CWE-601 · URL Redirection to Untrusted Site (Open Redirect) (page 9)
Page 9 of 17 — CVEs classified under CWE-601, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-49104 | High | 8.7 | 2023-11-21 | An issue was discovered in ownCloud owncloud/oauth2 before 0.6.1, when Allow Subdomains is enabled. An attacker is able to pass in a crafted redirect-url that… |
CVE-2023-49061 | Medium | 6.1 | 2023-11-21 | An attacker could have performed HTML template injection via Reader Mode and exfiltrated user information. This vulnerability affects Firefox for iOS < 120. |
CVE-2023-5610 | Medium | 5.4 | 2023-11-20 | The Seraphinite Accelerator WordPress plugin before 2.2.29 does not validate the URL to redirect any authenticated user to, leading to an arbitrary redirect |
CVE-2023-5445 | Medium | 5.4 | 2023-11-17 | An open redirect vulnerability in ePolicy Orchestrator prior to 5.10.0 CP1 Update 2, allows a remote low privileged user to modify the URL parameter for the p… |
CVE-2023-41699 | Medium | 6.1 | 2023-11-15 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Payara Platform Payara Server, Micro and Embedded (Servlet Implementation modules) allows… |
CVE-2023-5986 | High | 8.2 | 2023-11-15 | A CWE-601 URL Redirection to Untrusted Site vulnerability exists that could cause an openredirect vulnerability leading to a cross site scripting attack. By p… |
CVE-2019-25155 | Medium | 6.1 | 2023-11-07 | DOMPurify before 1.0.11 allows reverse tabnabbing in demos/hooks-target-blank-demo.html because links lack a 'rel="noopener noreferrer"' attribute. |
CVE-2023-45203 | Medium | 6.1 | 2023-11-01 | Online Examination System v1.0 is vulnerable to multiple Open Redirect vulnerabilities. The 'q' parameter of the login.php resource allows an attacker to redir… |
CVE-2023-45202 | Medium | 6.1 | 2023-11-01 | Online Examination System v1.0 is vulnerable to multiple Open Redirect vulnerabilities. The 'q' parameter of the feed.php resource allows an attacker to redire… |
CVE-2023-45201 | Medium | 6.1 | 2023-11-01 | Online Examination System v1.0 is vulnerable to multiple Open Redirect vulnerabilities. The 'q' parameter of the admin.php resource allows an attacker to redir… |
CVE-2023-20264 | Medium | 6.1 | 2023-11-01 | A vulnerability in the implementation of Security Assertion Markup Language (SAML) 2.0 single sign-on (SSO) for remote access VPN in Cisco Adaptive Security Ap… |
CVE-2023-20886 | High | 8.8 | 2023-10-31 | VMware Workspace ONE UEM console contains an open redirect vulnerability. A malicious actor may be able to redirect a victim to an attacker and retrieve thei… |
CVE-2023-4964 | High | 8.2 | 2023-10-30 | Potential open redirect vulnerability in opentext Service Management Automation X (SMAX) versions 2020.05, 2020.08, 2020.11, 2021.02, 2021.05, 2021.08, 2021.1… |
CVE-2023-36085 | Medium | 6.1 | 2023-10-25 | The sisqualWFM 7.1.319.103 thru 7.1.319.111 for Android, has a host header injection vulnerability in its "/sisqualIdentityServer/core/" endpoint. By modifying… |
CVE-2021-46898 | Medium | 6.1 | 2023-10-22 | views/switch.py in django-grappelli (aka Django Grappelli) before 2.15.2 attempts to prevent external redirection with startswith("/") but this does not consid… |
CVE-2023-45909 | Medium | 6.1 | 2023-10-18 | zzzcms v2.2.0 was discovered to contain an open redirect vulnerability. |
CVE-2018-25091 | Medium | 6.1 | 2023-10-15 | urllib3 before 1.24.2 does not remove the authorization HTTP header when following a cross-origin redirect (i.e., a redirect that differs in host, port, or sch… |
CVE-2023-5375 | Medium | 6.1 | 2023-10-04 | Open Redirect in GitHub repository mosparo/mosparo prior to 1.0.2. |
CVE-2023-3922 | Low | 3.0 | 2023-09-29 | An issue has been discovered in GitLab affecting all versions starting from 8.15 before 16.2.8, all versions starting from 16.3 before 16.3.5, all versions sta… |
CVE-2023-23957 | Medium | 5.4 | 2023-09-19 | An authenticated user can see and modify the value for ‘next’ query parameter in Symantec Identity Portal 14.4 |
CVE-2023-4965 | Low | 2.7 | 2023-09-14 | A vulnerability was found in phpipam 1.5.1. It has been rated as problematic. Affected by this issue is some unknown functionality of the component Header Hand… |
CVE-2023-40779 | Medium | 6.1 | 2023-09-14 | An issue in IceWarp Mail Server Deep Castle 2 v.13.0.1.2 allows a remote attacker to execute arbitrary code via a crafted request to the URL. |
CVE-2023-41609 | Medium | 6.1 | 2023-09-11 | An open redirect vulnerability in the sanitize_url() parameter of CouchCMS v2.3 allows attackers to redirect a victim user to an arbitrary web site via a craft… |
CVE-2023-40306 | Medium | 6.1 | 2023-09-08 | SAP S/4HANA Manage Catalog Items and Cross-Catalog searches Fiori apps allow an attacker to redirect users to a malicious site due to insufficient URL validati… |
CVE-2023-20263 | Medium | 4.7 | 2023-09-06 | A vulnerability in the web-based management interface of Cisco HyperFlex HX Data Platform could allow an unauthenticated, remote attacker to redirect a user to… |
CVE-2023-39364 | Low | 3.5 | 2023-09-05 | Cacti is an open source operational monitoring and fault management framework. In Cacti 1.2.24, users with console access can be redirected to an arbitrary web… |
CVE-2023-38574 | Medium | 6.1 | 2023-09-05 | Open redirect vulnerability in VI Web Client prior to 7.9.6 allows a remote unauthenticated attacker to redirect users to arbitrary web sites and conduct phish… |
CVE-2023-39371 | High | 8.8 | 2023-09-03 | StarTrinity Softswitch version 2023-02-16 - Open Redirect (CWE-601) |
CVE-2023-1279 | Low | 2.6 | 2023-09-01 | An issue has been discovered in GitLab affecting all versions starting from 4.1 before 16.1.5, all versions starting from 16.2 before 16.2.5, all versions star… |
CVE-2023-39968 | Medium | 4.3 | 2023-08-28 | jupyter-server is the backend for Jupyter web applications. Open Redirect Vulnerability. Maliciously crafted login links to known Jupyter Servers can cause suc… |
CVE-2023-41080 | Medium | 6.1 | 2023-08-25 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in FORM authentication feature Apache Tomcat.This issue affects Apache Tomcat: from 11.0.0-M1… |
CVE-2022-45582 | Medium | 6.1 | 2023-08-22 | Open Redirect vulnerability in Horizon Web Dashboard 19.4.0 thru 20.1.4 via the success_url parameter. |
CVE-2022-44215 | Medium | 6.1 | 2023-08-22 | There is an open redirect vulnerability in Titan FTP server 19.0 and below. Users are redirected to any target URL. |
CVE-2022-27861 | Medium | 4.7 | 2023-08-10 | Unauth. Open Redirect vulnerability in Arscode Ninja Popups plugin <= 4.7.5 versions. |
CVE-2023-38998 | Medium | 6.1 | 2023-08-09 | An open redirect in the Login page of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows attackers to redirect a victim user to a… |
CVE-2023-34917 | Medium | 6.1 | 2023-07-31 | Fuge CMS v1.0 contains an Open Redirect vulnerability in member/RegisterAct.java. |
CVE-2023-34916 | Medium | 6.1 | 2023-07-31 | Fuge CMS v1.0 contains an Open Redirect vulnerability via /front/ProcessAct.java. |
CVE-2023-35791 | Medium | 6.1 | 2023-07-31 | Vound Intella Connect 2.6.0.3 has an Open Redirect vulnerability. |
CVE-2021-36580 | Medium | 6.1 | 2023-07-27 | Open Redirect vulnerability exists in IceWarp MailServer IceWarp Server Deep Castle 2 Update 1 (13.0.1.2) via the referer parameter. |
CVE-2023-37624 | Medium | 6.1 | 2023-07-26 | Netdisco before v2.063000 was discovered to contain an open redirect vulnerability. An attacker may exploit this vulnerability to redirect users to arbitrary w… |
CVE-2021-39425 | Medium | 6.1 | 2023-07-20 | SeedDMS v6.0.15 was discovered to contain an open redirect vulnerability. An attacker may exploit this vulnerability to redirect users to arbitrary web URLs by… |
CVE-2023-30433 | Medium | 6.5 | 2023-07-19 | IBM Security Verify Access 10.0 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a spe… |
CVE-2023-28020 | Medium | 4.7 | 2023-07-18 | URL redirection in Login page in HCL BigFix WebUI allows malicious user to redirect the client browser to an external site via redirect URL response header. |
CVE-2023-3684 | Low | 3.5 | 2023-07-16 | A vulnerability was found in LivelyWorks Articart 2.0.1 and classified as problematic. Affected by this issue is some unknown functionality of the file /change… |
CVE-2023-37561 | Medium | 6.1 | 2023-07-13 | Open redirect vulnerability in ELECOM wireless LAN routers and ELECOM wireless LAN repeaters allows a remote unauthenticated attacker to redirect users to arbi… |
CVE-2023-37947 | Medium | 6.1 | 2023-07-12 | Jenkins OpenShift Login Plugin 1.1.0.227.v27e08dfb_1a_20 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins… |
CVE-2023-3568 | Medium | 6.3 | 2023-07-10 | Open Redirect in GitHub repository alextselegidis/easyappointments prior to 1.5.0. |
CVE-2023-35934 | Medium | 6.1 | 2023-07-06 | yt-dlp is a command-line program to download videos from video sites. During file downloads, yt-dlp or the external downloaders that yt-dlp employs may leak co… |
CVE-2023-35948 | Medium | 5.4 | 2023-07-06 | Novu provides an API for sending notifications through multiple channels. Versions prior to 0.16.0 contain an open redirect vulnerability in the "Sign In with… |
CVE-2023-3515 | Medium | 4.4 | 2023-07-05 | Open Redirect in GitHub repository go-gitea/gitea prior to 1.19.4. |
CVE-2023-3139 | Medium | 6.1 | 2023-07-04 | The Protect WP Admin WordPress plugin before 4.0 discloses the URL of the admin panel via a redirection of a crafted URL, bypassing the protection offered. |
CVE-2023-28364 | Medium | 6.1 | 2023-07-01 | An Open Redirect vulnerability exists prior to version 1.52.117, where the built-in QR scanner in Brave Browser Android navigated to scanned URLs automatically… |
CVE-2022-46407 | Medium | 4.8 | 2023-06-29 | Ericsson Network Manager (ENM), versions prior to 22.2, contains a vulnerability in the REST endpoint “editprofile” where Open Redirect HTTP Header Injection c… |
CVE-2023-35171 | Medium | 4.1 | 2023-06-23 | NextCloud Server and NextCloud Enterprise Server provide file storage for Nextcloud, a self-hosted productivity platform. Starting in version 26.0.0 and prior… |
CVE-2023-28799 | High | 8.2 | 2023-06-22 | A URL parameter during login flow was vulnerable to injection. An attacker could insert a malicious domain in this parameter, which would redirect the user aft… |
CVE-2023-33405 | Medium | 6.1 | 2023-06-21 | Blogengine.net 3.3.8.0 and earlier is vulnerable to Open Redirect. |
CVE-2023-34415 | Medium | 6.1 | 2023-06-19 | When choosing a site-isolated process for a document loaded from a data: URL that was the result of a redirect, Firefox would load that document in the same pr… |
CVE-2023-24030 | Medium | 6.1 | 2023-06-15 | An open redirect vulnerability exists in the /preauth Servlet in Zimbra Collaboration Suite through 9.0 and 8.8.15. To exploit the vulnerability, an attacker w… |
CVE-2023-29307 | Medium | 5.4 | 2023-06-15 | Adobe Experience Manager versions 6.5.16.0 (and earlier) is affected by a URL Redirection to Untrusted Site ('Open Redirect') vulnerability. A low-privilege au… |
CVE-2023-35029 | Medium | 6.1 | 2023-06-15 | Open redirect vulnerability in the Layout module's SEO configuration in Liferay Portal 7.4.3.70 through 7.4.3.76, and Liferay DXP 7.4 update 70 through 76 allo… |
CVE-2023-34247 | Medium | 6.1 | 2023-06-13 | Keystone is a content management system for Node.JS. There is an open redirect in the `@keystone-6/auth` package versions 7.0.0 and prior, where the redirect l… |
CVE-2021-4348 | High | 7.5 | 2023-06-07 | The Ultimate GDPR & CCPA plugin for WordPress is vulnerable to unauthenticated settings import and export via the export_settings & import_settings functions i… |
CVE-2023-32551 | Medium | 6.1 | 2023-06-06 | Landscape allowed URLs which caused open redirection. |
CVE-2015-10115 | Medium | 4.3 | 2023-06-05 | A vulnerability, which was classified as problematic, was found in WooSidebars Sidebar Manager Converter Plugin up to 1.1.1 on WordPress. This affects the func… |
CVE-2015-10114 | Medium | 4.3 | 2023-06-05 | A vulnerability, which was classified as problematic, has been found in WooSidebars Plugin up to 1.4.1 on WordPress. Affected by this issue is the function ena… |
CVE-2015-10113 | Low | 3.5 | 2023-06-05 | A vulnerability classified as problematic was found in WooFramework Tweaks Plugin up to 1.0.1 on WordPress. Affected by this vulnerability is the function admi… |
CVE-2022-4946 | Medium | 5.4 | 2023-06-05 | The Frontend Post WordPress Plugin WordPress plugin through 2.8.4 does not validate an attribute of one of its shortcode, which could allow users with a role a… |
CVE-2015-10112 | Medium | 4.3 | 2023-06-05 | A vulnerability classified as problematic has been found in WooFramework Branding Plugin up to 1.0.1 on WordPress. Affected is the function admin_screen_logic… |
CVE-2023-29540 | Medium | 6.1 | 2023-06-02 | Using a redirect embedded into <code>sourceMappingUrls</code> could allow for navigation to external protocol links in sandboxed iframes without <code>allow-to… |
CVE-2023-25734 | High | 8.1 | 2023-06-02 | After downloading a Windows <code>.url</code> shortcut from the local filesystem, an attacker could supply a remote path that would lead to unexpected network… |
CVE-2023-34224 | Medium | 4.8 | 2023-05-31 | In JetBrains TeamCity before 2023.05 open redirect during oAuth configuration was possible |
CVE-2023-32218 | Medium | 6.1 | 2023-05-30 | Avaya IX Workforce Engagement v15.2.7.1195 - CWE-601: URL Redirection to Untrusted Site ('Open Redirect') |
CVE-2023-23754 | Medium | 6.1 | 2023-05-30 | An issue was discovered in Joomla! 4.2.0 through 4.3.1. Lack of input validation caused an open redirect and XSS issue within the new mfa selection screen. |
CVE-2023-20884 | Medium | 6.1 | 2023-05-30 | VMware Workspace ONE Access and VMware Identity Manager contain an insecure redirect vulnerability. An unauthenticated malicious actor may be able to redirect… |
CVE-2023-28370 | Medium | 6.1 | 2023-05-25 | Open redirect vulnerability in Tornado versions 6.3.1 and earlier allows a remote unauthenticated attacker to redirect a user to an arbitrary web site and cond… |
CVE-2023-31245 | High | 7.1 | 2023-05-22 | Devices using Snap One OvrC cloud are sent to a web address when accessing a web management interface using a HTTP connection. Attacke… |
CVE-2023-32068 | Medium | 4.7 | 2023-05-15 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions prior to 14.10.4 it's possible to exploit… |
CVE-2023-25829 | Medium | 6.1 | 2023-05-09 | There is an unvalidated redirect vulnerability in Esri Portal for ArcGIS 11.0 and below that may allow a remote, unauthenticated attacker to craft a URL that c… |
CVE-2023-31134 | Medium | 4.8 | 2023-05-09 | Tauri is software for building applications for multi-platform deployment. The Tauri IPC is usually strictly isolated from external websites, but in versions 1… |
CVE-2020-21038 | Medium | 6.1 | 2023-05-08 | Open redirect vulnerability in typecho 1.1-17.10.30-release via the referer parameter to Login.php. |
CVE-2022-43950 | Medium | 4.3 | 2023-05-03 | A URL redirection to untrusted site ('Open Redirect') vulnerability [CWE-601] in FortiNAC-F version 7.2.0, FortiNAC version 9.4.1 and below, 9.2 all versions… |
CVE-2023-0155 | Medium | 5.4 | 2023-05-03 | An issue has been discovered in GitLab CE/EE affecting all versions before 15.8.5, 15.9.4, 15.10.1. Open redirects was possible due to framing arbitrary conten… |
CVE-2023-2000 | Medium | 5.4 | 2023-05-02 | Mattermost Desktop App fails to validate a mattermost server redirection and navigates to an arbitrary website |
CVE-2015-10104 | Low | 3.5 | 2023-04-30 | A vulnerability, which was classified as problematic, has been found in Icons for Features Plugin 1.0.0 on WordPress. Affected by this issue is some unknown fu… |
CVE-2023-22729 | Medium | 5.4 | 2023-04-26 | Silverstripe Framework is the Model-View-Controller framework that powers the Silverstripe content management system. Prior to version 4.12.15, an attacker can… |
CVE-2023-26494 | Medium | 6.1 | 2023-04-24 | lorawan-stack is an open source LoRaWAN network server. Prior to version 3.24.1, an open redirect exists on the login page of the lorawan stack server, allowin… |
CVE-2015-10102 | Medium | 6.3 | 2023-04-17 | A vulnerability, which was classified as critical, has been found in Freshdesk Plugin 1.7 on WordPress. Affected by this issue is some unknown functionality. T… |
CVE-2023-29204 | Medium | 4.7 | 2023-04-15 | XWiki Commons are technical libraries common to several other top level XWiki projects. It is possible to bypass the existing security measures put in place to… |
CVE-2022-46886 | Medium | 5.5 | 2023-04-14 | There exists an open redirect within the response list update functionality of ServiceNow. This allows attackers to redirect users to arbitrary domains when cl… |
CVE-2023-24935 | Medium | 6.1 | 2023-04-11 | Microsoft Edge (Chromium-based) Spoofing Vulnerability |
CVE-2023-22641 | Medium | 4.1 | 2023-04-11 | A url redirection to untrusted site ('open redirect') in Fortinet FortiOS version 7.2.0 through 7.2.3, FortiOS version 7.0.0 through 7.0.9, FortiOS versions 6… |
CVE-2023-28069 | Medium | 6.1 | 2023-04-05 | Dell Streaming Data Platform prior to 1.4 contains Open Redirect vulnerability. A remote unauthenticated attacker can phish the legitimate user to redirect to… |
CVE-2022-1230 | Low | 3.9 | 2023-03-28 | This vulnerability allows local attackers to execute arbitrary code on affected installations of Samsung Galaxy S21 prior to 4.5.40.5 phones. An attacker must… |
CVE-2022-48358 | High | 7.4 | 2023-03-27 | The BatteryHealthActivity has a redirection vulnerability. Successful exploitation of this vulnerability by a malicious app can cause service exceptions. |
CVE-2022-2237 | Medium | 6.1 | 2023-03-27 | A flaw was found in the Keycloak Node.js Adapter. This flaw allows an attacker to benefit from an Open Redirect vulnerability in the checkSso function. |
CVE-2023-28628 | Medium | 5.4 | 2023-03-27 | lambdaisland/uri is a pure Clojure/ClojureScript URI library. In versions prior to 1.14.120 `authority-regex` allows an attacker to send malicious URLs to be p… |
CVE-2016-15030 | Low | 3.5 | 2023-03-25 | A vulnerability classified as problematic has been found in Arno0x TwoFactorAuth. This affects an unknown part of the file login/login.php. The manipulation of… |
CVE-2023-22266 | Medium | 5.4 | 2023-03-22 | Experience Manager versions 6.5.15.0 (and earlier) are affected by a URL Redirection to Untrusted Site ('Open Redirect') vulnerability. A low-privilege authent… |
CVE-2023-22265 | Medium | 5.4 | 2023-03-22 | Experience Manager versions 6.5.15.0 (and earlier) are affected by a URL Redirection to Untrusted Site ('Open Redirect') vulnerability. A low-privilege authent… |
CVE-2023-22264 | Medium | 5.4 | 2023-03-22 | Experience Manager versions 6.5.15.0 (and earlier) are affected by a URL Redirection to Untrusted Site ('Open Redirect') vulnerability. A low-privilege authent… |