Total
999 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2021-32956 | 1 Advantech | 1 Webaccess\/scada | 2024-02-28 | 5.8 MEDIUM | 6.1 MEDIUM |
| Advantech WebAccess/SCADA Versions 9.0.1 and prior is vulnerable to redirection, which may allow an attacker to send a maliciously crafted URL that could result in redirecting a user to a malicious webpage. | |||||
| CVE-2020-5329 | 1 Dell | 1 Emc Avamar Server | 2024-02-28 | 5.8 MEDIUM | 6.1 MEDIUM |
| Dell EMC Avamar Server contains an open redirect vulnerability. A remote unauthenticated attacker may exploit this vulnerability to redirect application users to arbitrary web URLs by tricking the victim users to click on maliciously crafted links. | |||||
| CVE-2021-23401 | 1 Flask-user Project | 1 Flask-user | 2024-02-28 | 5.8 MEDIUM | 6.1 MEDIUM |
| This affects all versions of package Flask-User. When using the make_safe_url function, it is possible to bypass URL validation and redirect a user to an arbitrary URL by providing multiple back slashes such as /////evil.com/path or \\\evil.com/path. This vulnerability is only exploitable if an alternative WSGI server other than Werkzeug is used, or the default behaviour of Werkzeug is modified using 'autocorrect_location_header=False. | |||||
| CVE-2021-3647 | 1 Uri.js Project | 1 Uri.js | 2024-02-28 | 5.8 MEDIUM | 6.1 MEDIUM |
| URI.js is vulnerable to URL Redirection to Untrusted Site | |||||
| CVE-2021-24406 | 1 Gvectors | 1 Wpforo Forum | 2024-02-28 | 5.8 MEDIUM | 6.1 MEDIUM |
| The wpForo Forum WordPress plugin before 1.9.7 did not validate the redirect_to parameter in the login form of the forum, leading to an open redirect issue after a successful login. Such issue could allow an attacker to induce a user to use a login URL redirecting to a website under their control and being a replica of the legitimate one, asking them to re-enter their credentials (which will then in the attacker hands) | |||||
| CVE-2021-32645 | 1 Tenancy | 1 Multi-tenant | 2024-02-28 | 5.8 MEDIUM | 6.1 MEDIUM |
| Tenancy multi-tenant is an open source multi-domain controller for the Laravel web framework. In some situations, it is possible to have open redirects where users can be redirected from your site to any other site using a specially crafted URL. This is only the case for installations where the default Hostname Identification is used and the environment uses tenants that have `force_https` set to `true` (default: `false`). Version 5.7.2 contains the relevant patches to fix this bug. Stripping the URL from special characters to prevent specially crafted URL's from being redirected to. As a work around users can set the `force_https` to every tenant to `false`, however this may degrade connection security. | |||||
| CVE-2021-37699 | 1 Vercel | 1 Next.js | 2024-02-28 | 5.8 MEDIUM | 6.1 MEDIUM |
| Next.js is an open source website development framework to be used with the React library. In affected versions specially encoded paths could be used when pages/_error.js was statically generated allowing an open redirect to occur to an external site. In general, this redirect does not directly harm users although can allow for phishing attacks by redirecting to an attacker's domain from a trusted domain. We recommend everyone to upgrade regardless of whether you can reproduce the issue or not. The issue has been patched in release 11.1.0. | |||||
| CVE-2020-36365 | 1 Smartstore | 1 Smartstorenet | 2024-02-28 | 5.8 MEDIUM | 6.1 MEDIUM |
| Smartstore (aka SmartStoreNET) before 4.1.0 allows CommonController.ClearCache, ClearDatabaseCache, RestartApplication, and ScheduleTaskController.Edit open redirect. | |||||
| CVE-2021-25655 | 1 Avaya | 1 Aura Experience Portal | 2024-02-28 | 5.8 MEDIUM | 6.1 MEDIUM |
| A vulnerability in the system Service Menu component of Avaya Aura Experience Portal may allow URL Redirection to any untrusted site through a crafted attack. Affected versions include 7.0 through 7.2.3 (without hotfix) and 8.0.0 (without hotfix). | |||||
| CVE-2021-3664 | 1 Url-parse Project | 1 Url-parse | 2024-02-28 | 5.0 MEDIUM | 5.3 MEDIUM |
| url-parse is vulnerable to URL Redirection to Untrusted Site | |||||
| CVE-2021-1358 | 1 Cisco | 1 Finesse | 2024-02-28 | 5.8 MEDIUM | 6.1 MEDIUM |
| A vulnerability in the web-based management interface of Cisco Finesse could allow an unauthenticated, remote attacker to redirect a user to an undesired web page. This vulnerability is due to improper input validation of the URL parameters in an HTTP request that is sent to an affected system. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to cause the interface to redirect the user to a specific, malicious URL. This type of vulnerability is known as an open redirect and is used in phishing attacks that get users to unknowingly visit malicious sites. | |||||
| CVE-2021-24358 | 1 Posimyth | 1 The Plus Addons For Elementor | 2024-02-28 | 5.8 MEDIUM | 6.1 MEDIUM |
| The Plus Addons for Elementor Page Builder WordPress plugin before 4.1.10 did not validate a redirect parameter on a specifically crafted URL before redirecting the user to it, leading to an Open Redirect issue. | |||||
| CVE-2021-1397 | 1 Cisco | 48 C125 M5, C125 M5 Firmware, C220 M5 and 45 more | 2024-02-28 | 5.8 MEDIUM | 6.1 MEDIUM |
| A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) Software could allow an unauthenticated, remote attacker to redirect a user to a malicious web page. This vulnerability is due to improper input validation of the parameters in an HTTP request. An attacker could exploit this vulnerability by persuading a user to click a crafted link. A successful exploit could allow the attacker to redirect a user to a malicious website. This vulnerability is known as an open redirect attack, which is used in phishing attacks to get users to visit malicious sites without their knowledge. | |||||
| CVE-2021-33707 | 1 Sap | 1 Netweaver Knowledge Management | 2024-02-28 | 5.8 MEDIUM | 6.1 MEDIUM |
| SAP NetWeaver Knowledge Management allows remote attackers to redirect users to arbitrary websites and conduct phishing attacks via a URL stored in a component. This could enable the attacker to compromise the user's confidentiality and integrity. | |||||
| CVE-2021-23393 | 1 Flask Unchained Project | 1 Flask Unchained | 2024-02-28 | 5.8 MEDIUM | 5.4 MEDIUM |
| This affects the package Flask-Unchained before 0.9.0. When using the the _validate_redirect_url function, it is possible to bypass URL validation and redirect a user to an arbitrary URL by providing multiple back slashes such as \\\evil.com/path. This vulnerability is only exploitable if an alternative WSGI server other than Werkzeug is used, or the default behaviour of Werkzeug is modified using 'autocorrect_location_header=False. | |||||
| CVE-2020-28150 | 1 Inetsoftware | 1 I-net Clear Reports | 2024-02-28 | 5.8 MEDIUM | 6.1 MEDIUM |
| I-Net Software Clear Reports 20.10.136 web application accepts a user-controlled input that specifies a link to an external site, and uses the user supplied data in a Redirect. | |||||
| CVE-2021-21478 | 1 Sap | 1 Web Dynpro Abap | 2024-02-28 | 5.8 MEDIUM | 6.1 MEDIUM |
| SAP Web Dynpro ABAP allow an attacker to redirect users to a malicious site due to Reverse Tabnabbing vulnerabilities. | |||||
| CVE-2021-21338 | 1 Typo3 | 1 Typo3 | 2024-02-28 | 5.8 MEDIUM | 6.1 MEDIUM |
| TYPO3 is an open source PHP based web content management system. In TYPO3 before versions 6.2.57, 7.6.51, 8.7.40, 9.5.25, 10.4.14, 11.1.1 it has been discovered that Login Handling is susceptible to open redirection which allows attackers redirecting to arbitrary content, and conducting phishing attacks. No authentication is required in order to exploit this vulnerability. This is fixed in versions 6.2.57, 7.6.51, 8.7.40, 9.5.25, 10.4.14, 11.1.1. | |||||
| CVE-2020-26219 | 1 Touchbase.ai Project | 1 Touchbase.ai | 2024-02-28 | 5.8 MEDIUM | 6.1 MEDIUM |
| touchbase.ai before version 2.0 is vulnerable to Open Redirect. Impacts can be many, and vary from theft of information and credentials, to the redirection to malicious websites containing attacker-controlled content, which in some cases even cause XSS attacks. So even though an open redirection might sound harmless at first, the impacts of it can be severe should it be exploitable. The issue is fixed in version 2.0. | |||||
| CVE-2020-26836 | 1 Sap | 1 Solution Manager | 2024-02-28 | 5.8 MEDIUM | 6.1 MEDIUM |
| SAP Solution Manager (Trace Analysis), version - 720, allows for misuse of a parameter in the application URL leading to Open Redirect vulnerability, an attacker can enter a link to malicious site which could trick the user to enter credentials or download malicious software, as a parameter in the application URL and share it with the end user who could potentially become a victim of the attack. | |||||