Total
742 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2021-32721 | 1 Powermux Project | 1 Powermux | 2021-07-06 | 5.8 MEDIUM | 6.1 MEDIUM |
| PowerMux is a drop-in replacement for Go's http.ServeMux. In PowerMux versions prior to 1.1.1, attackers may be able to craft phishing links and other open redirects by exploiting the trailing slash redirection feature. This may lead to users being redirected to untrusted sites after following an attacker crafted link. The issue is resolved in v1.1.1. There are no existing workarounds. | |||||
| CVE-2020-23182 | 1 Php-fusion | 1 Php-fusion | 2021-07-06 | 4.9 MEDIUM | 5.4 MEDIUM |
| The component /php-fusion/infusions/shoutbox_panel/shoutbox_archive.php in PHP-Fusion 9.03.60 allows attackers to redirect victim users to malicious websites via a crafted payload entered into the Shoutbox message panel. | |||||
| CVE-2021-20105 | 1 Machform | 1 Machform | 2021-07-02 | 5.8 MEDIUM | 6.1 MEDIUM |
| Machform prior to version 16 is vulnerable to an open redirect in Safari_init.php due to an improperly sanitized 'ref' parameter. | |||||
| CVE-2021-34254 | 1 Umbraco | 1 Umbraco Cms | 2021-07-02 | 5.8 MEDIUM | 6.1 MEDIUM |
| Umbraco CMS before 7.15.7 is vulnerable to Open Redirection due to insufficient url sanitization on booting.aspx. | |||||
| CVE-2021-25655 | 1 Avaya | 1 Aura Experience Portal | 2021-06-30 | 5.8 MEDIUM | 6.1 MEDIUM |
| A vulnerability in the system Service Menu component of Avaya Aura Experience Portal may allow URL Redirection to any untrusted site through a crafted attack. Affected versions include 7.0 through 7.2.3 (without hotfix) and 8.0.0 (without hotfix). | |||||
| CVE-2021-27612 | 1 Sap | 1 Gui For Windows | 2021-06-29 | 5.8 MEDIUM | 6.1 MEDIUM |
| In specific situations SAP GUI for Windows until and including 7.60 PL9, 7.70 PL0, forwards a user to specific malicious website which could contain malware or might lead to phishing attacks to steal credentials of the victim. | |||||
| CVE-2020-18660 | 1 Get-simple | 1 Getsimplecms | 2021-06-28 | 5.8 MEDIUM | 6.1 MEDIUM |
| GetSimpleCMS <=3.3.15 has an open redirect in admin/changedata.php via the redirect function to the url parameter. | |||||
| CVE-2010-4266 | 1 Vanillaforums | 1 Vanilla Forums | 2021-06-25 | 5.8 MEDIUM | 6.1 MEDIUM |
| It was found in vanilla forums before 2.0.10 a potential linkbait vulnerability in dispatcher. | |||||
| CVE-2021-32956 | 1 Advantech | 1 Webaccess\/scada | 2021-06-24 | 5.8 MEDIUM | 6.1 MEDIUM |
| Advantech WebAccess/SCADA Versions 9.0.1 and prior is vulnerable to redirection, which may allow an attacker to send a maliciously crafted URL that could result in redirecting a user to a malicious webpage. | |||||
| CVE-2021-35206 | 1 Gitpod | 1 Gitpod | 2021-06-24 | 5.8 MEDIUM | 6.1 MEDIUM |
| Gitpod before 0.6.0 allows unvalidated redirects. | |||||
| CVE-2021-23393 | 1 Flask Unchained Project | 1 Flask Unchained | 2021-06-22 | 5.8 MEDIUM | 5.4 MEDIUM |
| This affects the package Flask-Unchained before 0.9.0. When using the the _validate_redirect_url function, it is possible to bypass URL validation and redirect a user to an arbitrary URL by providing multiple back slashes such as \\\evil.com/path. This vulnerability is only exploitable if an alternative WSGI server other than Werkzeug is used, or the default behaviour of Werkzeug is modified using 'autocorrect_location_header=False. | |||||
| CVE-2020-8430 | 1 Stormshield | 1 Stormshield Network Security | 2021-06-22 | 5.8 MEDIUM | 6.1 MEDIUM |
| Stormshield Network Security 310 3.7.10 devices have an auth/lang.html?rurl= Open Redirect vulnerability on the captive portal. For example, the attacker can use rurl=//example.com instead of rurl=https://example.com in the query string. | |||||
| CVE-2021-24358 | 1 Posimyth | 1 The Plus Addons For Elementor | 2021-06-17 | 5.8 MEDIUM | 6.1 MEDIUM |
| The Plus Addons for Elementor Page Builder WordPress plugin before 4.1.10 did not validate a redirect parameter on a specifically crafted URL before redirecting the user to it, leading to an Open Redirect issue. | |||||
| CVE-2020-26836 | 1 Sap | 1 Solution Manager | 2021-06-17 | 5.8 MEDIUM | 6.1 MEDIUM |
| SAP Solution Manager (Trace Analysis), version - 720, allows for misuse of a parameter in the application URL leading to Open Redirect vulnerability, an attacker can enter a link to malicious site which could trick the user to enter credentials or download malicious software, as a parameter in the application URL and share it with the end user who could potentially become a victim of the attack. | |||||
| CVE-2020-18268 | 1 Zblogcn | 1 Z-blogphp | 2021-06-15 | 5.8 MEDIUM | 6.1 MEDIUM |
| Open Redirect in Z-BlogPHP v1.5.2 and earlier allows remote attackers to obtain sensitive information via the "redirect" parameter in the component "zb_system/cmd.php." | |||||
| CVE-2021-1525 | 1 Cisco | 2 Webex Meetings Online, Webex Meetings Server | 2021-06-14 | 5.8 MEDIUM | 6.1 MEDIUM |
| A vulnerability in Cisco Webex Meetings and Cisco Webex Meetings Server could allow an unauthenticated, remote attacker to redirect users to a malicious file. This vulnerability is due to improper validation of URL paths in the application interface. An attacker could exploit this vulnerability by persuading a user to follow a specially crafted URL that is designed to cause Cisco Webex Meetings to include a remote file in the web UI. A successful exploit could allow the attacker to cause the application to offer a remote file to a user, which could allow the attacker to conduct further phishing or spoofing attacks. | |||||
| CVE-2019-10098 | 1 Apache | 1 Http Server | 2021-06-14 | 5.8 MEDIUM | 6.1 MEDIUM |
| In Apache HTTP server 2.4.0 to 2.4.39, Redirects configured with mod_rewrite that were intended to be self-referential might be fooled by encoded newlines and redirect instead to an unexpected URL within the request URL. | |||||
| CVE-2021-31252 | 1 Chiyu-tech | 28 Bf-430, Bf-430 Firmware, Bf-431 and 25 more | 2021-06-08 | 5.8 MEDIUM | 6.1 MEDIUM |
| An open redirect vulnerability exists in BF-630, BF-450M, BF-430, BF-431, BF631-W, BF830-W, Webpass, and SEMAC devices from CHIYU Technology that can be exploited by sending a link that has a specially crafted URL to convince the user to click on it. | |||||
| CVE-2021-32645 | 1 Tenancy | 1 Multi-tenant | 2021-06-08 | 5.8 MEDIUM | 6.1 MEDIUM |
| Tenancy multi-tenant is an open source multi-domain controller for the Laravel web framework. In some situations, it is possible to have open redirects where users can be redirected from your site to any other site using a specially crafted URL. This is only the case for installations where the default Hostname Identification is used and the environment uses tenants that have `force_https` set to `true` (default: `false`). Version 5.7.2 contains the relevant patches to fix this bug. Stripping the URL from special characters to prevent specially crafted URL's from being redirected to. As a work around users can set the `force_https` to every tenant to `false`, however this may degrade connection security. | |||||
| CVE-2021-1629 | 3 Linux, Microsoft, Tableau | 3 Linux Kernel, Windows, Tableau Server | 2021-06-03 | 5.8 MEDIUM | 6.1 MEDIUM |
| Tableau Server fails to validate certain URLs that are embedded in emails sent to Tableau Server users. | |||||