CWE-601 · URL Redirection to Untrusted Site (Open Redirect) (page 14)
Page 14 of 17 — CVEs classified under CWE-601, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-11664 | Medium | 6.1 | 2020-04-15 | CA API Developer Portal 4.3.1 and earlier handles homeRedirect page redirects in an insecure manner, which allows attackers to perform open redirect attacks. |
CVE-2020-11663 | Medium | 6.1 | 2020-04-15 | CA API Developer Portal 4.3.1 and earlier handles 404 requests in an insecure manner, which allows attackers to perform open redirect attacks. |
CVE-2020-3954 | Medium | 6.1 | 2020-04-15 | Open Redirect vulnerability exists in VMware vRealize Log Insight prior to 8.1.0 due to improper Input validation. |
CVE-2020-6215 | Medium | 6.1 | 2020-04-14 | SAP NetWeaver AS ABAP Business Server Pages Test Application IT00, versions 700, 701, 702, 730, 731, 740, 750, 751, 752, 753, 754, allows an attacker to redire… |
CVE-2020-6211 | Medium | 6.1 | 2020-04-14 | SAP Business Objects Business Intelligence Platform (AdminTools), versions 4.1, 4.2, allows an attacker to redirect users to a malicious site due to insufficie… |
CVE-2020-6223 | Medium | 6.1 | 2020-04-14 | The open document of SAP Business Objects Business Intelligence Platform, versions 4.1, 4.2, allows an attacker to modify certain error pages to include malici… |
CVE-2020-8430 | Medium | 6.1 | 2020-04-13 | Stormshield Network Security 310 3.7.10 devices have an auth/lang.html?rurl= Open Redirect vulnerability on the captive portal. For example, the attacker can u… |
CVE-2020-11611 | Medium | 6.1 | 2020-04-07 | An issue was discovered in xdLocalStorage through 2.0.5. The buildMessage() function in xdLocalStorage.js specifies the wildcard (*) as the targetOrigin when c… |
CVE-2020-11515 | Medium | 6.1 | 2020-04-07 | The Rank Math plugin through 1.0.40.2 for WordPress allows unauthenticated remote attackers to create new URIs (that redirect to an external web site) via the… |
CVE-2020-11529 | Medium | 6.1 | 2020-04-04 | Common/Grav.php in Grav before 1.7 has an Open Redirect. This is partially fixed in 1.6.23 and still present in 1.6.x. |
CVE-2020-8143 | Medium | 6.1 | 2020-04-03 | An Open Redirect vulnerability was discovered in Revive Adserver version < 5.0.5 and reported by HackerOne user hoangn144. A remote attacker could trick logged… |
CVE-2020-1927 | Medium | 6.1 | 2020-04-02 | In Apache HTTP Server 2.4.0 to 2.4.41, redirects configured with mod_rewrite that were intended to be self-referential might be fooled by encoded newlines and… |
CVE-2019-19484 | Medium | 6.1 | 2020-03-20 | Open redirect via parameter ‘p’ in login.php in Centreon (19.04.4 and below) allows an attacker to craft a payload and execute unintended behavior. |
CVE-2019-14882 | Medium | 6.1 | 2020-03-18 | A vulnerability was found in Moodle 3.7 to 3.7.3, 3.6 to 3.6.7, 3.5 to 3.5.9 and earlier where an open redirect existed in the Lesson edit page. |
CVE-2019-19613 | Medium | 5.2 | 2020-03-16 | An issue was discovered in Halvotec RaQuest 10.23.10801.0. The login page of the admin application is vulnerable to an Open Redirect attack allowing an attacke… |
CVE-2019-6696 | Medium | 6.1 | 2020-03-15 | An improper input validation vulnerability in FortiOS 6.2.1, 6.2.0, 6.0.8 and below until 5.4.0 under admin webUI may allow an attacker to perform an URL redir… |
CVE-2020-6803 | Medium | 5.4 | 2020-02-28 | An open redirect is present on the gateway's login page, which could cause a user to be redirected to a malicious site after logging in. |
CVE-2019-4595 | Medium | 6.1 | 2020-02-24 | IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 5.2.6.5 could allow a remote attacker to conduct phishing attacks, using an open redirect attack… |
CVE-2019-20479 | Medium | 6.1 | 2020-02-20 | A flaw was found in mod_auth_openidc before version 2.4.1. An open redirect issue exists in URLs with a slash and backslash at the beginning. |
CVE-2014-9617 | Medium | 6.1 | 2020-02-19 | Open redirect vulnerability in remotereporter/load_logfiles.php in Netsweeper before 4.0.5 allows remote attackers to redirect users to arbitrary web sites and… |
CVE-2019-19758 | Medium | 6.1 | 2020-02-14 | A vulnerability in the web interface of Lenovo EZ Media & Backup Center, ix2 & ix2-dl version 4.1.406.34763 and prior could allow an unauthenticated, remote at… |
CVE-2013-2621 | Medium | 6.1 | 2020-02-03 | Open Redirection Vulnerability in the redir.php script in Telaen before 1.3.1 allows remote attackers to redirect victims to arbitrary websites via a crafted U… |
CVE-2020-5233 | Medium | 5.9 | 2020-01-30 | OAuth2 Proxy before 5.0 has an open redirect vulnerability. Authentication tokens could be silently harvested by an attacker. This has been patched in version… |
CVE-2013-2764 | Medium | 6.1 | 2020-01-28 | Secure Entry Server before 4.7.0 contains a URI Redirection vulnerability which could allow remote attackers to conduct phishing attacks due to HSP_AbsoluteRed… |
CVE-2019-4631 | Medium | 6.1 | 2020-01-28 | IBM Security Secret Server 10.7 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a spe… |
CVE-2020-7936 | Medium | 6.1 | 2020-01-23 | An open redirect on the login form (and possibly other places) in Plone 4.0 through 5.2.1 allows an attacker to craft a link to a Plone Site that, when followe… |
CVE-2019-17151 | Medium | 5.4 | 2020-01-07 | This vulnerability allows remote attackers redirect users to an external resource on affected installations of Tencent WeChat Prior to 7.0.9. User interaction… |
CVE-2015-9540 | Medium | 6.1 | 2020-01-04 | Chamilo LMS through 1.9.10.2 allows a link_goto.php?link_url= open redirect, a related issue to CVE-2015-5503. |
CVE-2019-20225 | Medium | 6.1 | 2020-01-02 | MyBB before 1.8.22 allows an open redirect on login. |
CVE-2019-6035 | Medium | 6.1 | 2019-12-26 | Open redirect vulnerability in Athenz v1.8.24 and earlier allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a s… |
CVE-2019-6025 | Medium | 6.1 | 2019-12-26 | Open redirect vulnerability in Movable Type series Movable Type 7 r.4602 (7.1.3) and earlier (Movable Type 7), Movable Type 6.5.0 and 6.5.1 (Movable Type 6.5)… |
CVE-2019-6021 | Medium | 6.1 | 2019-12-26 | Open redirect vulnerability in Library Information Management System LIMEDIO all versions allows remote attackers to redirect users to arbitrary web sites and… |
CVE-2019-6020 | Medium | 6.1 | 2019-12-26 | Open redirect vulnerability in PowerCMS 5.12 and earlier (PowerCMS 5.x), 4.42 and earlier (PowerCMS 4.x), and 3.293 and earlier (PowerCMS 3.x) allows remote at… |
CVE-2018-18288 | Medium | 6.1 | 2019-12-26 | CrushFTP through 8.3.0 is vulnerable to credentials theft via URL redirection. |
CVE-2019-18781 | Medium | 6.1 | 2019-12-18 | An open redirect vulnerability was discovered in Zoho ManageEngine ADSelfService Plus 5.x before 5809 that allows attackers to force users who click on a craft… |
CVE-2019-8791 | Medium | 6.1 | 2019-12-18 | An issue existed in the parsing of URL schemes. This issue was addressed with improved URL validation. This issue is fixed in Shazam Android App Version 9.25.0… |
CVE-2019-19775 | Medium | 6.1 | 2019-12-18 | The image thumbnailing handler in Zulip Server versions 1.9.0 to before 2.0.8 allowed an open redirect that was visible to logged-in users. |
CVE-2014-3652 | Medium | 6.1 | 2019-12-15 | JBoss KeyCloak: Open redirect vulnerability via failure to validate the redirect URL. |
CVE-2019-19709 | Medium | 6.1 | 2019-12-11 | MediaWiki through 1.33.1 allows attackers to bypass the Title_blacklist protection mechanism by starting with an arbitrary title, establishing a non-resolvable… |
CVE-2019-1486 | Medium | 6.1 | 2019-12-10 | A spoofing vulnerability exists in Visual Studio Live Share when a guest connected to a Live Share session is redirected to an arbitrary URL specified by the s… |
CVE-2019-19703 | Medium | 6.1 | 2019-12-10 | In Ktor through 1.2.6, the client resends data from the HTTP Authorization header to a redirect location. |
CVE-2016-1000107 | Medium | 6.1 | 2019-12-10 | inets in Erlang possibly 22.1 and earlier follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client dat… |
CVE-2016-1000108 | Medium | 6.1 | 2019-12-10 | yaws before 2.0.4 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect CGI applications from the presence of… |
CVE-2018-1002102 | Low | 2.6 | 2019-12-05 | Improper validation of URL redirection in the Kubernetes API server in versions prior to v1.14.0 allows an attacker-controlled Kubelet to redirect API server r… |
CVE-2016-1000110 | Medium | 6.1 | 2019-11-27 | The CGIHandler class in Python before 2.7.12 does not protect against the HTTP_PROXY variable name clash in a CGI script, which could allow a remote attacker t… |
CVE-2019-18451 | Medium | 6.1 | 2019-11-26 | An issue was discovered in GitLab Community and Enterprise Edition 10.7.4 through 12.4 in the InternalRedirect filtering feature. It has an Open Redirect. |
CVE-2019-15688 | Medium | 6.1 | 2019-11-26 | Kaspersky Anti-Virus, Kaspersky Internet Security, Kaspersky Total Security, Kaspersky Free Anti-Virus, Kaspersky Small Office Security, Kaspersky Security Clo… |
CVE-2019-14857 | Medium | 6.1 | 2019-11-26 | A flaw was found in mod_auth_openidc before version 2.4.0.1. An open redirect issue exists in URLs with trailing slashes similar to CVE-2019-3877 in mod_auth_m… |
CVE-2014-2213 | Medium | 6.1 | 2019-11-22 | Open redirect vulnerability in the password reset functionality in POSH 3.0 through 3.2.1 allows remote attackers to redirect users to arbitrary web sites and… |
CVE-2019-15073 | Medium | 6.1 | 2019-11-20 | An Open Redirect vulnerability for all browsers in MAIL2000 through version 6.0 and 7.0, which will redirect to a malicious site without authentication. This v… |
CVE-2018-13257 | Medium | 6.1 | 2019-11-18 | The bb-auth-provider-cas authentication module within Blackboard Learn 2018-07-02 is susceptible to HTTP host header spoofing during Central Authentication Ser… |
CVE-2019-18815 | Medium | 6.1 | 2019-11-07 | PopojiCMS 2.0.1 allows refer= Open Redirection. |
CVE-2010-2471 | Medium | 6.1 | 2019-11-06 | Drupal versions 5.x and 6.x has open redirection |
CVE-2010-3669 | Medium | 5.4 | 2019-11-04 | TYPO3 before 4.2.13, 4.3.x before 4.3.4 and 4.4.x before 4.4.1 allows XSS and Open Redirection in the frontend login box. |
CVE-2010-3661 | Medium | 6.1 | 2019-11-01 | TYPO3 before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4 and 4.4.x before 4.4.1 allows Open Redirection on the backend. |
CVE-2019-4538 | High | 8.2 | 2019-10-02 | IBM Security Directory Server 6.4.0 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a… |
CVE-2019-15041 | Medium | 6.1 | 2019-10-01 | JetBrains YouTrack versions before 2019.1.52545 allowed unbounded URL whitelisting because of Inclusion of Functionality from an Untrusted Control Sphere. |
CVE-2019-10098 | Medium | 6.1 | 2019-09-25 | In Apache HTTP server 2.4.0 to 2.4.39, Redirects configured with mod_rewrite that were intended to be self-referential might be fooled by encoded newlines and… |
CVE-2019-14912 | Medium | 6.1 | 2019-09-20 | An issue was discovered in PRiSE adAS 1.7.0. The OPENSSO module does not properly check the goto parameter, leading to an open redirect that leaks the session… |
CVE-2019-16393 | Medium | 6.1 | 2019-09-17 | SPIP before 3.1.11 and 3.2 before 3.2.5 mishandles redirect URLs in ecrire/inc/headers.php with a %0D, %0A, or %20 character. |
CVE-2019-6009 | Medium | 6.1 | 2019-09-12 | Open redirect vulnerability in SHIRASAGI v1.7.0 and earlier allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via u… |
CVE-2019-6004 | Medium | 6.1 | 2019-09-12 | Open redirect vulnerability in ApeosWare Management Suite Ver.1.4.0.18 and earlier, and ApeosWare Management Suite 2 Ver.2.1.2.4 and earlier allow remote attac… |
CVE-2019-5978 | Medium | 6.1 | 2019-09-12 | Open redirect vulnerability in Cybozu Garoon 4.0.0 to 4.10.2 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via… |
CVE-2019-16220 | Medium | 6.1 | 2019-09-11 | In WordPress before 5.2.3, validation and sanitization of a URL in wp_validate_redirect in wp-includes/pluggable.php could lead to an open redirect if a provid… |
CVE-2019-14223 | Medium | 6.1 | 2019-09-06 | An issue was discovered in Alfresco Community Edition versions below 5.2.6, 6.0.N and 6.1.N. The Alfresco Share application is vulnerable to an Open Redirect a… |
CVE-2019-15820 | Medium | 6.1 | 2019-08-30 | The login-or-logout-menu-item plugin before 1.2.0 for WordPress has no requirement for lolmi_save_settings authentication. |
CVE-2019-15818 | Medium | 6.1 | 2019-08-30 | The simple-301-redirects-addon-bulk-uploader plugin through 1.2.4 for WordPress has no requirement for authentication for action=bulk301export or action=bulk30… |
CVE-2019-15816 | High | 7.5 | 2019-08-30 | The wp-private-content-plus plugin before 2.0 for WordPress has no protection against option changes via save_settings_page and other save_ functions. |
CVE-2019-15771 | Medium | 6.1 | 2019-08-29 | The nd-shortcodes plugin before 6.0 for WordPress has a nopriv_ AJAX action that allows modification of the siteurl setting. |
CVE-2019-15776 | Medium | 6.1 | 2019-08-29 | The simple-301-redirects-addon-bulk-uploader plugin before 1.2.5 for WordPress has no protection against 301 redirect rule injection via a CSV file. |
CVE-2019-15775 | Medium | 6.1 | 2019-08-29 | The nd-learning plugin before 4.8 for WordPress has a nopriv_ AJAX action that allows modification of the siteurl setting. |
CVE-2019-15774 | Medium | 6.1 | 2019-08-29 | The nd-booking plugin before 2.5 for WordPress has a nopriv_ AJAX action that allows modification of the siteurl setting. |
CVE-2019-15773 | Medium | 6.1 | 2019-08-29 | The nd-travel plugin before 1.7 for WordPress has a nopriv_ AJAX action that allows modification of the siteurl setting. |
CVE-2019-15772 | Medium | 6.1 | 2019-08-29 | The nd-donations plugin before 1.4 for WordPress has a nopriv_ AJAX action that allows modification of the siteurl setting. |
CVE-2016-6154 | Medium | 6.1 | 2019-08-23 | The authentication applet in Watchguard Fireware 11.11 Operating System has reflected XSS (this can also cause an open redirect). |
CVE-2019-10751 | High | 8.8 | 2019-08-23 | All versions of the HTTPie package prior to version 1.0.3 are vulnerable to Open Redirect that allows an attacker to write an arbitrary file with supplied file… |
CVE-2019-13422 | Medium | 6.1 | 2019-08-23 | Search Guard Kibana Plugin versions before 5.6.8-7 and before 6.x.y-12 had an issue that an attacker can redirect the user to a potentially malicious site upon… |
CVE-2019-11589 | Medium | 6.1 | 2019-08-23 | The ChangeSharedFilterOwner resource in Jira before version 7.13.6, from version 8.0.0 before version 8.2.3, and from version 8.3.0 before version 8.3.2 allows… |
CVE-2019-11585 | Medium | 6.1 | 2019-08-23 | The startup.jsp resource in Jira before version 7.13.6, from version 8.0.0 before version 8.2.3, and from version 8.3.0 before version 8.3.2 allows remote atta… |
CVE-2019-1954 | Medium | 6.1 | 2019-08-08 | A vulnerability in the web-based management interface of Cisco Webex Meetings Server Software could allow an unauthenticated, remote attacker to redirect a use… |
CVE-2019-10372 | Medium | 6.1 | 2019-08-07 | An open redirect vulnerability in Jenkins Gitlab Authentication Plugin 1.4 and earlier in GitLabSecurityRealm.java allows attackers to redirect users to a URL… |
CVE-2016-10769 | Medium | 6.1 | 2019-08-05 | cPanel before 60.0.25 allows an open redirect via /cgi-sys/FormMail-clone.cgi (SEC-162). |
CVE-2017-18441 | Medium | 5.0 | 2019-08-02 | cPanel before 64.0.21 allows demo accounts to redirect web traffic (SEC-245). |
CVE-2017-18414 | High | 7.4 | 2019-08-02 | cPanel before 67.9999.103 allows an open redirect in /unprotected/redirect.html (SEC-300). |
CVE-2019-9140 | High | 8.1 | 2019-08-01 | When processing Deeplink scheme, Happypoint mobile app 6.3.19 and earlier versions doesn't check Deeplink URL correctly. This could lead to javascript code exe… |
CVE-2018-20929 | Medium | 6.1 | 2019-08-01 | cPanel before 70.0.23 allows an open redirect via the /unprotected/redirect.html endpoint (SEC-392). |
CVE-2019-14403 | Medium | 4.3 | 2019-07-30 | cPanel before 78.0.18 offers an open mail relay because of incorrect domain-redirect routing (SEC-483). |
CVE-2018-20867 | Medium | 6.1 | 2019-07-30 | cPanel before 76.0.8 has an open redirect when resetting connections (SEC-462). |
CVE-2019-1020016 | Medium | 6.1 | 2019-07-29 | ASH-AIO before 2.0.0.3 allows an open redirect. |
CVE-2019-1943 | Medium | 4.7 | 2019-07-17 | A vulnerability in the web interface of Cisco Small Business 200, 300, and 500 Series Switches software could allow an unauthenticated, remote attacker to redi… |
CVE-2019-1010290 | Medium | 6.1 | 2019-07-16 | Babel: Multilingual site Babel All is affected by: Open Redirection. The impact is: Redirection to any URL, which is supplied to redirect.php in a "newurl" par… |
CVE-2019-1075 | Medium | 6.1 | 2019-07-15 | A spoofing vulnerability exists in ASP.NET Core that could lead to an open redirect, aka 'ASP.NET Core Spoofing Vulnerability'. |
CVE-2018-12621 | Medium | 6.1 | 2019-07-05 | An issue was discovered in Eventum 3.5.0. /htdocs/switch.php has an Open Redirect via the current_page parameter. |
CVE-2019-5969 | Medium | 6.1 | 2019-07-05 | Open redirect vulnerability in GROWI v3.4.6 and earlier allows remote attackersto redirect users to arbitrary web sites and conduct phishing attacks via the pr… |
CVE-2019-5965 | Medium | 6.1 | 2019-07-05 | Open redirect vulnerability in Joruri Mail 2.1.4 and earlier allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via… |
CVE-2019-10721 | Medium | 6.1 | 2019-07-03 | BlogEngine.NET 3.3.7.0 allows a Client Side URL Redirect via the ReturnUrl parameter, related to BlogEngine/BlogEngine.Core/Services/Security/Security.cs, logi… |
CVE-2019-13175 | Medium | 6.1 | 2019-07-02 | Read the Docs before 3.5.1 has an Open Redirect if certain user-defined redirects are used. This affects private instances of Read the Docs (in addition to the… |
CVE-2019-7275 | Medium | 6.1 | 2019-07-01 | Optergy Proton/Enterprise devices allow Open Redirect. |
CVE-2019-13038 | Medium | 6.1 | 2019-06-29 | mod_auth_mellon through 0.14.2 has an Open Redirect via the login?ReturnTo= substring, as demonstrated by omitting the // after http: in the target URL. |
CVE-2019-5823 | Medium | 5.4 | 2019-06-27 | Insufficient policy enforcement in service workers in Google Chrome prior to 74.0.3729.108 allowed a remote attacker to bypass navigation restrictions via a cr… |