CWE-601 · URL Redirection to Untrusted Site (Open Redirect) (page 15)
Page 15 of 17 — CVEs classified under CWE-601, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-10133 | Low | 3.1 | 2019-06-26 | A flaw was found in Moodle before 3.7, 3.6.4, 3.5.6, 3.4.9 and 3.1.18. The form to upload cohorts contained a redirect field, which was not restricted to inter… |
CVE-2019-4153 | Medium | 6.8 | 2019-06-25 | IBM Security Access Manager 9.0.1 through 9.0.6 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victi… |
CVE-2017-14394 | Medium | 6.1 | 2019-06-19 | OAuth 2.0 Authorization Server of ForgeRock Access Management (OpenAM) 13.5.0-13.5.1 and Access Management (AM) 5.0.0-5.1.1 does not correctly validate redirec… |
CVE-2019-11269 | Medium | 5.4 | 2019-06-12 | Spring Security OAuth versions 2.3 prior to 2.3.6, 2.2 prior to 2.2.5, 2.1 prior to 2.1.5, and 2.0 prior to 2.0.18, as well as older unsupported versions could… |
CVE-2019-3477 | Medium | 6.1 | 2019-06-07 | Micro Focus Solution Business Manager versions prior to 11.4.2 is susceptible to open redirect. |
CVE-2019-4201 | Medium | 6.1 | 2019-06-06 | IBM Jazz for Service Management 1.1.3, 1.1.3.1, and 1.1.3.2 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persua… |
CVE-2018-13384 | Medium | 6.1 | 2019-06-04 | A Host Header Redirection vulnerability in Fortinet FortiOS all versions below 6.0.5 under SSL VPN web portal allows a remote attacker to potentially poison HT… |
CVE-2019-6741 | Critical | 9.3 | 2019-06-03 | This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Samsung Galaxy S9 prior to January 2019 Security Update (SM… |
CVE-2017-5871 | Medium | 5.4 | 2019-05-22 | Odoo Version <= 8.0-20160726 and Version 9 is affected by: CWE-601: Open redirection. The impact is: obtain sensitive information (remote). |
CVE-2019-6781 | High | 7.5 | 2019-05-17 | An Improper Input Validation issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It… |
CVE-2019-5946 | Medium | 6.1 | 2019-05-17 | Open redirect vulnerability in Cybozu Garoon 4.2.4 to 4.10.1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via… |
CVE-2019-10117 | Medium | 6.1 | 2019-05-16 | An Open Redirect issue was discovered in GitLab Community and Enterprise Edition before 11.7.8, 11.8.x before 11.8.4, and 11.9.x before 11.9.2. A redirect is t… |
CVE-2019-8951 | Medium | 6.1 | 2019-05-13 | An Open Redirect vulnerability located in the webserver affects several Bosch hardware and software products. The vulnerability potentially allows a remote att… |
CVE-2018-12300 | Medium | 6.1 | 2019-05-13 | Arbitrary Redirect in echo-server.html in Seagate NAS OS version 4.3.15.1 allows attackers to disclose information in the Referer header via the 'state' URL pa… |
CVE-2019-5433 | Medium | 5.4 | 2019-05-06 | A user having access to the UI of a Revive Adserver instance could be tricked into clicking on a specifically crafted admin account-switch.php URL that would e… |
CVE-2018-14931 | Medium | 6.1 | 2019-04-30 | An issue was discovered in the Core and Portal modules in Polaris FT Intellect Core Banking 9.7.1. An open redirect exists via a /IntellectMain.jsp?IntellectSy… |
CVE-2019-4166 | Medium | 6.1 | 2019-04-30 | IBM StoredIQ 7.6 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially-crafted… |
CVE-2019-3788 | High | 8.7 | 2019-04-25 | Cloud Foundry UAA Release, versions prior to 71.0, allows clients to be configured with an insecure redirect uri. Given a UAA client was configured with a wild… |
CVE-2019-10955 | Medium | 6.1 | 2019-04-25 | In Rockwell Automation MicroLogix 1400 Controllers Series A, All Versions Series B, v15.002 and earlier, MicroLogix 1100 Controllers v14.00 and earlier, Compac… |
CVE-2019-4092 | Medium | 6.1 | 2019-04-25 | IBM Content Navigator 2.0.3 and 3.0CD could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit… |
CVE-2019-8995 | Medium | 6.1 | 2019-04-24 | The workspace client, openspace client, and app development client of TIBCO Software Inc.'s TIBCO ActiveMatrix BPM, TIBCO ActiveMatrix BPM Distribution for TIB… |
CVE-2018-20698 | Medium | 6.1 | 2019-04-09 | The floragunn Search Guard plugin before 6.x-16 for Kibana allows URL injection for login redirects on the login page when basePath is set. |
CVE-2019-11016 | Medium | 6.1 | 2019-04-08 | Elgg before 1.12.18 and 2.3.x before 2.3.11 has an open redirect. |
CVE-2019-10856 | Medium | 6.1 | 2019-04-04 | In Jupyter Notebook before 5.7.8, an open redirect can occur via an empty netloc. This issue exists because of an incomplete fix for CVE-2019-10255. |
CVE-2018-15180 | Medium | 6.1 | 2019-04-02 | qTest Portal in QASymphony qTest Manager 9.0.0 has an Open Redirect via the /portal/loginform redirect parameter. |
CVE-2018-8913 | High | 7.1 | 2019-04-01 | Missing custom error page vulnerability in Synology Web Station before 2.1.3-0139 allows remote attackers to conduct phishing attacks via a crafted URL. |
CVE-2017-18109 | Medium | 6.1 | 2019-03-29 | The login resource of CrowdId in Atlassian Crowd before version 3.0.2 and from version 3.1.0 before version 3.1.1 allows remote attackers to redirect users to… |
CVE-2019-10255 | Medium | 6.1 | 2019-03-28 | An Open Redirect vulnerability for all browsers in Jupyter Notebook before 5.7.7 and some browsers (Chrome, Firefox) in JupyterHub before 0.9.5 allows crafted… |
CVE-2019-3877 | Medium | 5.8 | 2019-03-27 | A vulnerability was found in mod_auth_mellon before v0.14.2. An open redirect in the logout URL allows requests with backslashes to pass through by assuming th… |
CVE-2019-3850 | Medium | 4.3 | 2019-03-26 | A vulnerability was found in moodle before versions 3.6.3, 3.5.5, 3.4.8 and 3.1.17. Links within assignment submission comments would open directly (in the sam… |
CVE-2019-4035 | Medium | 5.4 | 2019-03-22 | IBM Content Navigator 3.0CD could allow attackers to direct web traffic to a malicious site. If attackers make a fake IBM Content Navigator site, they can send… |
CVE-2019-9915 | Medium | 6.1 | 2019-03-22 | GetSimpleCMS 3.3.13 has an Open Redirect via the admin/index.php redirect parameter. |
CVE-2019-9837 | Medium | 6.1 | 2019-03-21 | Doorkeeper::OpenidConnect (aka the OpenID Connect extension for Doorkeeper) 1.4.x and 1.5.x before 1.5.4 has an open redirect via the redirect_uri field in an… |
CVE-2019-7416 | Medium | 6.1 | 2019-03-21 | XSS and/or a Client Side URL Redirect exists in OpenText Documentum Webtop 5.3 SP2. The parameter startat in "/webtop/help/en/default.htm" is vulnerable. |
CVE-2018-17422 | Medium | 6.1 | 2019-03-07 | dotCMS before 5.0.2 has open redirects via the html/common/forward_js.jsp FORWARD_URL parameter or the html/portlet/ext/common/page_preview_popup.jsp hostname… |
CVE-2019-3778 | Medium | 6.5 | 2019-03-07 | Spring Security OAuth, versions 2.3 prior to 2.3.5, and 2.2 prior to 2.2.4, and 2.1 prior to 2.1.4, and 2.0 prior to 2.0.17, and older unsupported versions cou… |
CVE-2019-0540 | Medium | 5.5 | 2019-03-05 | A security feature bypass vulnerability exists when Microsoft Office does not validate URLs.An attacker could send a victim a specially crafted file, which cou… |
CVE-2018-1939 | Medium | 6.8 | 2019-03-05 | IBM Cloud Private 3.1.1 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially-c… |
CVE-2018-1875 | High | 7.4 | 2019-03-05 | IBM InfoSphere Information Governance Catalog 11.3, 11.5, and 11.7 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By… |
CVE-2018-19106 | Medium | 6.1 | 2019-02-20 | Avi Vantage before 17.2.13 uses an invalid URL encoding during a redirect operation, aka AV-33959. |
CVE-2016-10742 | Medium | 6.1 | 2019-02-17 | Zabbix before 2.2.21rc1, 3.x before 3.0.13rc1, 3.1.x and 3.2.x before 3.2.10rc1, and 3.3.x and 3.4.x before 3.4.4rc1 allows open redirect via the request param… |
CVE-2019-5915 | Medium | 6.1 | 2019-02-13 | Open redirect vulnerability in OpenAM (Open Source Edition) 13.0 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks… |
CVE-2019-3912 | Medium | 6.1 | 2019-01-30 | An open redirect vulnerability in LabKey Server Community Edition before 18.3.0-61806.763 via the /__r1/ returnURL parameter allows an unauthenticated remote a… |
CVE-2019-6780 | Medium | 6.1 | 2019-01-24 | The Wise Chat plugin before 2.7 for WordPress mishandles external links because rendering/filters/post/WiseChatLinksPostFilter.php omits noopener and noreferre… |
CVE-2018-16191 | Medium | 6.1 | 2019-01-09 | Open redirect vulnerability in EC-CUBE (EC-CUBE 3.0.0, EC-CUBE 3.0.1, EC-CUBE 3.0.2, EC-CUBE 3.0.3, EC-CUBE 3.0.4, EC-CUBE 3.0.5, EC-CUBE 3.0.6, EC-CUBE 3.0.7… |
CVE-2018-16174 | Medium | 6.1 | 2019-01-09 | Open redirect vulnerability in LearnPress prior to version 3.1.0 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks… |
CVE-2018-0688 | Medium | 6.1 | 2019-01-09 | Open redirect vulnerability in SEIKO EPSON printers and scanners (DS-570W firmware versions released prior to 2018 March 13, DS-780N firmware versions released… |
CVE-2018-15798 | High | 7.6 | 2018-12-19 | Pivotal Concourse Release, versions 4.x prior to 4.2.2, login flow allows redirects to untrusted websites. A remote unauthenticated attacker could convince a u… |
CVE-2018-19790 | Medium | 6.1 | 2018-12-18 | An open redirect was discovered in Symfony 2.7.x before 2.7.50, 2.8.x before 2.8.49, 3.x before 3.4.20, 4.0.x before 4.0.15, 4.1.x before 4.1.9 and 4.2.x befor… |
CVE-2018-7804 | Medium | 6.1 | 2018-12-17 | A URL Redirection to Untrusted Site vulnerability exists in the embedded web servers in all Modicon M340, Premium, Quantum PLCs and BMXNOR0200 where a user cli… |
CVE-2018-7797 | Medium | 6.1 | 2018-12-17 | A URL redirection vulnerability exists in Power Monitoring Expert, Energy Expert (formerly Power Manager) - EcoStruxure Power Monitoring Expert (PME) v8.2 (all… |
CVE-2018-13813 | High | 8.1 | 2018-12-13 | A vulnerability has been identified in SIMATIC HMI Comfort Panels 4" - 22" (All versions < V15 Update 4), SIMATIC HMI Comfort Outdoor Panels 7" & 15" (All vers… |
CVE-2018-1654 | Medium | 6.8 | 2018-12-11 | IBM Curam Social Program Management 6.0.5, 6.1.1, 6.2.0, 7.0.1, and 7.0.3 could allow a remote attacker to conduct phishing attacks, using an open redirect att… |
CVE-2018-19796 | Medium | 6.1 | 2018-12-03 | An open redirect in the Ninja Forms plugin before 3.3.19.1 for WordPress allows Remote Attackers to redirect a user via the lib/StepProcessing/step-processing… |
CVE-2018-11067 | Medium | 6.1 | 2018-11-26 | Dell EMC Avamar Client Manager in Dell EMC Avamar Server versions 7.2.0, 7.2.1, 7.3.0, 7.3.1, 7.4.0, 7.4.1, 7.5.0, 7.5.1, 18.1 and Dell EMC Integrated Data Pro… |
CVE-2018-17948 | Medium | 6.1 | 2018-11-20 | An open redirect vulnerability exists in the Access Manager Identity Provider prior to 4.4 SP3. |
CVE-2018-2476 | Medium | 6.1 | 2018-11-13 | Due to insufficient URL Validation in forums in SAP NetWeaver versions 7.30, 7.31, 7.40, an attacker can redirect users to a malicious site. |
CVE-2018-14658 | Medium | 6.1 | 2018-11-13 | A flaw was found in JBOSS Keycloak 3.2.1.Final. The Redirect URL for both Login and Logout are not normalized in org.keycloak.protocol.oidc.utils.RedirectUtils… |
CVE-2018-13402 | Medium | 6.1 | 2018-10-23 | Many resources in Atlassian Jira before version 7.6.9, from version 7.7.0 before version 7.7.5, from version 7.8.0 before version 7.8.5, from version 7.9.0 bef… |
CVE-2018-13401 | Medium | 6.1 | 2018-10-23 | The XsrfErrorAction resource in Atlassian Jira before version 7.6.9, from version 7.7.0 before version 7.7.5, from version 7.8.0 before version 7.8.5, from ver… |
CVE-2018-12675 | Medium | 6.1 | 2018-10-19 | The SV3C HD Camera (L-SERIES V2.3.4.2103-S50-NTD-B20170508B and V2.3.4.2103-S50-NTD-B20170823B) does not perform origin checks on URLs that the camera's web in… |
CVE-2018-15493 | Medium | 6.1 | 2018-10-17 | vBulletin 5.4.3 has an Open Redirect. |
CVE-2018-15403 | Medium | 5.4 | 2018-10-05 | A vulnerability in the web interface of Cisco Emergency Responder, Cisco Unified Communications Manager, Cisco Unified Communications Manager IM & Presence Ser… |
CVE-2018-11784 | Medium | 4.3 | 2018-10-04 | When the default servlet in Apache Tomcat versions 9.0.0.M1 to 9.0.11, 8.5.0 to 8.5.33 and 7.0.23 to 7.0.90 returned a redirect to a directory (e.g. redirectin… |
CVE-2018-17870 | Medium | 6.1 | 2018-10-01 | An issue was discovered in BTITeam XBTIT 2.5.4. The "returnto" parameter of account_change.php is vulnerable to an open redirect, a different vulnerability tha… |
CVE-2018-1251 | High | 8.3 | 2018-09-28 | Dell EMC Unity and UnityVSA versions prior to 4.3.1.1525703027 contains a URL Redirection vulnerability. A remote unauthenticated attacker could potentially ex… |
CVE-2018-1704 | Medium | 6.8 | 2018-09-28 | IBM Platform Symphony 7.1 Fix Pack 1 and 7.1.1 and IBM Spectrum Symphony 7.1.2 and 7.2.0.2 could allow a remote attacker to conduct phishing attacks, using an… |
CVE-2018-1736 | High | 7.4 | 2018-09-27 | IBM WebSphere Portal 7.0, 8.0, 8.5, and 9.0 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to… |
CVE-2018-16954 | Medium | 6.1 | 2018-09-18 | An issue was discovered in Oracle WebCenter Interaction Portal 10.3.3. The login function of the portal is vulnerable to insecure redirection (also called an o… |
CVE-2018-17074 | Medium | 6.1 | 2018-09-16 | The Feed Statistics plugin before 4.0 for WordPress has an Open Redirect via the feed-stats-url parameter. |
CVE-2018-5548 | Medium | 6.1 | 2018-09-13 | On BIG-IP APM 11.6.0-11.6.3, an insecure AES ECB mode is used for orig_uri parameter in an undisclosed /vdesk link of APM virtual server configured with an acc… |
CVE-2018-16761 | Medium | 6.1 | 2018-09-09 | Eventum before 3.4.0 has an open redirect vulnerability. |
CVE-2018-14398 | Medium | 6.1 | 2018-09-07 | An issue was discovered in Creme CRM 1.6.12. The value of the cancel button uses the content of the HTTP Referer header, and could be used to trick a user into… |
CVE-2018-14366 | Medium | 6.1 | 2018-09-06 | download.cgi in Pulse Secure Pulse Connect Secure 8.1RX before 8.1R13 and 8.3RX before 8.3R4 and Pulse Policy Secure through 5.2RX before 5.2R10 and 5.4RX befo… |
CVE-2018-1000671 | Medium | 6.1 | 2018-09-06 | sympa version 6.2.16 and later contains a CWE-601: URL Redirection to Untrusted Site ('Open Redirect') vulnerability in The "referer" parameter of the wwsympa… |
CVE-2018-15683 | Medium | 6.1 | 2018-09-05 | An issue was discovered in BTITeam XBTIT. The "returnto" parameter of the login page is vulnerable to an open redirect due to a lack of validation. If a user i… |
CVE-2017-15419 | Medium | 6.5 | 2018-08-28 | Insufficient policy enforcement in Resource Timing API in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to infer browsing history by triggering… |
CVE-2018-3774 | Critical | 10.0 | 2018-08-12 | Incorrect parsing in url-parse <1.4.3 returns wrong hostname which leads to multiple vulnerabilities such as SSRF, Open Redirect, Bypass Authentication Protoco… |
CVE-2018-7692 | Medium | 6.1 | 2018-08-09 | Unvalidated redirect vulnerability in in NetIQ eDirectory before 9.1.1 HF1. |
CVE-2018-15178 | Medium | 6.1 | 2018-08-08 | Open redirect vulnerability in Gogs before 0.12 allows remote attackers to redirect users to arbitrary websites and conduct phishing attacks via an initial /\… |
CVE-2018-7091 | Medium | 6.1 | 2018-08-06 | HPE XP P9000 Command View Advanced Edition Software (CVAE) has open URL redirection vulnerability in versions 7.0.0-00 to earlier than 8.60-00 of DevMgr, TSMgr… |
CVE-2017-8989 | Critical | 9.1 | 2018-08-06 | A security vulnerability in HPE IceWall SSO Dfw 10.0 and 11.0 on RHEL, HP-UX, and Windows could be exploited remotely to allow URL Redirection. |
CVE-2018-14574 | Medium | 6.1 | 2018-08-03 | django.middleware.common.CommonMiddleware in Django 1.11.x before 1.11.15 and 2.0.x before 2.0.8 has an Open Redirect. |
CVE-2018-14474 | Medium | 6.1 | 2018-07-20 | views/auth.go in Orange Forum 1.4.0 allows Open Redirection via the next parameter to /login or /signup. |
CVE-2018-14381 | Medium | 6.1 | 2018-07-18 | Pagekit before 1.0.14 has a /user/login?redirect= open redirect vulnerability. |
CVE-2013-0594 | Medium | 6.1 | 2018-07-11 | Open redirect vulnerability in IBM iNotes before 8.5.3 Fix Pack 6 and 9.x before 9.0.1 allows remote attackers to redirect users to arbitrary web sites and con… |
CVE-2018-1355 | Medium | 6.1 | 2018-06-27 | An open redirect vulnerability in Fortinet FortiManager 6.0.0, 5.6.5 and below versions, FortiAnalyzer 6.0.0, 5.6.5 and below versions allows attacker to injec… |
CVE-2018-1000504 | High | 7.2 | 2018-06-26 | Redirection version 2.7.3 contains a ACE via file inclusion vulnerability in Pass-through mode that can result in allows admins to execute any PHP file in the… |
CVE-2018-11041 | Medium | 6.1 | 2018-06-25 | Cloud Foundry UAA, versions later than 4.6.0 and prior to 4.19.0 except 4.10.1 and 4.7.5 and uaa-release versions later than v48 and prior to v60 except v55.1… |
CVE-2018-11408 | Medium | 6.1 | 2018-06-13 | The security handlers in the Security component in Symfony in 2.7.x before 2.7.48, 2.8.x before 2.8.41, 3.3.x before 3.3.17, 3.4.x before 3.4.11, and 4.0.x bef… |
CVE-2017-16652 | Medium | 6.1 | 2018-06-13 | An issue was discovered in Symfony 2.7.x before 2.7.38, 2.8.x before 2.8.31, 3.2.x before 3.2.14, and 3.3.x before 3.3.13. DefaultAuthenticationSuccessHandler… |
CVE-2017-5389 | Medium | 6.1 | 2018-06-11 | WebExtensions could use the "mozAddonManager" API by modifying the CSP headers on sites with the appropriate permissions and then using host requests to redire… |
CVE-2016-9078 | High | 8.8 | 2018-06-11 | Redirection from an HTTP connection to a "data:" URL assigns the referring site's origin to the "data:" URL in some circumstances. This can result in same-orig… |
CVE-2017-16224 | Medium | 6.1 | 2018-06-07 | st is a module for serving static files. An attacker is able to craft a request that results in an HTTP 301 (redirect) to an entirely different domain. A reque… |
CVE-2017-1748 | Medium | 6.8 | 2018-06-04 | IBM Connections 5.0, 5.5, and 6.0 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a s… |
CVE-2018-3743 | Medium | 6.1 | 2018-06-01 | Open redirect in hekto <=0.2.3 when target domain name is used as html filename on server. |
CVE-2018-10651 | Medium | 6.1 | 2018-05-23 | There are Open Redirect Vulnerabilities in Citrix XenMobile Server 10.8 before RP2 and 10.7 before RP3. |
CVE-2015-8094 | Medium | 6.1 | 2018-05-22 | Open redirect vulnerability in Cloudera HUE before 3.10.0 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a U… |
CVE-2018-11119 | Medium | 6.1 | 2018-05-17 | ILIAS 5.1.x, 5.2.x, and 5.3.x before 5.3.5 redirects a logged-in user to a third-party site via the return_to_url parameter. |
CVE-2018-10678 | Medium | 6.1 | 2018-05-13 | MyBB 1.8.15, when accessed with Microsoft Edge, mishandles 'target="_blank" rel="noopener"' in A elements, which makes it easier for remote attackers to conduc… |