CWE-601 · URL Redirection to Untrusted Site (Open Redirect) (page 16)
Page 16 of 17 — CVEs classified under CWE-601, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2018-5304 | Medium | 4.3 | 2018-05-11 | An issue was discovered on the Impinj Speedway Connect R420 RFID Reader before 2.2.2. The affected web interface is vulnerable to ClickJacking or UI Redressing… |
CVE-2018-1000174 | Medium | 6.1 | 2018-05-08 | An open redirect vulnerability exists in Jenkins Google Login Plugin 1.3 and older in GoogleOAuth2SecurityRealm.java that allows attackers to redirect users to… |
CVE-2018-1248 | Medium | 6.1 | 2018-05-08 | RSA Authentication Manager Security Console, Operation Console and Self-Service Console, version 8.3 and earlier, is affected by a Host header injection vulner… |
CVE-2017-18262 | Medium | 6.1 | 2018-04-30 | Blackboard Learn (Since at least 17th of October 2017) has allowed Unvalidated Redirects on any signed-in user through its endpoints for handling Shibboleth lo… |
CVE-2018-10101 | Medium | 6.1 | 2018-04-16 | Before WordPress 4.9.5, the URL validator assumed URLs with the hostname localhost were on the same host as the WordPress server. |
CVE-2018-10100 | Medium | 6.1 | 2018-04-16 | Before WordPress 4.9.5, the redirection URL for the login page was not validated or sanitized if forced to use HTTPS. |
CVE-2017-0364 | Medium | 6.1 | 2018-04-13 | Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 contains a flaw where Special:Search allows redirects to any interwiki link. |
CVE-2017-0363 | Medium | 6.1 | 2018-04-13 | Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 has a flaw where Special:UserLogin?returnto=interwiki:foo will redirect to external sites. |
CVE-2018-8813 | Medium | 4.8 | 2018-04-04 | Open redirect vulnerability in the login[redirect] parameter login functionality in WolfCMS 0.8.3.1 allows remote attackers to redirect users to arbitrary web… |
CVE-2017-7153 | Medium | 6.1 | 2018-04-03 | An issue was discovered in certain Apple products. iOS before 11.2 is affected. Safari before 11.0.2 is affected. iCloud before 7.2 on Windows is affected. iTu… |
CVE-2018-3819 | Medium | 6.1 | 2018-03-30 | The fix in Kibana for ESA-2017-23 was incomplete. With X-Pack security enabled, Kibana versions before 6.1.3 and 5.6.7 have an open redirect vulnerability on t… |
CVE-2018-7674 | Low | 2.1 | 2018-03-28 | The NetIQ Identity Manager user console, in versions prior to 4.7, is susceptible to URL redirection. |
CVE-2018-8937 | Medium | 6.1 | 2018-03-26 | An issue was discovered in Open-AudIT Professional 2.1. It is possible to inject a malicious payload in the redirect_url parameter to the /login URI to trigger… |
CVE-2018-0924 | Medium | 6.5 | 2018-03-14 | Microsoft Exchange Server 2010 Service Pack 3 Update Rollup 20, Microsoft Exchange Server 2013 Cumulative Update 18, Microsoft Exchange Server 2013 Cumulative… |
CVE-2018-1220 | Medium | 6.1 | 2018-03-08 | EMC RSA Archer, versions prior to 6.2.0.8, contains a redirect vulnerability in the QuickLinks feature. A remote attacker may potentially exploit this vulnerab… |
CVE-2018-7473 | Medium | 6.1 | 2018-03-07 | Open redirect vulnerability in the SO Connect SO WIFI hotspot web interface, prior to version 140, allows remote attackers to redirect users to arbitrary web s… |
CVE-2017-14802 | Medium | 5.4 | 2018-03-02 | Novell Access Manager Admin Console and IDP servers before 4.3.3 have a URL that could be used by remote attackers to trigger unvalidated redirects to third pa… |
CVE-2017-6932 | Medium | 4.7 | 2018-03-01 | Drupal core 7.x versions before 7.57 has an external link injection vulnerability when the language switcher block is used. A similar vulnerability exists in v… |
CVE-2015-3898 | Medium | 6.1 | 2018-02-28 | Multiple open redirect vulnerabilities in Bonita BPM Portal before 6.5.3 allow remote attackers to redirect users to arbitrary web sites and conduct phishing a… |
CVE-2018-6324 | Medium | 6.1 | 2018-02-16 | F-Secure Radar (on-premises) before 2018-02-15 has an Unvalidated Redirect via the ReturnUrl parameter that triggers upon a user login. |
CVE-2017-8945 | Medium | 6.1 | 2018-02-15 | A Remote Unauthorized Disclosure of Information vulnerability in HPE IceWall Federation Agent version 3.0 was found. |
CVE-2017-18178 | Medium | 6.1 | 2018-02-12 | Authenticate/SWT in Progress Sitefinity 9.1 has an open redirect issue in which an authentication token is sent to the redirection target, if the target is spe… |
CVE-2016-0329 | Medium | 5.4 | 2018-02-02 | Open redirect vulnerability in IBM Emptoris Sourcing 10.0.0.x before 10.0.0.1_iFix3, 10.0.1.x before 10.0.1.3_iFix3, 10.0.2.x before 10.0.2.8_iFix1, 10.0.4.0 b… |
CVE-2018-6520 | Medium | 6.1 | 2018-02-02 | SimpleSAMLphp before 1.15.2 allows remote attackers to bypass an open redirect protection mechanism via crafted authority data in a URL. |
CVE-2017-2166 | Medium | 6.1 | 2018-01-26 | Open redirect vulnerability in GroupSession version 4.7.0 and earlier allows an attacker to redirect users to arbitrary web sites and conduct phishing attacks… |
CVE-2018-6200 | Medium | 6.1 | 2018-01-25 | vBulletin 3.x.x and 4.2.x through 4.2.5 has an open redirect via the redirector.php url parameter. |
CVE-2018-0097 | Medium | 6.1 | 2018-01-18 | A vulnerability in the web interface of Cisco Prime Infrastructure could allow an unauthenticated, remote attacker to redirect a user to a malicious web page… |
CVE-2017-1534 | Medium | 6.1 | 2018-01-10 | IBM Security Access Manager Appliance 8.0.0 and 9.0.0 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a… |
CVE-2017-1668 | Medium | 6.1 | 2018-01-09 | IBM Tivoli Key Lifecycle Manager 2.5, 2.6, and 2.7 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a vi… |
CVE-2017-1000484 | Medium | 6.1 | 2018-01-03 | By linking to a specific url in Plone 2.5-5.1rc1 with a parameter, an attacker could send you to his own website. On its own this is not so bad: the attacker c… |
CVE-2017-1000481 | Medium | 6.1 | 2018-01-03 | When you visit a page where you need to login, Plone 2.5-5.1rc1 sends you to the login form with a 'came_from' parameter set to the previous url. After you log… |
CVE-2017-1000434 | Medium | 6.1 | 2018-01-02 | Wordpress plugin Furikake version 0.1.0 is vulnerable to an Open Redirect The furikake-redirect parameter on a page allows for a redirect to an attacker contro… |
CVE-2017-1558 | Medium | 6.1 | 2017-12-13 | IBM Maximo Asset Management 7.5 and 7.6 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to vis… |
CVE-2017-16679 | Medium | 6.1 | 2017-12-12 | URL redirection vulnerability in SAP's Startup Service, SAP KERNEL 32 NUC, SAP KERNEL 32 Unicode, SAP KERNEL 64 NUC, SAP KERNEL 64 Unicode 7.21, 7.21EXT, 7.22… |
CVE-2017-11482 | Medium | 6.1 | 2017-12-08 | The Kibana fix for CVE-2017-8451 was found to be incomplete. With X-Pack installed, Kibana versions before 6.0.1 and 5.6.5 have an open redirect vulnerability… |
CVE-2017-3105 | Medium | 6.1 | 2017-12-01 | Adobe RoboHelp has an Open Redirect vulnerability. This affects versions before RH12.0.4.460 and RH2017 before RH2017.0.2. |
CVE-2017-12344 | Medium | 6.1 | 2017-11-30 | Multiple vulnerabilities in Cisco Data Center Network Manager (DCNM) Software could allow a remote attacker to inject arbitrary values into DCNM configuration… |
CVE-2017-1000163 | Medium | 6.1 | 2017-11-17 | The Phoenix Framework versions 1.0.0 through 1.0.4, 1.1.0 through 1.1.6, 1.2.0, 1.2.2 and 1.3.0-rc.0 are vulnerable to unvalidated URL redirection, which may r… |
CVE-2017-11879 | High | 8.8 | 2017-11-15 | ASP.NET Core 2.0 allows an attacker to steal log-in session information such as cookies or authentication tokens via a specially crafted URL aka "ASP.NET Core… |
CVE-2017-16761 | Medium | 6.1 | 2017-11-10 | An Open Redirect vulnerability in Inedo BuildMaster before 5.8.2 allows remote attackers to redirect users to arbitrary web sites. |
CVE-2017-16569 | Medium | 4.8 | 2017-11-06 | An Open URL Redirect issue exists in Zurmo 3.2.1.57987acc3018 via an http: URL in the redirectUrl parameter to app/index.php/meetings/default/createMeeting. |
CVE-2017-14358 | Medium | 6.1 | 2017-10-31 | A URL redirection to untrusted site vulnerability in HP ArcSight ESM and HP ArcSight ESM Express, in any 6.x version prior to 6.9.1c Patch 4 or 6.11.0 Patch 1… |
CVE-2015-6961 | Medium | 6.1 | 2017-10-18 | Open redirect vulnerability in gluon/tools.py in Web2py 2.9.11 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks vi… |
CVE-2015-7943 | Medium | 6.1 | 2017-10-18 | Open redirect vulnerability in the Overlay module in Drupal 7.x before 7.41, the jQuery Update module 7.x-2.x before 7.x-2.7 for Drupal, and the LABjs module 7… |
CVE-2017-1000117 | High | 8.8 | 2017-10-05 | A malicious third-party can give a crafted "ssh://..." URL to an unsuspecting victim, and an attempt to visit the URL can result in any program that exists on… |
CVE-2017-8047 | Medium | 6.1 | 2017-10-04 | In Cloud Foundry router routing-release all versions prior to v0.163.0 and cf-release all versions prior to v274, in some applications, it is possible to appen… |
CVE-2017-14525 | Medium | 6.1 | 2017-09-28 | Multiple open redirect vulnerabilities in OpenText Documentum Webtop 6.8.0160.0073 allow remote attackers to redirect users to arbitrary web sites and conduct… |
CVE-2017-14524 | Medium | 6.1 | 2017-09-28 | Multiple open redirect vulnerabilities in OpenText Documentum Administrator 7.2.0180.0055 allow remote attackers to redirect users to arbitrary web sites and c… |
CVE-2015-4668 | Medium | 6.1 | 2017-09-25 | Open redirect vulnerability in Xsuite 2.4.4.5 and earlier allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a U… |
CVE-2017-14725 | Medium | 5.4 | 2017-09-23 | Before version 4.8.2, WordPress was susceptible to an open redirect attack in wp-admin/edit-tag-form.php and wp-admin/user-edit.php. |
CVE-2015-5608 | Medium | 6.1 | 2017-09-20 | Open redirect vulnerability in Joomla! CMS 3.0.0 through 3.4.1. |
CVE-2015-3880 | Medium | 6.1 | 2017-09-19 | Open redirect vulnerability in phpBB before 3.0.14 and 3.1.x before 3.1.4 allows remote attackers to redirect users of Google Chrome to arbitrary web sites and… |
CVE-2017-1002150 | Medium | 6.1 | 2017-09-14 | python-fedora 0.8.0 and lower is vulnerable to an open redirect resulting in loss of CSRF protection |
CVE-2015-2750 | Medium | 6.1 | 2017-09-13 | Open redirect vulnerability in URL-related API functions in Drupal 6.x before 6.35 and 7.x before 7.35 allows remote attackers to redirect users to arbitrary w… |
CVE-2015-2749 | Medium | 6.1 | 2017-09-13 | Open redirect vulnerability in Drupal 6.x before 6.35 and 7.x before 7.35 allows remote attackers to redirect users to arbitrary web sites and conduct phishing… |
CVE-2015-5054 | Medium | 6.1 | 2017-09-11 | Open redirect vulnerability in Ellucian (formerly SunGard) Banner Student 8.5.1.2 through 8.7 allows remote attackers to redirect users to arbitrary web sites… |
CVE-2017-1450 | Medium | 6.1 | 2017-08-31 | IBM Emptoris Sourcing 9.5 - 10.1.3 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a… |
CVE-2017-1449 | Medium | 5.4 | 2017-08-31 | IBM Emptoris Sourcing 9.5 - 10.1.3 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a… |
CVE-2017-14038 | Medium | 6.1 | 2017-08-30 | CrushFTP before 7.8.0 and 8.x before 8.2.0 has a redirect vulnerability. |
CVE-2017-1195 | Medium | 6.1 | 2017-08-29 | IBM Curam Social Program Management 6.0, 6.1, 6.2, and 7.0 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuad… |
CVE-2017-1489 | Medium | 6.1 | 2017-08-29 | IBM Security Access Manager 6.1, 7.0, 8.0, and 9.0 e-community configurations may be affected by a redirect vulnerability. ECSSO Master Authentication can redi… |
CVE-2017-3085 | High | 7.4 | 2017-08-11 | Adobe Flash Player versions 26.0.0.137 and earlier have a security bypass vulnerability that leads to information disclosure when performing URL redirect. |
CVE-2017-1448 | Medium | 5.4 | 2017-08-09 | IBM Emptoris Supplier Lifecycle Management 10.0.x and 10.1.x could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persu… |
CVE-2016-8949 | Medium | 5.4 | 2017-08-09 | IBM Emptoris Supplier Lifecycle Management 10.0.x and 10.1.x could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persu… |
CVE-2017-12138 | Medium | 6.1 | 2017-08-02 | XOOPS Core 2.5.8 has a stored URL redirect bypass vulnerability in /modules/profile/index.php because of the URL filter. |
CVE-2017-11725 | Medium | 5.4 | 2017-07-29 | The share function in Thycotic Secret Server before 10.2.000019 mishandles the Back Button, leading to unintended redirections. |
CVE-2017-11718 | Medium | 6.1 | 2017-07-28 | There is URL Redirector Abuse in MetInfo through 5.3.17 via the gourl parameter to member/login.php. |
CVE-2017-1287 | Medium | 5.4 | 2017-07-24 | IBM Rhapsody DM 5.0 and 6.0 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a special… |
CVE-2017-11586 | Medium | 6.1 | 2017-07-24 | dayrui FineCms 5.0.9 has URL Redirector Abuse via the url parameter in a sync action, related to controllers/Weixin.php. |
CVE-2017-1223 | Medium | 6.1 | 2017-07-19 | IBM Tivoli Endpoint Manager could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a special… |
CVE-2017-1000070 | Medium | 6.1 | 2017-07-17 | The Bitly oauth2_proxy in version 2.1 and earlier was affected by an open redirect vulnerability during the start and termination of the 2-legged OAuth flow. T… |
CVE-2017-1000027 | Medium | 6.1 | 2017-07-17 | Koozali Foundation SME Server versions 8.x, 9.x, 10.x are vulnerable to an open URL redirect vulnerability in the user web login function resulting in unauthor… |
CVE-2017-1000013 | Medium | 6.1 | 2017-07-17 | phpMyAdmin 4.0, 4.4, and 4.6 are vulnerable to an open redirect weakness |
CVE-2016-8953 | Medium | 5.4 | 2017-07-12 | IBM Emptoris Sourcing 9.5.x through 10.1.x could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to… |
CVE-2016-8947 | Medium | 6.1 | 2017-07-12 | IBM Emptoris Sourcing 9.5.x through 10.1.x could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to… |
CVE-2017-8621 | Medium | 6.1 | 2017-07-11 | Microsoft Exchange Server 2010 SP3, Exchange Server 2013 SP3, Exchange Server 2013 CU16, and Exchange Server 2016 CU5 allows an open redirect vulnerability tha… |
CVE-2017-1398 | Medium | 6.1 | 2017-07-10 | IBM WebSphere Commerce Enterprise, Professional, Express, and Developer 6.0, 7.0, and 8.0 could allow a remote attacker to conduct phishing attacks, using an o… |
CVE-2017-2217 | Medium | 6.1 | 2017-07-07 | Open redirect vulnerability in WordPress Download Manager prior to version 2.9.51 allows remote attackers to redirect users to arbitrary web sites and conduct… |
CVE-2017-5002 | Medium | 6.1 | 2017-07-07 | EMC RSA Archer 5.4.1.3, 5.5.3.1, 5.5.2.3, 5.5.2, 5.5.1.3.1, 5.5.1.1 is affected by an open redirect vulnerability. A remote unprivileged attacker may potential… |
CVE-2017-6018 | Medium | 6.1 | 2017-06-30 | An open redirect issue was discovered in B. Braun Medical SpaceCom module, which is integrated into the SpaceStation docking station: SpaceStation with SpaceCo… |
CVE-2017-8451 | Medium | 6.1 | 2017-06-16 | With X-Pack installed, Kibana versions before 5.3.1 have an open redirect vulnerability on the login page that would enable an attacker to craft a link that re… |
CVE-2016-10365 | Medium | 6.1 | 2017-06-16 | Kibana versions before 4.6.3 and 5.0.1 have an open redirect vulnerability that would enable an attacker to craft a link in the Kibana domain that redirects to… |
CVE-2017-9464 | Medium | 6.1 | 2017-06-14 | An open redirect vulnerability is present in Piwigo 2.9 and probably prior versions, allowing remote attackers to redirect users to arbitrary web sites and con… |
CVE-2017-6670 | Medium | 6.1 | 2017-06-13 | A vulnerability in the web-based GUI of Cisco Unified Communications Domain Manager could allow an unauthenticated, remote attacker to redirect a user to a mal… |
CVE-2016-7831 | Medium | 6.1 | 2017-06-09 | Sleipnir 4 Black Edition for Mac 4.5.3 and earlier and Sleipnir 4 for Mac 4.5.3 and earlier (Mac App Store) may allow a remote attacker to spoof the URL displa… |
CVE-2017-9297 | Medium | 6.1 | 2017-05-29 | Open Redirect vulnerability in Hitachi Device Manager before 8.5.2-01 allows remote attackers to redirect users to arbitrary web sites. |
CVE-2017-9296 | Medium | 6.1 | 2017-05-29 | Open Redirect vulnerability in Hitachi Device Manager before 8.5.2-01 and Hitachi Tuning Manager before 8.5.2-00 allows remote attackers to redirect authentica… |
CVE-2017-7343 | Medium | 6.1 | 2017-05-27 | An open redirect vulnerability in Fortinet FortiPortal 4.0.0 and below allows attacker to execute unauthorized code or commands via the url parameter. |
CVE-2017-3126 | Medium | 6.1 | 2017-05-27 | An Open Redirect vulnerability in Fortinet FortiAnalyzer 5.4.0 through 5.4.2 and FortiManager 5.4.0 through 5.4.2 allows attacker to execute unauthorized code… |
CVE-2015-3190 | Medium | 6.1 | 2017-05-25 | With Cloud Foundry Runtime cf-release versions v209 or earlier, UAA Standalone versions 2.2.6 or earlier and Pivotal Cloud Foundry Runtime 1.4.5 or earlier the… |
CVE-2017-1159 | Medium | 5.4 | 2017-05-22 | IBM Business Process Manager 8.0 and 8.5 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to vi… |
CVE-2017-2497 | Medium | 6.1 | 2017-05-22 | An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. macOS before 10.12.5 is affected. The issue involves the "iBooks" component… |
CVE-2015-5241 | Medium | 6.1 | 2017-05-19 | After logging into the portal, the logout jsp page redirects the browser back to the login page after. It is feasible for malicious users to redirect the brows… |
CVE-2017-9062 | High | 8.6 | 2017-05-18 | In WordPress before 4.7.5, there is improper handling of post meta data values in the XML-RPC API. |
CVE-2015-4070 | Medium | 6.1 | 2017-05-17 | Open redirect vulnerability in the proxyimages function in wowproxy.php in the Wow Moodboard Lite plugin 1.1.1.1 for WordPress allows remote attackers to redir… |
CVE-2016-4859 | Medium | 6.1 | 2017-05-12 | Open redirect vulnerability in Splunk Enterprise 6.4.x prior to 6.4.3, Splunk Enterprise 6.3.x prior to 6.3.6, Splunk Enterprise 6.2.x prior to 6.2.10, Splunk… |
CVE-2016-4857 | Medium | 6.1 | 2017-05-12 | Open redirect vulnerability in Splunk Enterprise 6.4.x prior to 6.4.2, Splunk Enterprise 6.3.x prior to 6.3.6, Splunk Enterprise 6.2.x prior to 6.2.11 and Splu… |
CVE-2016-9099 | Medium | 6.1 | 2017-05-11 | Symantec Advanced Secure Gateway (ASG) 6.6, ASG 6.7 prior to 6.7.2.1, ProxySG 6.5 prior to 6.5.10.6, ProxySG 6.6, and ProxySG 6.7 prior to 6.7.2.1 are suscepti… |
CVE-2017-1156 | High | 8.8 | 2017-05-05 | IBM WebSphere Portal 8.5 and 9.0 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a sp… |
CVE-2016-10368 | Medium | 6.1 | 2017-05-03 | Open redirect vulnerability in Opsview Monitor Pro (Prior to 5.1.0.162300841, prior to 5.0.2.27475, prior to 4.6.4.162391051, and 4.5.x without a certain 2016… |