CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities Related To CWE-601

Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2018-6520 601 Bypass 2018-02-01 2018-02-15
5.8
None Remote Medium Not required Partial Partial None
SimpleSAMLphp before 1.15.2 allows remote attackers to bypass an open redirect protection mechanism via crafted authority data in a URL.
2 CVE-2018-6200 601 2018-01-24 2018-02-08
5.8
None Remote Medium Not required Partial Partial None
vBulletin 3.x.x and 4.2.x through 4.2.5 has an open redirect via the redirector.php url parameter.
3 CVE-2018-0097 601 2018-01-18 2018-02-09
5.8
None Remote Medium Not required Partial Partial None
A vulnerability in the web interface of Cisco Prime Infrastructure could allow an unauthenticated, remote attacker to redirect a user to a malicious web page, aka an Open Redirect. The vulnerability is due to improper input validation of the parameters in the HTTP request. An attacker could exploit this vulnerability by crafting an HTTP request that could cause the web application to redirect the request to a specific malicious URL. This vulnerability is known as an open redirect attack and is used in phishing attacks to get users to visit malicious sites without their knowledge. Cisco Bug IDs: CSCve37646.
4 CVE-2017-1002150 601 CSRF 2017-09-14 2017-09-21
5.8
None Remote Medium Not required Partial Partial None
python-fedora 0.8.0 and lower is vulnerable to an open redirect resulting in loss of CSRF protection
5 CVE-2017-1000484 601 2018-01-03 2018-01-18
5.8
None Remote Medium Not required Partial Partial None
By linking to a specific url in Plone 2.5-5.1rc1 with a parameter, an attacker could send you to his own website. On its own this is not so bad: the attacker could more easily link directly to his own website instead. But in combination with another attack, you could be sent to the Plone login form and login, then get redirected to the specific url, and then get a second redirect to the attacker website. (The specific url can be seen by inspecting the hotfix code, but we don't want to make it too easy for attackers by spelling it out here.)
6 CVE-2017-1000481 601 2018-01-03 2018-01-18
5.8
None Remote Medium Not required Partial Partial None
When you visit a page where you need to login, Plone 2.5-5.1rc1 sends you to the login form with a 'came_from' parameter set to the previous url. After you login, you get redirected to the page you tried to view before. An attacker might try to abuse this by letting you click on a specially crafted link. You would login, and get redirected to the site of the attacker, letting you think that you are still on the original Plone site. Or some javascript of the attacker could be executed. Most of these types of attacks are already blocked by Plone, using the `isURLInPortal` check to make sure we only redirect to a page on the same Plone site. But a few more ways of tricking Plone into accepting a malicious link were discovered, and fixed with this hotfix.
7 CVE-2017-1000434 601 2018-01-02 2018-01-17
5.8
None Remote Medium Not required Partial Partial None
Wordpress plugin Furikake version 0.1.0 is vulnerable to an Open Redirect The furikake-redirect parameter on a page allows for a redirect to an attacker controlled page classes/Furigana.php: header('location:'.urldecode($_GET['furikake-redirect']));
8 CVE-2017-1000163 601 2017-11-17 2017-12-03
5.8
None Remote Medium Not required Partial Partial None
The Phoenix Framework versions 1.0.0 through 1.0.4, 1.1.0 through 1.1.6, 1.2.0, 1.2.2 and 1.3.0-rc.0 are vulnerable to unvalidated URL redirection, which may result in phishing or social engineering attacks.
9 CVE-2017-1000070 601 2017-07-17 2017-07-20
5.8
None Remote Medium Not required Partial Partial None
The Bitly oauth2_proxy in version 2.1 and earlier was affected by an open redirect vulnerability during the start and termination of the 2-legged OAuth flow. This issue was caused by improper input validation and a violation of RFC-6819
10 CVE-2017-1000027 601 2017-07-17 2017-07-21
5.8
None Remote Medium Not required Partial Partial None
Koozali Foundation SME Server versions 8.x, 9.x, 10.x are vulnerable to an open URL redirect vulnerability in the user web login function resulting in unauthorized account access.
11 CVE-2017-1000013 601 2017-07-17 2017-07-19
5.8
None Remote Medium Not required Partial Partial None
phpMyAdmin 4.0, 4.4, and 4.6 are vulnerable to an open redirect weakness
12 CVE-2017-16761 601 2017-11-10 2017-11-27
5.8
None Remote Medium Not required Partial Partial None
An Open Redirect vulnerability in Inedo BuildMaster before 5.8.2 allows remote attackers to redirect users to arbitrary web sites.
13 CVE-2017-16679 601 2017-12-12 2018-01-04
5.8
None Remote Medium Not required Partial Partial None
URL redirection vulnerability in SAP's Startup Service, SAP KERNEL 32 NUC, SAP KERNEL 32 Unicode, SAP KERNEL 64 NUC, SAP KERNEL 64 Unicode 7.21, 7.21EXT, 7.22 and 7.22EXT; SAP KERNEL 7.21, 7.22, 7.45, 7.49 and 7.52, that allows an attacker to redirect users to a malicious site.
14 CVE-2017-16569 601 2017-11-06 2017-11-22
4.9
None Remote Medium Single system Partial Partial None
An Open URL Redirect issue exists in Zurmo 3.2.1.57987acc3018 via an http: URL in the redirectUrl parameter to app/index.php/meetings/default/createMeeting.
15 CVE-2017-14725 601 2017-09-23 2017-11-09
4.9
None Remote Medium Single system Partial Partial None
Before version 4.8.2, WordPress was susceptible to an open redirect attack in wp-admin/edit-tag-form.php and wp-admin/user-edit.php.
16 CVE-2017-14525 601 2017-09-27 2017-10-06
5.8
None Remote Medium Not required Partial Partial None
Multiple open redirect vulnerabilities in OpenText Documentum Webtop 6.8.0160.0073 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a (1) URL in the startat parameter to xda/help/en/default.htm or (2) /%09/ (slash encoded horizontal tab slash) followed by a domain in the redirectUrl parameter to xda/component/virtuallinkconnect.
17 CVE-2017-14524 601 2017-09-27 2017-10-06
5.8
None Remote Medium Not required Partial Partial None
Multiple open redirect vulnerabilities in OpenText Documentum Administrator 7.2.0180.0055 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a (1) URL in the startat parameter to xda/help/en/default.htm or (2) /%09/ (slash encoded horizontal tab slash) followed by a domain in the redirectUrl parameter to xda/component/virtuallinkconnect.
18 CVE-2017-14358 601 2017-10-31 2017-11-21
5.8
None Remote Medium Not required Partial Partial None
A URL redirection to untrusted site vulnerability in HP ArcSight ESM and HP ArcSight ESM Express, in any 6.x version prior to 6.9.1c Patch 4 or 6.11.0 Patch 1. This vulnerability could be exploited remotely to allow URL redirection to untrusted site.
19 CVE-2017-14038 601 2017-08-30 2017-09-01
5.8
None Remote Medium Not required Partial Partial None
CrushFTP before 7.8.0 and 8.x before 8.2.0 has a redirect vulnerability.
20 CVE-2017-12344 601 XSS 2017-11-30 2017-12-05
5.8
None Remote Medium Not required Partial Partial None
Multiple vulnerabilities in Cisco Data Center Network Manager (DCNM) Software could allow a remote attacker to inject arbitrary values into DCNM configuration parameters, redirect a user to a malicious website, inject malicious content into a DCNM client interface, or conduct a cross-site scripting (XSS) attack against a user of the affected software. Cisco Bug IDs: CSCvf40477, CSCvf63150, CSCvf68218, CSCvf68235, CSCvf68247.
21 CVE-2017-12138 601 Bypass 2017-08-02 2017-08-04
5.8
None Remote Medium Not required Partial Partial None
XOOPS Core 2.5.8 has a stored URL redirect bypass vulnerability in /modules/profile/index.php because of the URL filter.
22 CVE-2017-11879 601 2017-11-14 2018-02-01
4.3
None Remote Medium Not required Partial None None
ASP.NET Core 2.0 allows an attacker to steal log-in session information such as cookies or authentication tokens via a specially crafted URL aka "ASP.NET Core Elevation Of Privilege Vulnerability".
23 CVE-2017-11725 601 2017-07-29 2017-08-09
5.8
None Remote Medium Not required Partial Partial None
The share function in Thycotic Secret Server before 10.2.000019 mishandles the Back Button, leading to unintended redirections.
24 CVE-2017-11718 601 2017-07-28 2017-08-09
5.8
None Remote Medium Not required Partial Partial None
There is URL Redirector Abuse in MetInfo through 5.3.17 via the gourl parameter to member/login.php.
25 CVE-2017-11586 601 2017-07-23 2017-07-28
5.8
None Remote Medium Not required Partial Partial None
dayrui FineCms 5.0.9 has URL Redirector Abuse via the url parameter in a sync action, related to controllers/Weixin.php.
26 CVE-2017-11482 601 2017-12-08 2017-12-22
5.8
None Remote Medium Not required Partial Partial None
The Kibana fix for CVE-2017-8451 was found to be incomplete. With X-Pack installed, Kibana versions before 6.0.1 and 5.6.5 have an open redirect vulnerability on the login page that would enable an attacker to craft a link that redirects to an arbitrary website.
27 CVE-2017-9464 601 2017-06-14 2017-06-19
5.8
None Remote Medium Not required Partial Partial None
An open redirect vulnerability is present in Piwigo 2.9 and probably prior versions, allowing remote attackers to redirect users to arbitrary web sites and conduct phishing attacks. The identification.php component is affected by this issue: the "redirect" parameter is not validated.
28 CVE-2017-9297 601 2017-05-29 2017-06-08
5.8
None Remote Medium Not required Partial Partial None
Open Redirect vulnerability in Hitachi Device Manager before 8.5.2-01 allows remote attackers to redirect users to arbitrary web sites.
29 CVE-2017-9296 601 2017-05-29 2017-06-08
5.8
None Remote Medium Not required Partial Partial None
Open Redirect vulnerability in Hitachi Device Manager before 8.5.2-01 and Hitachi Tuning Manager before 8.5.2-00 allows remote attackers to redirect authenticated users to arbitrary web sites.
30 CVE-2017-8621 601 2017-07-11 2017-07-17
5.8
None Remote Medium Not required Partial Partial None
Microsoft Exchange Server 2010 SP3, Exchange Server 2013 SP3, Exchange Server 2013 CU16, and Exchange Server 2016 CU5 allows an open redirect vulnerability that could lead to spoofing, aka "Microsoft Exchange Open Redirect Vulnerability".
31 CVE-2017-8451 601 2017-06-16 2017-07-05
5.8
None Remote Medium Not required Partial Partial None
With X-Pack installed, Kibana versions before 5.3.1 have an open redirect vulnerability on the login page that would enable an attacker to craft a link that redirects to an arbitrary website.
32 CVE-2017-8047 601 2017-10-03 2017-10-23
5.8
None Remote Medium Not required Partial Partial None
In Cloud Foundry router routing-release all versions prior to v0.163.0 and cf-release all versions prior to v274, in some applications, it is possible to append a combination of characters to the URL that will allow for an open redirect. An attacker could exploit this as a phishing attack to gain access to user credentials or other sensitive data. NOTE: 274 resolves the vulnerability but has a serious bug that is fixed in 275.
33 CVE-2017-7343 601 Exec Code 2017-05-26 2017-05-31
5.8
None Remote Medium Not required Partial Partial None
An open redirect vulnerability in Fortinet FortiPortal 4.0.0 and below allows attacker to execute unauthorized code or commands via the url parameter.
34 CVE-2017-7266 601 2017-03-26 2017-03-28
5.8
None Remote Medium Not required Partial Partial None
Netflix Security Monkey before 0.8.0 has an Open Redirect. The logout functionality accepted the "next" parameter which then redirects to any domain irrespective of the Host header.
35 CVE-2017-7234 601 2017-04-04 2017-11-03
5.8
None Remote Medium Not required Partial Partial None
A maliciously crafted URL to a Django (1.10 before 1.10.7, 1.9 before 1.9.13, and 1.8 before 1.8.18) site using the ``django.views.static.serve()`` view could redirect to any other domain, aka an open redirect vulnerability.
36 CVE-2017-7233 601 XSS 2017-04-04 2018-01-04
5.8
None Remote Medium Not required Partial Partial None
Django 1.10 before 1.10.7, 1.9 before 1.9.13, and 1.8 before 1.8.18 relies on user input in some cases to redirect the user to an "on success" URL. The security check for these redirects (namely ``django.utils.http.is_safe_url()``) considered some numeric URLs "safe" when they shouldn't be, aka an open redirect vulnerability. Also, if a developer relies on ``is_safe_url()`` to provide safe redirect targets and puts such a URL into a link, they could suffer from an XSS attack.
37 CVE-2017-6670 601 2017-06-13 2017-07-07
5.8
None Remote Medium Not required Partial Partial None
A vulnerability in the web-based GUI of Cisco Unified Communications Domain Manager could allow an unauthenticated, remote attacker to redirect a user to a malicious web page, aka an Open Redirect issue. More Information: CSCvc54813. Known Affected Releases: 8.1(7)ER1.
38 CVE-2017-6604 601 2017-04-07 2017-07-11
5.8
None Remote Medium Not required Partial Partial None
A vulnerability in the web interface of Cisco Integrated Management Controller (IMC) Software could allow an unauthenticated, remote attacker to redirect a user to a malicious web page. This vulnerability affects the following Cisco products running Cisco IMC Software: Unified Computing System (UCS) B-Series M3 and M4 Blade Servers, Unified Computing System (UCS) C-Series M3 and M4 Rack Servers. More Information: CSCvc37931. Known Affected Releases: 3.1(2c)B.
39 CVE-2017-6018 601 2017-06-29 2017-07-27
5.8
None Remote Medium Not required Partial Partial None
An open redirect issue was discovered in B. Braun Medical SpaceCom module, which is integrated into the SpaceStation docking station: SpaceStation with SpaceCom module (integrated as part number 8713142U), software versions prior to Version 012U000040, and SpaceStation (part number 8713140U) with installed SpaceCom module (part number 8713160U), software versions prior to Version 012U000040. The web server of the affected product accepts untrusted input which could allow attackers to redirect the request to an unintended URL contained within untrusted input.
40 CVE-2017-5615 601 2017-03-03 2017-03-07
5.8
None Remote Medium Not required Partial Partial None
cgiemail and cgiecho allow remote attackers to inject HTTP headers via a newline character in the redirect location.
41 CVE-2017-5614 601 2017-03-03 2017-03-07
5.8
None Remote Medium Not required Partial Partial None
Open redirect vulnerability in cgiemail and cgiecho allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via vectors involving the (1) success or (2) failure parameter.
42 CVE-2017-5571 601 2017-03-03 2017-03-07
5.8
None Remote Medium Not required Partial Partial None
Open redirect vulnerability in the lmadmin component in Flexera FlexNet Publisher (aka Flex License Manager) 11.14.1 and earlier, as used in Citrix License Server for Windows and the Citrix License Server VPX, allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.
43 CVE-2017-5474 601 2017-01-14 2017-01-25
5.8
None Remote Medium Not required Partial Partial None
Open redirect vulnerability in comment.php in Serendipity through 2.0.5 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the HTTP Referer header.
44 CVE-2017-5002 601 2017-07-06 2017-07-17
5.8
None Remote Medium Not required Partial Partial None
EMC RSA Archer 5.4.1.3, 5.5.3.1, 5.5.2.3, 5.5.2, 5.5.1.3.1, 5.5.1.1 is affected by an open redirect vulnerability. A remote unprivileged attacker may potentially redirect legitimate users to arbitrary web sites and conduct phishing attacks. The attacker could then steal the victims' credentials and silently authenticate them to the RSA Archer application without the victims realizing an attack occurred.
45 CVE-2017-3889 601 2017-04-07 2017-04-14
5.8
None Remote Medium Not required Partial Partial None
A vulnerability in the web interface of the Cisco Registered Envelope Service could allow an unauthenticated, remote attacker to redirect a user to a undesired web page, aka an Open Redirect. This vulnerability affects the Cisco Registered Envelope cloud-based service. More Information: CSCvc60123. Known Affected Releases: 5.1.0-015.
46 CVE-2017-3840 601 2017-02-21 2017-07-24
5.8
None Remote Medium Not required Partial Partial None
A vulnerability in the web interface of the Cisco Secure Access Control System (ACS) could allow an unauthenticated, remote attacker to redirect a user to a malicious web page, aka an Open Redirect Vulnerability. More Information: CSCvc04849. Known Affected Releases: 5.8(2.5).
47 CVE-2017-3810 601 2017-02-03 2017-07-24
4.9
None Remote Medium Single system Partial Partial None
A vulnerability in the web framework of Cisco Prime Service Catalog could allow an authenticated, remote attacker to conduct a web URL redirect attack against a user who is logged in to an affected system. More Information: CSCvb21745. Known Affected Releases: 10.0_R2_tanggula.
48 CVE-2017-3799 601 2017-01-26 2017-07-25
5.8
None Remote Medium Not required Partial Partial None
A vulnerability in a URL parameter of Cisco WebEx Meeting Center could allow an unauthenticated, remote attacker to perform site redirection. More Information: CSCzu78401. Known Affected Releases: T28.1.
49 CVE-2017-3126 601 Exec Code 2017-05-26 2017-07-07
5.8
None Remote Medium Not required Partial Partial None
An Open Redirect vulnerability in Fortinet FortiAnalyzer 5.4.0 through 5.4.2 and FortiManager 5.4.0 through 5.4.2 allows attacker to execute unauthorized code or commands via the next parameter.
50 CVE-2017-3105 601 2017-12-01 2017-12-14
5.8
None Remote Medium Not required Partial Partial None
Adobe RoboHelp has an Open Redirect vulnerability. This affects versions before RH12.0.4.460 and RH2017 before RH2017.0.2.
Total number of vulnerabilities : 113   Page : 1 (This Page)2 3
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.