CWE-601 · URL Redirection to Untrusted Site (Open Redirect) (page 8)
Page 8 of 17 — CVEs classified under CWE-601, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-22262 | High | 8.1 | 2024-04-16 | Applications that use UriComponentsBuilder to parse an externally provided URL (e.g. through a query parameter) AND perform validation checks on the host of th… |
CVE-2024-1183 | Medium | 6.5 | 2024-04-16 | An SSRF (Server-Side Request Forgery) vulnerability exists in the gradio-app/gradio repository, allowing attackers to scan and identify open ports within an in… |
CVE-2024-32129 | Medium | 4.7 | 2024-04-15 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Freshworks Freshdesk (official).This issue affects Freshdesk (official): from n/a through… |
CVE-2024-27592 | Medium | 4.3 | 2024-04-11 | Open Redirect vulnerability in Corezoid Process Engine v6.5.0 allows attackers to redirect to arbitrary websites via appending a crafted link to /login/ in the… |
CVE-2024-28344 | Low | 3.1 | 2024-04-10 | An Open Redirect vulnerability was found in Sipwise C5 NGCP Dashboard below mr11.5.1. The Open Redirect vulnerability allows attackers to control the "back" pa… |
CVE-2024-31282 | Medium | 4.7 | 2024-04-10 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Appcheap.Io App Builder.This issue affects App Builder: from n/a through 3.8.7. |
CVE-2024-31253 | Medium | 4.7 | 2024-04-10 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in WP OAuth Server OAuth Server.This issue affects OAuth Server: from n/a through 4.3.3. |
CVE-2024-31213 | Low | 3.5 | 2024-04-05 | InstantCMS is a free and open source content management system. An open redirect was found in the ICMS2 application version 2.16.2 when being redirected after… |
CVE-2024-28287 | High | 7.3 | 2024-04-02 | A DOM-based open redirection in the returnUrl parameter of INSTINCT UI Web Client 6.5.0 allows attackers to redirect users to malicious sites via a crafted URL. |
CVE-2024-22248 | High | 7.1 | 2024-04-02 | VMware SD-WAN Orchestrator contains an open redirect vulnerability. A malicious actor may be able to redirect a victim to an attacker controlled domain due t… |
CVE-2024-31135 | Medium | 6.1 | 2024-03-28 | In JetBrains TeamCity before 2024.03 open redirect was possible on the login page |
CVE-2023-34020 | Medium | 4.7 | 2024-03-27 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Uncanny Owl Uncanny Toolkit for LearnDash.This issue affects Uncanny Toolkit for LearnDash… |
CVE-2024-29041 | Medium | 6.1 | 2024-03-25 | Express.js minimalist web framework for node. Versions of Express.js prior to 4.19.0 and all pre-release alpha and beta versions of 5.0 are affected by an open… |
CVE-2024-2465 | High | 7.1 | 2024-03-21 | Open redirection vulnerability in CDeX application allows to redirect users to arbitrary websites via a specially crafted URL.This issue affects CDeX applicati… |
CVE-2024-27291 | Medium | 6.1 | 2024-03-21 | Docassemble is an expert system for guided interviews and document assembly. Prior to 1.4.97, it is possible to create a URL that acts as an open redirect. The… |
CVE-2024-24818 | Medium | 5.9 | 2024-03-21 | EspoCRM is an Open Source Customer Relationship Management software. An attacker can inject arbitrary IP or domain in "Password Change" page and redirect victi… |
CVE-2024-0337 | Medium | 6.1 | 2024-03-20 | The Travelpayouts: All Travel Brands in One Place WordPress plugin through 1.1.15 is vulnerable to Open Redirect due to insufficient validation on the travelpa… |
CVE-2024-25657 | Medium | 5.4 | 2024-03-18 | An open redirect in the Login/Logout functionality of web management in AVSystem Unified Management Platform (UMP) 23.07.0.16567~LTS could allow attackers to r… |
CVE-2024-22259 | High | 8.1 | 2024-03-16 | Applications that use UriComponentsBuilder in Spring Framework to parse an externally provided URL (e.g. through a query parameter) AND perform validation chec… |
CVE-2024-28239 | Medium | 5.4 | 2024-03-12 | Directus is a real-time API and App dashboard for managing SQL database content. The authentication API has a `redirect` parameter that can be exploited as an… |
CVE-2024-28113 | Low | 3.5 | 2024-03-12 | Peering Manager is a BGP session management tool. In Peering Manager <=1.8.2, it is possible to redirect users to an arbitrary page using a crafted url. As a r… |
CVE-2024-1227 | Medium | 6.5 | 2024-03-12 | An open redirect vulnerability, the exploitation of which could allow an attacker to create a custom URL and redirect a legitimate page to a malicious site. |
CVE-2024-22891 | Critical | 9.8 | 2024-03-01 | Nteract v.0.28.0 was discovered to contain a remote code execution (RCE) vulnerability via the Markdown link. |
CVE-2024-21723 | Medium | 4.3 | 2024-02-29 | Inadequate parsing of URLs could result into an open redirect. |
CVE-2024-22243 | High | 8.1 | 2024-02-23 | Applications that use UriComponentsBuilder to parse an externally provided URL (e.g. through a query parameter) AND perform validation checks on the host of th… |
CVE-2022-45169 | Medium | 5.4 | 2024-02-21 | An issue was discovered in LIVEBOX Collaboration vDesk through v031. A URL Redirection to an Untrusted Site (Open Redirect) can occur under the /api/v1/notific… |
CVE-2024-24763 | Medium | 4.3 | 2024-02-20 | JumpServer is an open source bastion host and an operation and maintenance security audit system. Prior to version 3.10.0, attackers can exploit this vulnerabi… |
CVE-2024-25609 | Medium | 6.1 | 2024-02-20 | HtmlUtil.escapeRedirect in Liferay Portal 7.2.0 through 7.4.3.12, and older unsupported versions, and Liferay DXP 7.4 before update 9, 7.3 service pack 3, 7.2… |
CVE-2024-25608 | Medium | 6.1 | 2024-02-20 | HtmlUtil.escapeRedirect in Liferay Portal 7.2.0 through 7.4.3.18, and older unsupported versions, and Liferay DXP 7.4 before update 19, 7.3 before update 4, 7… |
CVE-2023-44308 | Medium | 6.1 | 2024-02-20 | Open redirect vulnerability in adaptive media administration page in Liferay DXP 2023.Q3 before patch 6, and 7.4 GA through update 92 allows remote attackers t… |
CVE-2023-5190 | Medium | 6.1 | 2024-02-20 | Open redirect vulnerability in the Countries Management’s edit region page in Liferay Portal 7.4.3.45 through 7.4.3.101, and Liferay DXP 2023.Q3 before patch 6… |
CVE-2024-21497 | Medium | 5.4 | 2024-02-17 | Versions of the package github.com/greenpau/caddy-security are vulnerable to Open Redirect via the redirect_url parameter. An attacker could perform a phishin… |
CVE-2024-22854 | Medium | 6.1 | 2024-02-16 | DOM-based HTML injection vulnerability in the main page of Darktrace Threat Visualizer version 6.1.27 (bundle version 61050) and before has been identified. A… |
CVE-2024-21728 | Medium | 6.1 | 2024-02-15 | An Open Redirect vulnerability was found in osTicky2 below 2.2.8. osTicky (osTicket Bridge) by SmartCalc is a Joomla 3.x extension that provides Joomla fronted… |
CVE-2024-25559 | Medium | 4.7 | 2024-02-15 | URL spoofing vulnerability exists in a-blog cms Ver.3.1.0 to Ver.3.1.8. If an attacker sends a specially crafted request, the administrator of the product may… |
CVE-2024-0250 | Medium | 6.1 | 2024-02-12 | The Analytics Insights for Google Analytics 4 (AIWP) WordPress plugin before 6.3 is vulnerable to Open Redirect due to insufficient validation on the redirect… |
CVE-2024-25715 | Medium | 6.1 | 2024-02-11 | Glewlwyd SSO server 2.x through 2.7.6 allows open redirection via redirect_uri. |
CVE-2024-24034 | Medium | 6.1 | 2024-02-08 | Setor Informatica S.I.L version 3.0 is vulnerable to Open Redirect via the hprinter parameter, allows remote attackers to execute arbitrary code. |
CVE-2024-24291 | Medium | 6.1 | 2024-02-06 | An issue in the component /member/index/login of yzmcms v7.0 allows attackers to direct users to malicious sites via a crafted URL. |
CVE-2024-24808 | Medium | 4.7 | 2024-02-06 | pyLoad is an open-source Download Manager written in pure Python. There is an open redirect vulnerability due to incorrect validation of input values when redi… |
CVE-2024-0953 | Medium | 6.1 | 2024-02-05 | When a user scans a QR Code with the QR Code Scanner feature, the user is not prompted before being navigated to the page specified in the code. This may surp… |
CVE-2024-21794 | Medium | 5.4 | 2024-02-02 | In Rapid Software LLC's Rapid SCADA versions prior to Version 5.8.4, an attacker can redirect users to malicious pages through the login page. |
CVE-2023-6389 | Medium | 6.1 | 2024-01-29 | The WordPress Toolbar WordPress plugin through 2.2.6 redirects to any URL via the "wptbto" parameter. This makes it possible for unauthenticated attackers to r… |
CVE-2023-6291 | High | 7.1 | 2024-01-26 | A flaw was found in the redirect_uri validation logic in Keycloak. This issue may allow a bypass of otherwise explicitly allowed hosts. A successful attack may… |
CVE-2024-22308 | Low | 3.4 | 2024-01-24 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in smp7, wp.Insider Simple Membership.This issue affects Simple Membership: from n/a through… |
CVE-2024-0854 | Medium | 5.4 | 2024-01-24 | URL redirection to untrusted site ('Open Redirect') vulnerability in file access component in Synology DiskStation Manager (DSM) before 6.2.4-25556-8, 7.0.1-42… |
CVE-2024-0781 | Low | 3.5 | 2024-01-22 | A vulnerability, which was classified as problematic, was found in CodeAstro Internet Banking System 1.0. This affects an unknown part of the file pages_client… |
CVE-2024-22113 | Medium | 6.1 | 2024-01-22 | Open redirect vulnerability in Access analysis CGI An-Analyzer released in 2023 December 31 and earlier allows a remote unauthenticated attacker to redirect us… |
CVE-2023-50963 | Medium | 6.5 | 2024-01-19 | IBM Storage Defender - Data Protect 1.0.0 through 1.4.1 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. Th… |
CVE-2024-22400 | Low | 3.1 | 2024-01-18 | Nextcloud User Saml is an app for authenticating Nextcloud users using SAML. In affected versions users can be given a link to the Nextcloud server and end up… |
CVE-2023-3771 | Medium | 6.1 | 2024-01-16 | The T1 WordPress theme through 19.0 is vulnerable to unauthenticated open redirect with which any attacker and redirect users to arbitrary websites. |
CVE-2024-0319 | Medium | 5.4 | 2024-01-15 | Open Redirect vulnerability in FireEye HXTool affecting version 4.6, the exploitation of which could allow an attacker to redirect a legitimate user to a malic… |
CVE-2024-0545 | Medium | 5.3 | 2024-01-15 | A vulnerability classified as problematic was found in CodeCanyon RISE Ultimate Project Manager 3.5.3. This vulnerability affects unknown code of the file /ind… |
CVE-2023-49394 | Medium | 6.1 | 2024-01-10 | Zentao versions 4.1.3 and before has a URL redirect vulnerability, which prevents the system from functioning properly. |
CVE-2024-21734 | Low | 3.7 | 2024-01-09 | SAP Marketing (Contacts App) - version 160, allows an attacker with low privileges to trick a user to open malicious page which could lead to a very convincing… |
CVE-2023-6552 | Medium | 6.1 | 2024-01-08 | Lack of "current" GET parameter validation during the action of changing a language leads to an open redirect vulnerability. |
CVE-2024-21641 | Medium | 6.5 | 2024-01-05 | Flarum is open source discussion platform software. Prior to version 1.8.5, the Flarum `/logout` route includes a redirect parameter that allows any third part… |
CVE-2023-50345 | Low | 3.7 | 2024-01-03 | HCL DRYiCE MyXalytics is impacted by an Open Redirect vulnerability which could allow an attacker to redirect users to malicious sites, potentially leading to… |
CVE-2023-26159 | High | 7.3 | 2024-01-02 | Versions of the package follow-redirects before 1.15.4 are vulnerable to Improper Input Validation due to the improper handling of URLs by the url.parse() func… |
CVE-2023-52263 | Medium | 6.1 | 2023-12-30 | Brave Browser before 1.59.40 does not properly restrict the schema for WebUI factory and redirect. This is related to browser/brave_content_browser_client.cc a… |
CVE-2023-51517 | Medium | 4.1 | 2023-12-29 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in CodePeople Calculated Fields Form.This issue affects Calculated Fields Form: from n/a thro… |
CVE-2023-51675 | Medium | 4.7 | 2023-12-29 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in AAM Advanced Access Manager – Restricted Content, Users & Roles, Enhanced Security and Mor… |
CVE-2023-32517 | Medium | 4.7 | 2023-12-29 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in PluginOps MailChimp Subscribe Form, Optin Builder, PopUp Builder, Form Builder.This issue… |
CVE-2023-32101 | Medium | 4.7 | 2023-12-29 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Pexle Chris Library Viewer.This issue affects Library Viewer: from n/a through 2.0.6. |
CVE-2023-31237 | Medium | 4.7 | 2023-12-29 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Dylan James Zephyr Project Manager.This issue affects Zephyr Project Manager: from n/a thr… |
CVE-2023-31229 | Medium | 4.7 | 2023-12-29 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in WP Directory Kit.This issue affects WP Directory Kit: from n/a through 1.1.9. |
CVE-2023-31095 | Medium | 4.7 | 2023-12-29 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in CRM Perks Integration for HubSpot and Contact Form 7, WPForms, Elementor, Ninja Forms.This… |
CVE-2023-28786 | Low | 3.7 | 2023-12-29 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in SolidWP Solid Security – Password, Two Factor Authentication, and Brute Force Protection.T… |
CVE-2023-49438 | Medium | 6.1 | 2023-12-26 | An open redirect vulnerability in the python package Flask-Security-Too <=5.3.2 allows attackers to redirect unsuspecting users to malicious sites via a crafte… |
CVE-2023-48003 | Medium | 6.1 | 2023-12-26 | An open redirect through HTML injection in user messages in Asp.Net Zero before 12.3.0 allows remote attackers to redirect targeted victims to any URL via the… |
CVE-2023-50297 | Medium | 6.1 | 2023-12-26 | Open redirect vulnerability in PowerCMS (6 Series, 5 Series, and 4 Series) allows a remote unauthenticated attacker to redirect users to arbitrary web sites vi… |
CVE-2023-50704 | Medium | 4.3 | 2023-12-20 | An attacker could construct a URL within the application that causes a redirection to an arbitrary external domain and could be leveraged to facilitate ph… |
CVE-2023-46624 | Medium | 4.7 | 2023-12-19 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Parcel Pro.This issue affects Parcel Pro: from n/a through 1.6.11. |
CVE-2023-37982 | Medium | 4.7 | 2023-12-19 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in CRM Perks Integration for Salesforce and Contact Form 7, WPForms, Elementor, Ninja Forms.T… |
CVE-2023-35883 | Medium | 4.7 | 2023-12-19 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Magazine3 Core Web Vitals & PageSpeed Booster.This issue affects Core Web Vitals & PageSpe… |
CVE-2023-45105 | Medium | 4.7 | 2023-12-19 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in SERVIT Software Solutions affiliate-toolkit – WordPress Affiliate Plugin.This issue affect… |
CVE-2023-41648 | Medium | 4.7 | 2023-12-19 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Swapnil V. Patil Login and Logout Redirect.This issue affects Login and Logout Redirect: f… |
CVE-2023-40602 | Medium | 4.7 | 2023-12-19 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Doofinder Doofinder WP & WooCommerce Search.This issue affects Doofinder WP & WooCommerce… |
CVE-2023-38481 | Medium | 4.7 | 2023-12-19 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in CRM Perks Integration for WooCommerce and Zoho CRM, Books, Invoice, Inventory, Bigin.This… |
CVE-2023-38478 | Medium | 4.7 | 2023-12-19 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in CRM Perks Integration for WooCommerce and QuickBooks.This issue affects Integration for Wo… |
CVE-2023-6927 | Medium | 4.6 | 2023-12-18 | A flaw was found in Keycloak. This issue may allow an attacker to steal authorization codes or tokens from clients using a wildcard in the JARM response mode "… |
CVE-2020-17484 | Medium | 6.1 | 2023-12-16 | An Open Redirection vulnerability exists in Uffizio's GPS Tracker all versions allows an attacker to construct a URL within the application that causes a redir… |
CVE-2023-6545 | Medium | 4.7 | 2023-12-14 | The package authelia-bhf included in Beckhoffs TwinCAT/BSD is prone to an open redirect that allows a remote unprivileged attacker to redirect a user to anothe… |
CVE-2023-46750 | Medium | 6.1 | 2023-12-14 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability when "form" authentication is used in Apache Shiro. Mitigation: Update to Apache Shiro 1.13.0… |
CVE-2023-5629 | High | 8.2 | 2023-12-14 | A CWE-601:URL Redirection to Untrusted Site (‘Open Redirect’) vulnerability exists that could cause disclosure of information through phishing attempts over H… |
CVE-2023-50771 | Medium | 6.1 | 2023-12-13 | Jenkins OpenId Connect Authentication Plugin 2.6 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins, allowin… |
CVE-2023-6380 | Medium | 6.1 | 2023-12-13 | Open redirect vulnerability has been found in the Open CMS product affecting versions 14 and 15 of the 'Mercury' template. An attacker could create a specially… |
CVE-2023-50456 | Medium | 5.3 | 2023-12-10 | An issue was discovered in Zammad before 6.2.0. An attacker can trigger phishing links in generated notification emails via a crafted first or last name. |
CVE-2023-28874 | Medium | 6.1 | 2023-12-09 | The next parameter in the /accounts/login endpoint of Seafile 9.0.6 allows attackers to redirect users to arbitrary sites. |
CVE-2023-48928 | Medium | 6.1 | 2023-12-08 | Franklin Fueling Systems System Sentinel AnyWare (SSA) version 1.6.24.492 is vulnerable to Open Redirect. The 'path' parameter of the prefs.asp resource allows… |
CVE-2023-47548 | Medium | 4.7 | 2023-12-07 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in SoftLab Integrate Google Drive – Browse, Upload, Download, Embed, Play, Share, Gallery, an… |
CVE-2023-45762 | Medium | 4.7 | 2023-12-07 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Michael Uno (miunosoft) Responsive Column Widgets.This issue affects Responsive Column Wid… |
CVE-2023-48325 | Medium | 4.7 | 2023-12-07 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in PluginOps Landing Page Builder – Lead Page – Optin Page – Squeeze Page – WordPress Landing… |
CVE-2023-47779 | Medium | 4.7 | 2023-12-07 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in CRM Perks. Integration for Constant Contact and Contact Form 7, WPForms, Elementor, Ninja… |
CVE-2023-49240 | High | 7.5 | 2023-12-06 | Unauthorized access vulnerability in the launcher module. Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2023-46688 | Medium | 6.1 | 2023-12-06 | Open redirect vulnerability in Pleasanter 1.3.47.0 and earlier allows a remote unauthenticated attacker to redirect users to arbitrary web sites via a speciall… |
CVE-2023-48815 | Medium | 6.1 | 2023-12-04 | kkFileView v4.3.0 is vulnerable to Incorrect Access Control. |
CVE-2023-49281 | Medium | 4.7 | 2023-12-01 | Calendarinho is an open source calendaring application to manage large teams of consultants. An Open Redirect issue occurs when a web application redirects use… |
CVE-2023-42502 | Medium | 4.8 | 2023-11-28 | An authenticated attacker with update datasets permission could change a dataset link to an untrusted site by spoofing the HTTP Host header, users could be red… |
CVE-2023-47168 | Medium | 4.3 | 2023-11-27 | Mattermost fails to properly check a redirect URL parameter allowing for an open redirect was possible when the user clicked "Back to Mattermost" after providi… |