahn|Python before 20.12.3 allows redirect header injection. |
CVE-2020-27729 | Medium | 6.1 | 2020-12-24 | In versions 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, 14.1.0-14.1.3, 13.1.0-13.1.3.4, 12.1.0-12.1.5.2, and 11.6.1-11.6.5.2, an undisclosed link on the BIG-IP APM virtu… |
CVE-2020-4840 | Medium | 6.1 | 2020-12-21 | IBM Security Secret Server 10.6 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a spe… |
CVE-2020-26275 | Medium | 6.1 | 2020-12-21 | The Jupyter Server provides the backend (i.e. the core services, APIs, and REST endpoints) for Jupyter web applications like Jupyter notebook, JupyterLab, and… |
CVE-2020-25901 | Medium | 6.1 | 2020-12-18 | Host Header Injection in Spiceworks 7.5.7.0 allowing the attacker to render arbitrary links that point to a malicious website with poisoned Host header webpage… |
CVE-2020-4849 | Medium | 6.1 | 2020-12-15 | IBM Tivoli Netcool Impact 7.1.0.0 through 7.1.0.19 Interim Fix 7 could allow a remote attacker to bypass security restrictions, caused by a reverse tabnabbing… |
CVE-2020-26836 | Medium | 6.1 | 2020-12-09 | SAP Solution Manager (Trace Analysis), version - 720, allows for misuse of a parameter in the application URL leading to Open Redirect vulnerability, an attack… |
CVE-2020-29565 | Medium | 6.1 | 2020-12-04 | An issue was discovered in OpenStack Horizon before 15.3.2, 16.x before 16.2.1, 17.x and 18.x before 18.3.3, 18.4.x, and 18.5.x. There is a lack of validation… |
CVE-2020-27816 | Medium | 6.1 | 2020-12-02 | The elasticsearch-operator does not validate the namespace where kibana logging resource is created and due to that it is possible to replace the original open… |
CVE-2020-26232 | Medium | 4.1 | 2020-11-24 | Jupyter Server before version 1.0.6 has an Open redirect vulnerability. A maliciously crafted link to a jupyter server could redirect the browser to a differen… |
CVE-2020-28726 | Medium | 6.1 | 2020-11-24 | Open redirect in SeedDMS 6.0.13 via the dropfolderfileform1 parameter to out/out.AddDocument.php. |
CVE-2020-26215 | Medium | 4.4 | 2020-11-18 | Jupyter Notebook before version 6.1.5 has an Open redirect vulnerability. A maliciously crafted link to a notebook server could redirect the browser to a diffe… |
CVE-2020-15300 | Medium | 6.1 | 2020-11-18 | SuiteCRM through 7.11.13 has an Open Redirect in the Documents module via a crafted SVG document. |
CVE-2020-28724 | Medium | 6.1 | 2020-11-18 | Open redirect vulnerability in werkzeug before 0.11.6 via a double slash in the URL. |
CVE-2020-26219 | Medium | 4.7 | 2020-11-11 | touchbase.ai before version 2.0 is vulnerable to Open Redirect. Impacts can be many, and vary from theft of information and credentials, to the redirection to… |
CVE-2020-26161 | Medium | 6.1 | 2020-10-26 | In Octopus Deploy through 2020.4.2, an attacker could redirect users to an external site via a modified HTTP Host header. |
CVE-2020-3558 | Medium | 4.7 | 2020-10-21 | A vulnerability in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an unauthenticated, remote attacker to re… |
CVE-2020-6365 | Medium | 6.1 | 2020-10-15 | SAP NetWeaver AS Java, versions - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, Start Page allows an unauthenticated remote attacker to redirect users to a malicio… |
CVE-2020-24551 | Medium | 6.1 | 2020-10-14 | IProom MMC+ Server login page does not validate specific parameters properly. Attackers can use the vulnerability to redirect to any malicious site and steal t… |
CVE-2020-15241 | Medium | 4.7 | 2020-10-08 | TYPO3 Fluid Engine (package `typo3fluid/fluid`) before versions 2.0.5, 2.1.4, 2.2.1, 2.3.5, 2.4.1, 2.5.5 or 2.6.1 is vulnerable to cross-site scripting when ma… |
CVE-2020-15242 | Medium | 4.7 | 2020-10-08 | Next.js versions >=9.5.0 and <9.5.4 are vulnerable to an Open Redirect. Specially encoded paths could be used with the trailing slash redirect to allow an open… |
CVE-2020-15234 | Medium | 6.1 | 2020-10-02 | ORY Fosite is a security first OAuth2 & OpenID Connect framework for Go. In Fosite before version 0.34.1, the OAuth 2.0 Client's registered redirect URLs and t… |
CVE-2020-15233 | Medium | 6.1 | 2020-10-02 | ORY Fosite is a security first OAuth2 & OpenID Connect framework for Go. In Fosite from version 0.30.2 and before version 0.34.1, there is an issue in which an… |
CVE-2020-15677 | Medium | 6.1 | 2020-10-01 | By exploiting an Open Redirect vulnerability on a website, an attacker could have spoofed the site displayed in the download file dialog to show the original s… |
CVE-2019-15974 | Medium | 6.1 | 2020-09-23 | A vulnerability in the web interface of Cisco Managed Services Accelerator (MSX) could allow an unauthenticated, remote attacker to redirect a user to a malici… |
CVE-2020-4409 | High | 8.2 | 2020-09-16 | IBM Maximo Asset Management 7.6.0 and 7.6.1 could allow a remote attacker to conduct phishing attacks, using a tabnabbing attack. By persuading a victim to vis… |
CVE-2020-5627 | Medium | 6.1 | 2020-09-09 | Yodobashi App for Android versions 1.8.7 and earlier allows remote attackers to lead a user to access an arbitrary website via the vulnerable App. As a result… |
CVE-2020-24554 | High | 7.5 | 2020-09-01 | The redirect module in Liferay Portal before 7.3.3 does not limit the number of URLs resulting in a 404 error that is recorded, which allows remote attackers t… |
CVE-2020-5623 | Medium | 6.1 | 2020-08-28 | NITORI App for Android versions 6.0.4 and earlier and NITORI App for iOS versions 6.0.2 and earlier allow remote attackers to lead a user to access an arbitrar… |
CVE-2020-24598 | Medium | 6.1 | 2020-08-26 | An issue was discovered in Joomla! before 3.9.21. Lack of input validation in the vote feature of com_content leads to an open redirect. |
CVE-2020-5541 | Medium | 6.1 | 2020-08-25 | Open redirect vulnerability in CyberMail Ver.6.x and Ver.7.x allows remote attackers to redirect users to arbitrary sites and conduct phishing attacks via a sp… |
CVE-2020-10775 | Medium | 5.3 | 2020-08-24 | An Open redirect vulnerability was found in ovirt-engine versions 4.4 and earlier, where it allows remote attackers to redirect users to arbitrary web sites an… |
CVE-2020-4598 | Medium | 6.1 | 2020-08-24 | IBM Security Guardium Insights 2.0.1 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit… |
CVE-2020-4653 | Medium | 6.1 | 2020-08-19 | IBM Planning Analytics 2.0 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a speciall… |
CVE-2020-15129 | Medium | 6.1 | 2020-07-30 | In Traefik before versions 1.7.26, 2.2.8, and 2.3.0-rc3, there exists a potential open redirect vulnerability in Traefik's handling of the "X-Forwarded-Prefix"… |
CVE-2020-7520 | Medium | 4.7 | 2020-07-23 | A CWE-601: URL Redirection to Untrusted Site ('Open Redirect') vulnerability exists in Schneider Electric Software Update (SESU), V2.4.0 and prior, which could… |
CVE-2020-8559 | Medium | 6.4 | 2020-07-22 | The Kubernetes kube-apiserver in versions v1.6-v1.15, and versions prior to v1.16.13, v1.17.9 and v1.18.6 are vulnerable to an unvalidated redirect on proxied… |
CVE-2019-12783 | Medium | 6.1 | 2020-07-14 | An issue was discovered in Verint Impact 360 15.1. At wfo/control/signin, the rd parameter can accept a URL, to which users will be redirected after a successf… |
CVE-2019-20901 | Medium | 6.1 | 2020-07-13 | The login.jsp resource in Jira before version 8.5.2, and from version 8.6.0 before version 8.6.1 allows remote attackers to redirect users to a different websi… |
CVE-2020-5607 | Medium | 6.1 | 2020-07-10 | Open redirect vulnerability in SHIRASAGI v1.13.1 and earlier allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via… |
CVE-2020-11882 | Medium | 6.1 | 2020-07-07 | The O2 Business application 1.2.0 for Android exposes the canvasm.myo2.SplashActivity activity to other applications. The purpose of this activity is to handle… |
CVE-2020-4037 | Medium | 4.3 | 2020-06-29 | In OAuth2 Proxy from version 5.1.1 and less than version 6.0.0, users can provide a redirect address for the proxy to send the authenticated user to at the end… |
CVE-2017-18897 | Medium | 6.1 | 2020-06-19 | An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5, when used as an OAuth 2.0 service provider. It mishandles a deny action for a redi… |
CVE-2017-18891 | Medium | 6.1 | 2020-06-19 | An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5. It allows Phishing because an error page can have a link. |
CVE-2020-14454 | Medium | 6.1 | 2020-06-19 | An issue was discovered in Mattermost Desktop App before 4.4.0. Attackers can open web pages in the desktop application because server redirection is mishandle… |
CVE-2020-14446 | Medium | 6.1 | 2020-06-18 | An issue was discovered in WSO2 Identity Server through 5.10.0 and WSO2 IS as Key Manager through 5.10.0. An open redirect exists. |
CVE-2020-3337 | Medium | 6.1 | 2020-06-18 | A vulnerability in the web server of Cisco Umbrella could allow an unauthenticated, remote attacker to redirect a user to an undesired web page. The vulnerabil… |
CVE-2020-4048 | Medium | 5.7 | 2020-06-12 | In affected versions of WordPress, due to an issue in wp_validate_redirect() and URL sanitization, an arbitrary external link can be crafted leading to uninten… |
CVE-2020-6266 | Medium | 5.4 | 2020-06-10 | SAP Fiori for SAP S/4HANA, versions - 100, 200, 300, 400, allows an attacker to redirect users to a malicious site due to insufficient URL validation, leading… |
CVE-2020-1323 | Medium | 6.1 | 2020-06-09 | An open redirect vulnerability exists in Microsoft SharePoint that could lead to spoofing.To exploit the vulnerability, an attacker could send a link that has… |
CVE-2020-1220 | Medium | 6.1 | 2020-06-09 | A spoofing vulnerability exists when theMicrosoft Edge (Chromium-based) in IE Mode improperly handles specific redirects, aka 'Microsoft Edge (Chromium-based)… |
CVE-2020-10959 | Medium | 6.1 | 2020-06-02 | resources/src/mediawiki.page.ready/ready.js in MediaWiki before 1.35 allows remote attackers to force a logout and external redirection via HTML content in a M… |
CVE-2020-13486 | Medium | 6.1 | 2020-05-25 | The Knock Knock plugin before 1.2.8 for Craft CMS allows malicious redirection. |
CVE-2020-1059 | Medium | 4.3 | 2020-05-21 | A spoofing vulnerability exists when Microsoft Edge does not properly parse HTTP content, aka 'Microsoft Edge Spoofing Vulnerability'. |
CVE-2020-13121 | Medium | 6.1 | 2020-05-16 | Submitty through 20.04.01 has an open redirect via authentication/login?old= during an invalid login attempt. |
CVE-2020-5409 | Medium | 6.1 | 2020-05-14 | Pivotal Concourse, most versions prior to 6.0.0, allows redirects to untrusted websites in its login flow. A remote unauthenticated attacker could convince a u… |
CVE-2020-1997 | Medium | 5.3 | 2020-05-13 | An open redirection vulnerability in the GlobalProtect component of Palo Alto Networks PAN-OS allows an attacker to specify an arbitrary redirection target awa… |
CVE-2020-12699 | Medium | 6.1 | 2020-05-13 | The direct_mail extension through 5.2.3 for TYPO3 has an Open Redirect via jumpUrl. |
CVE-2020-11053 | High | 7.1 | 2020-05-07 | In OAuth2 Proxy before 5.1.1, there is an open redirect vulnerability. Users can provide a redirect address for the proxy to send the authenticated user to at… |
CVE-2020-3311 | Medium | 6.1 | 2020-05-06 | A vulnerability in the web interface of Cisco Firepower Management Center (FMC) Software could allow an unauthenticated, remote attacker to redirect a user to… |
CVE-2020-3178 | Medium | 6.1 | 2020-05-06 | Multiple vulnerabilities in the web-based GUI of Cisco AsyncOS Software for Cisco Content Security Management Appliance (SMA) could allow an unauthenticated, r… |
CVE-2020-12666 | Medium | 6.1 | 2020-05-05 | macaron before 1.3.7 has an open redirect in the static handler, as demonstrated by the http://127.0.0.1:4000//example.com/ URL. |
CVE-2020-11034 | Medium | 6.1 | 2020-05-05 | In GLPI before version 9.4.6, there is a vulnerability that allows bypassing the open redirect protection based which is based on a regexp. This is fixed in ve… |
CVE-2020-5337 | Medium | 4.6 | 2020-05-04 | RSA Archer, versions prior to 6.7 P1 (6.7.0.1), contain a URL redirection vulnerability. A remote unauthenticated attacker could potentially exploit this vulne… |
CVE-2019-4209 | Medium | 6.1 | 2020-05-01 | HCL Connections v5.5, v6.0, and v6.5 contains an open redirect vulnerability which could be exploited by an attacker to conduct phishing attacks. |
CVE-2020-12283 | Medium | 6.1 | 2020-04-30 | Sourcegraph before 3.15.1 has a vulnerable authentication workflow because of improper validation in the SafeRedirectURL method in cmd/frontend/auth/redirect.g… |
CVE-2020-5270 | Medium | 4.1 | 2020-04-20 | In PrestaShop between versions 1.7.6.0 and 1.7.6.5, there is an open redirection when using back parameter. The impacts can be many, and vary from the theft of… |
CVE-2020-5733 | Medium | 6.1 | 2020-04-17 | In OpenMRS 2.9 and prior, the export functionality of the Data Exchange Module does not properly redirect to a login page when an unauthenticated user attempts… |
CVE-2020-5732 | Medium | 6.1 | 2020-04-17 | In OpenMRS 2.9 and prior, he import functionality of the Data Exchange Module does not properly redirect to a login page when an unauthenticated user attempts… |
CVE-2020-11665 | Medium | 6.1 | 2020-04-15 | CA API Developer Portal 4.3.1 and earlier handles loginRedirect page redirects in an insecure manner, which allows attackers to perform open redirect attacks. |