CWE-601 · URL Redirection to Untrusted Site (Open Redirect) (page 7)
Page 7 of 17 — CVEs classified under CWE-601, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-20634 | Medium | 4.7 | 2024-11-15 | A vulnerability in the web-based management interface of Cisco ECE could allow an unauthenticated, remote attacker to redirect a user to an undesired web… |
CVE-2024-1240 | Medium | 6.1 | 2024-11-15 | An open redirection vulnerability exists in pyload/pyload version 0.5.0. The vulnerability is due to improper handling of the 'next' parameter in the login fun… |
CVE-2024-11207 | Medium | 4.3 | 2024-11-14 | A vulnerability has been found in Apereo CAS 6.6 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /login… |
CVE-2024-30140 | Medium | 5.4 | 2024-11-07 | HCL BigFix Compliance is affected by unvalidated redirects and forwards. The HOST header can be manipulated by an attacker and as a result, it can poison the… |
CVE-2024-50345 | Low | 3.1 | 2024-11-06 | symfony/http-foundation is a module for the Symphony PHP framework which defines an object-oriented layer for the HTTP specification. The `Request` class, does… |
CVE-2024-48463 | Medium | 6.5 | 2024-11-04 | Bruno before 1.29.1 uses Electron shell.openExternal without validation (of http or https) for opening windows within the Markdown docs viewer. |
CVE-2024-25566 | Medium | 6.1 | 2024-10-29 | An Open-Redirect vulnerability exists in PingAM where well-crafted requests may cause improper validation of redirect URLs. This could allow an attacker to red… |
CVE-2024-42930 | Medium | 6.1 | 2024-10-28 | PbootCMS 3.2.8 is vulnerable to URL Redirect. |
CVE-2024-50463 | Medium | 4.7 | 2024-10-28 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in sunshinephotocart Sunshine Photo Cart sunshine-photo-cart.This issue affects Sunshine Phot… |
CVE-2024-49682 | Medium | 4.7 | 2024-10-24 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in wp.insider Simple Membership simple-membership allows Phishing.This issue affects Simple M… |
CVE-2024-46326 | Medium | 6.1 | 2024-10-21 | Public Knowledge Project pkp-lib 3.4.0-7 and earlier is vulnerable to Open redirect due to a lack of input sanitization in the logout function. |
CVE-2024-47353 | Medium | 4.7 | 2024-10-11 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in quomodosoft ElementsReady Addons for Elementor element-ready-lite.This issue affects Eleme… |
CVE-2024-47648 | Medium | 4.7 | 2024-10-10 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Metagauss EventPrime eventprime-event-calendar-management.This issue affects EventPrime: f… |
CVE-2024-47354 | Medium | 4.7 | 2024-10-10 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in wp.insider Simple Membership After Login Redirection simple-membership-after-login-redirec… |
CVE-2024-43543 | Medium | 6.8 | 2024-10-08 | Windows Mobile Broadband Driver Remote Code Execution Vulnerability |
CVE-2024-43536 | Medium | 6.8 | 2024-10-08 | Windows Mobile Broadband Driver Remote Code Execution Vulnerability |
CVE-2024-46886 | Medium | 4.7 | 2024-10-08 | The web server of affected devices does not properly validate input that is used for a user redirection. This could allow an attacker to make the server redire… |
CVE-2024-45247 | Medium | 6.1 | 2024-10-06 | Sonarr – CWE-601: URL Redirection to Untrusted Site ('Open Redirect') |
CVE-2024-47646 | Medium | 4.7 | 2024-10-05 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in tomlister Payflex Payment Gateway payflex-payment-gateway.This issue affects Payflex Payme… |
CVE-2024-43683 | Medium | 6.1 | 2024-10-04 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Microchip TimeProvider 4100 allows XSS Through HTTP Headers.This issue affects TimeProvide… |
CVE-2024-8148 | Medium | 6.1 | 2024-10-04 | There is an unvalidated redirect vulnerability in Esri Portal for ArcGIS 11.2 and below that may allow a remote, unauthenticated attacker to craft a URL that c… |
CVE-2024-38037 | Medium | 6.1 | 2024-10-04 | There is an unvalidated redirect vulnerability in Esri Portal for ArcGIS 11.0 and below that may allow a remote, unauthenticated attacker to craft a URL that c… |
CVE-2024-9266 | Medium | 4.7 | 2024-10-03 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Express. This vulnerability affects the use of the Express Response object. This issue imp… |
CVE-2024-47530 | Medium | 5.4 | 2024-09-30 | Scout is a web-based visualizer for VCF-files. Open redirect vulnerability allows performing phishing attacks on users by redirecting them to malicious page. /… |
CVE-2024-9329 | Medium | 6.1 | 2024-09-30 | In Eclipse Glassfish versions before 7.0.17, The Host HTTP parameter could cause the web application to redirect to the specified URL, when the requested endpo… |
CVE-2024-46331 | High | 7.2 | 2024-09-27 | ModStartCMS v8.8.0 was discovered to contain an open redirect vulnerability in the redirect parameter at /admin/login. This vulnerability allows attackers to r… |
CVE-2024-45981 | High | 8.8 | 2024-09-26 | A host header injection vulnerability in BookReviewLibrary 1.0 allows attackers to obtain the password reset token via user interaction with a crafted password… |
CVE-2024-45979 | High | 8.8 | 2024-09-26 | A host header injection vulnerability in Lines Police CAD 1.0 allows attackers to obtain the password reset token via user interaction with a crafted password… |
CVE-2024-8883 | Medium | 6.1 | 2024-09-19 | A misconfiguration flaw was found in Keycloak. This issue can allow an attacker to redirect users to an arbitrary URL if a 'Valid Redirect URI' is set to http… |
CVE-2024-8897 | Medium | 6.1 | 2024-09-17 | Under certain conditions, an attacker with the ability to redirect users to a malicious site via an open redirect on a trusted site, may be able to spoof the a… |
CVE-2024-8761 | High | 7.2 | 2024-09-17 | The Share This Image plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 2.03. This is due to insufficient validation on… |
CVE-2024-4283 | Medium | 6.4 | 2024-09-16 | An issue has been discovered in GitLab EE affecting all versions starting from 11.1 before 17.1.7, 17.2 before 17.2.5, and 17.3 before 17.3.2. Under certain co… |
CVE-2024-4612 | Medium | 6.4 | 2024-09-12 | An issue has been discovered in GitLab EE affecting all versions starting from 12.9 before 17.1.7, 17.2 before 17.2.5, and 17.3 before 17.3.2. Under certain co… |
CVE-2024-7312 | Medium | 6.1 | 2024-09-11 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Payara Platform Payara Server (REST Management Interface modules) allows Session Hijacking… |
CVE-2024-8646 | Medium | 6.1 | 2024-09-11 | In Eclipse Glassfish versions prior to 7.0.10, a URL redirection vulnerability to untrusted sites existed. This vulnerability is caused by the vulnerability (C… |
CVE-2024-7260 | Medium | 6.1 | 2024-09-09 | An open redirect vulnerability was found in Keycloak. A specially crafted URL can be constructed where the referrer and referrer_uri parameters are made to tri… |
CVE-2024-8586 | Medium | 6.1 | 2024-09-09 | WebITR from Uniong has an Open Redirect vulnerability, which allows unauthorized remote attackers to exploit this vulnerability to forge URLs. Users, believing… |
CVE-2024-42341 | Medium | 6.1 | 2024-09-08 | Loway - CWE-601: URL Redirection to Untrusted Site ('Open Redirect') |
CVE-2024-8555 | Medium | 4.3 | 2024-09-07 | A vulnerability was found in SourceCodester Clinics Patient Management System 2.0. It has been classified as problematic. Affected is an unknown function of th… |
CVE-2024-8412 | Medium | 4.3 | 2024-09-04 | A vulnerability, which was classified as problematic, was found in LinuxOSsk Shakal-NG up to 1.3.3. Affected is an unknown function of the file comments/views… |
CVE-2024-8386 | Medium | 6.1 | 2024-09-03 | If a site had been granted the permission to open popup windows, it could cause Select elements to appear on top of another site to perform a spoofing attack… |
CVE-2024-44776 | Medium | 6.1 | 2024-08-29 | An Open Redirect vulnerability in the page parameter of vTiger CRM v7.4.0 allows attackers to redirect users to a malicious site via a crafted URL. |
CVE-2024-35133 | Medium | 6.8 | 2024-08-29 | IBM Security Verify Access 10.0.0 through 10.0.8 OIDC Provider could allow a remote authenticated attacker to conduct phishing attacks, using an open redirect… |
CVE-2024-7941 | Medium | 4.3 | 2024-08-27 | An HTTP parameter may contain a URL value and could cause the web application to redirect the request to the specified URL. By modifying the URL value to a mal… |
CVE-2024-39097 | Medium | 6.1 | 2024-08-26 | There is an Open Redirect vulnerability in Gnuboard v6.0.4 and below via the `url` parameter in login path. |
CVE-2024-7428 | | 2024-08-23 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in OpenText™ Network Node Manager i (NNMi) allows URL Redirector Abuse.This issue affects Net… | |
CVE-2024-43794 | Medium | 6.1 | 2024-08-23 | OpenSearch Dashboards Security Plugin adds a configuration management UI for the OpenSearch Security features to OpenSearch Dashboards. Improper validation of… |
CVE-2024-27184 | Medium | 6.1 | 2024-08-20 | Inadequate validation of URLs could result into an invalid check whether an redirect URL is internal or not.. |
CVE-2024-6377 | High | 8.1 | 2024-08-20 | An URL redirection to untrusted site (open redirect) vulnerability affecting 3DPassport in 3DSwymer from Release 3DEXPERIENCE R2022x through Release 3DEXPERIEN… |
CVE-2024-43280 | Medium | 4.7 | 2024-08-19 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Salon Booking System Salon booking system.This issue affects Salon booking system: from n/… |
CVE-2024-43236 | Medium | 4.7 | 2024-08-19 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Scott Paterson Easy PayPal Buy Now Button.This issue affects Easy PayPal Buy Now Button: f… |
CVE-2024-7902 | Medium | 4.3 | 2024-08-17 | A vulnerability was found in pkp ojs up to 3.4.0-6 and classified as problematic. Affected by this issue is some unknown functionality of the file /login/signO… |
CVE-2024-42353 | Medium | 6.1 | 2024-08-14 | WebOb provides objects for HTTP requests and responses. When WebOb normalizes the HTTP Location header to include the request hostname, it does so by parsing t… |
CVE-2024-38211 | High | 8.2 | 2024-08-13 | Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability |
CVE-2024-7211 | Medium | 4.7 | 2024-08-01 | The 1E Platform's component utilized the third-party Duende Identity Server, which suffered from an open redirect vulnerability, permitting an attacker to cont… |
CVE-2024-41955 | Medium | 5.2 | 2024-07-31 | Mobile Security Framework (MobSF) is a security research platform for mobile applications in Android, iOS and Windows Mobile. An open redirect vulnerability ex… |
CVE-2024-39694 | Medium | 4.7 | 2024-07-31 | Duende IdentityServer is an OpenID Connect and OAuth 2.x framework for ASP.NET Core. It is possible for an attacker to craft malicious Urls that certain functi… |
CVE-2024-41801 | Medium | 4.7 | 2024-07-25 | OpenProject is open source project management software. Prior to version 14.3.0, using a forged HOST header in the default configuration of packaged installati… |
CVE-2024-21684 | Medium | 4.3 | 2024-07-24 | There is a low severity open redirect vulnerability within affected versions of Bitbucket Data Center. Versions of Bitbucket DC from 8.0.0 to 8.9.12 and 8.19.0… |
CVE-2024-20400 | Medium | 4.7 | 2024-07-17 | A vulnerability in the web-based management interface of Cisco Expressway Series could allow an unauthenticated, remote attacker to redirect a user to a malici… |
CVE-2024-6289 | Medium | 6.1 | 2024-07-15 | The WPS Hide Login WordPress plugin before 1.9.16.4 does not prevent redirects to the login page via the auth_redirect WordPress function, allowing an unauthen… |
CVE-2024-6149 | Medium | 6.1 | 2024-07-10 | Redirection of users to a vulnerable URL in Citrix Workspace app for HTML5 |
CVE-2024-5492 | Medium | 6.1 | 2024-07-10 | Open redirect vulnerability allows a remote unauthenticated attacker to redirect users to arbitrary websites in NetScaler ADC and NetScaler Gateway |
CVE-2024-37830 | Medium | 6.1 | 2024-07-09 | An issue in Outline <= v0.76.1 allows attackers to redirect a victim user to a malicious site via intercepting and changing the state cookie. |
CVE-2024-4882 | | 2024-07-08 | The user may be redirected to an arbitrary site in Sitefinity 15.1.8321.0 and previous versions. | |
CVE-2024-37234 | Low | 3.5 | 2024-07-06 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Kodezen Limited Academy LMS.This issue affects Academy LMS: from n/a through 2.0.4. |
CVE-2024-5936 | Medium | 6.1 | 2024-06-27 | An open redirect vulnerability exists in imartinez/privategpt version 0.5.0 due to improper handling of the 'file' parameter. This vulnerability allows attacke… |
CVE-2024-4704 | Medium | 6.1 | 2024-06-27 | The Contact Form 7 WordPress plugin before 5.9.5 has an open redirect that allows an attacker to utilize a false URL and redirect to the URL of their choosing. |
CVE-2024-4604 | Medium | 6.1 | 2024-06-26 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Magarsus Consultancy SSO (Single Sign On) allows Manipulating Hidden Fields. This issue a… |
CVE-2024-37141 | Low | 3.5 | 2024-06-26 | Dell PowerProtect DD, versions prior to 8.0, LTS 7.13.1.0, LTS 7.10.1.30, LTS 7.7.5.40 contain an open redirect vulnerability. A remote low privileged attacker… |
CVE-2024-24764 | Low | 3.5 | 2024-06-26 | October is a self-hosted CMS platform based on the Laravel PHP Framework. This issue affects authenticated administrators who may be redirected to an untrusted… |
CVE-2024-4900 | Medium | 6.1 | 2024-06-24 | The SEOPress WordPress plugin before 7.8 does not validate and escape one of its Post settings, which could allow contributor and above role to perform Open r… |
CVE-2024-4940 | Medium | 6.1 | 2024-06-22 | An open redirect vulnerability exists in the gradio-app/gradio, affecting the latest version. The vulnerability allows an attacker to redirect users to arbitra… |
CVE-2024-3597 | High | 7.1 | 2024-06-20 | The Export WP Page to Static HTML/CSS plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 2.2.2. This is due to insuffici… |
CVE-2024-37881 | Medium | 5.3 | 2024-06-19 | SiteGuard WP Plugin provides a functionality to customize the path to the login page wp-login.php and implements a measure to avoid redirection from other URLs… |
CVE-2024-23442 | Medium | 6.1 | 2024-06-14 | An open redirect issue was discovered in Kibana that could lead to a user being redirected to an arbitrary website if they use a maliciously crafted Kibana URL. |
CVE-2024-3032 | Medium | 6.1 | 2024-06-13 | Themify Builder WordPress plugin before 7.5.8 does not validate a parameter before redirecting the user to its value, leading to an Open Redirect issue |
CVE-2024-34065 | High | 7.1 | 2024-06-12 | Strapi is an open-source content management system. By combining two vulnerabilities (an `Open Redirect` and `session token sent as URL query parameter`) in @s… |
CVE-2024-22244 | Medium | 4.3 | 2024-06-10 | Open Redirect in Harbor <=v2.8.4, <=v2.9.2, and <=v2.10.0 may redirect a user to a malicious site. |
CVE-2024-36419 | Medium | 4.3 | 2024-06-10 | SuiteCRM is an open-source Customer Relationship Management (CRM) software application. A vulnerability in versions prior to 8.6.1 allows for Host Header Injec… |
CVE-2024-36406 | Medium | 5.4 | 2024-06-10 | SuiteCRM is an open-source Customer Relationship Management (CRM) software application. In versions prior to 7.14.4 and 8.6.1, unchecked input allows for open… |
CVE-2024-23664 | Medium | 6.1 | 2024-06-03 | A URL redirection to untrusted site ('open redirect') in Fortinet FortiAuthenticator version 6.6.0, version 6.5.3 and below, version 6.4.9 and below may allow… |
CVE-2024-34071 | Medium | 6.1 | 2024-05-21 | Umbraco is an ASP.NET CMS used by more than 730.000 websites. Umbraco has an endpoint that is vulnerable to open redirects. The endpoint is protected so it req… |
CVE-2024-20369 | Medium | 4.7 | 2024-05-15 | A vulnerability in the web-based management interface of Cisco Crosswork Network Services Orchestrator (NSO) could allow an unauthenticated, remote attacker to… |
CVE-2024-4773 | High | 7.5 | 2024-05-14 | When a network error occurred during page load, the prior content could have remained in view with a blank URL bar. This could have been used to obfuscate a sp… |
CVE-2024-4445 | Medium | 6.5 | 2024-05-14 | The WP Compress – Image Optimizer [All-In-One] plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the… |
CVE-2023-6812 | Medium | 4.3 | 2024-05-14 | The WP Compress – Image Optimizer [All-In-One plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 6.20.01. This is due to… |
CVE-2024-34074 | Medium | 6.1 | 2024-05-14 | Frappe is a full-stack web application framework. Prior to 15.26.0 and 14.74.0, the login page accepts redirect argument and it allowed redirect to untrusted e… |
CVE-2024-4133 | Medium | 6.1 | 2024-05-02 | The ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup plugin for WordPress is vulnerable to Open Redirect in all ver… |
CVE-2024-33930 | Medium | 4.7 | 2024-05-02 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in ILLID Share This Image.This issue affects Share This Image: from n/a through 1.97. |
CVE-2024-25676 | Medium | 4.7 | 2024-05-01 | An issue was discovered in ViewerJS 0.5.8. A script from the component loads content via URL TAGs without properly sanitizing it. This leads to both open redir… |
CVE-2024-26504 | High | 8.8 | 2024-05-01 | An issue in Wifire Hotspot v.4.5.3 allows a local attacker to execute arbitrary code via a crafted payload to the dst parameter. |
CVE-2024-33584 | Medium | 4.7 | 2024-04-29 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Deepen Bajracharya Video Conferencing with Zoom.This issue affects Video Conferencing with… |
CVE-2024-33661 | Critical | 9.1 | 2024-04-26 | Portainer before 2.20.0 allows redirects when the target is not index.yaml. |
CVE-2022-36029 | Critical | 9.1 | 2024-04-25 | Greenlight is an end-user interface for BigBlueButton servers. Versions prior to 2.13.0 have an open redirect vulnerability in the Login page due to unchecked… |
CVE-2022-36028 | Critical | 9.1 | 2024-04-25 | Greenlight is an end-user interface for BigBlueButton servers. Versions prior to 2.13.0 have an open redirect vulnerability in the Login page due to unchecked… |
CVE-2024-32078 | Medium | 4.1 | 2024-04-24 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Foliovision FV Flowplayer Video Player.This issue affects FV Flowplayer Video Player: from… |
CVE-2024-28076 | High | 7.0 | 2024-04-18 | The SolarWinds Platform was susceptible to a Arbitrary Open Redirection Vulnerability. A potential attacker can redirect to different domain when using URL par… |
CVE-2024-2419 | High | 7.1 | 2024-04-17 | A flaw was found in Keycloak's redirect_uri validation logic. This issue may allow a bypass of otherwise explicitly allowed hosts. A successful attack may lead… |
CVE-2024-21065 | Medium | 6.1 | 2024-04-16 | Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Workflow). Supported versions that are affected are 8.59, 8.60… |