URL Redirection to Untrusted Site ('Open Redirect')

A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.

CVEs (1,576)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2017-1449 1Ibm 1Emptoris Sourcing May 13, 2026 Aug 31, 2017 N/A· v4 5.4 MEDIUM· v3 4.9 MEDIUM· v2 IBM Emptoris Sourcing 9.5 - 10.1.3 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit t...Show more IBM Emptoris Sourcing 9.5 - 10.1.3 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web site that would appear to be trusted. This could allow the attacker to obtain highly sensitive information or conduct further attacks against the victim. IBM X-Force ID: 128174.Show less
CVE-2017-14038 1Crushftp 1Crushftp May 13, 2026 Aug 30, 2017 N/A· v4 6.1 MEDIUM· v3 5.8 MEDIUM· v2 CrushFTP before 7.8.0 and 8.x before 8.2.0 has a redirect vulnerability.
CVE-2017-1195 1Ibm 1Curam Social Program Management May 13, 2026 Aug 29, 2017 N/A· v4 6.1 MEDIUM· v3 5.8 MEDIUM· v2 IBM Curam Social Program Management 6.0, 6.1, 6.2, and 7.0 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially-crafted Web site, a remote...Show more IBM Curam Social Program Management 6.0, 6.1, 6.2, and 7.0 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web site that would appear to be trusted. This could allow the attacker to obtain highly sensitive information or conduct further attacks against the victim. IBM X-Force ID: 123670.Show less
CVE-2017-1489 1Ibm 6Security Access Manager Security Access Manager For MobileSecurity Access Manager For Web+3 more May 13, 2026 Aug 29, 2017 N/A· v4 6.1 MEDIUM· v3 5.8 MEDIUM· v2 IBM Security Access Manager 6.1, 7.0, 8.0, and 9.0 e-community configurations may be affected by a redirect vulnerability. ECSSO Master Authentication can redirect to a server not participating in an e-community domain....Show more IBM Security Access Manager 6.1, 7.0, 8.0, and 9.0 e-community configurations may be affected by a redirect vulnerability. ECSSO Master Authentication can redirect to a server not participating in an e-community domain. IBM X-Force ID: 128687.Show less
CVE-2017-3085 2Adobe Redhat 5Enterprise Linux Enterprise Linux DesktopEnterprise Linux Workstation+2 more May 13, 2026 Aug 11, 2017 N/A· v4 7.4 HIGH· v3 4.3 MEDIUM· v2 Adobe Flash Player versions 26.0.0.137 and earlier have a security bypass vulnerability that leads to information disclosure when performing URL redirect.
CVE-2017-1448 1Ibm 2Emptoris Strategic Supply Management Emptoris Supplier Lifecycle Management May 13, 2026 Aug 9, 2017 N/A· v4 5.4 MEDIUM· v3 4.9 MEDIUM· v2 IBM Emptoris Supplier Lifecycle Management 10.0.x and 10.1.x could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially-crafted Web site, a remot...Show more IBM Emptoris Supplier Lifecycle Management 10.0.x and 10.1.x could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web site that would appear to be trusted. This could allow the attacker to obtain highly sensitive information or conduct further attacks against the victim. IBM X-Force ID: 128173.Show less
CVE-2016-8949 1Ibm 2Emptoris Strategic Supply Management Emptoris Supplier Lifecycle Management May 13, 2026 Aug 9, 2017 N/A· v4 5.4 MEDIUM· v3 4.9 MEDIUM· v2 IBM Emptoris Supplier Lifecycle Management 10.0.x and 10.1.x could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially-crafted Web site, a remot...Show more IBM Emptoris Supplier Lifecycle Management 10.0.x and 10.1.x could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web site that would appear to be trusted. This could allow the attacker to obtain highly sensitive information or conduct further attacks against the victim. IBM X-Force ID: 118836.Show less
CVE-2017-12138 1Xoops 1Xoops May 13, 2026 Aug 2, 2017 N/A· v4 6.1 MEDIUM· v3 5.8 MEDIUM· v2 XOOPS Core 2.5.8 has a stored URL redirect bypass vulnerability in /modules/profile/index.php because of the URL filter.
CVE-2017-11725 1Thycotic 1Secret Server May 13, 2026 Jul 29, 2017 N/A· v4 5.4 MEDIUM· v3 5.8 MEDIUM· v2 The share function in Thycotic Secret Server before 10.2.000019 mishandles the Back Button, leading to unintended redirections.
CVE-2017-11718 1Metinfo Project 1Metinfo May 13, 2026 Jul 28, 2017 N/A· v4 6.1 MEDIUM· v3 5.8 MEDIUM· v2 There is URL Redirector Abuse in MetInfo through 5.3.17 via the gourl parameter to member/login.php.
CVE-2017-1287 1Ibm 1Rhapsody Design Manager May 13, 2026 Jul 24, 2017 N/A· v4 5.4 MEDIUM· v3 4.9 MEDIUM· v2 IBM Rhapsody DM 5.0 and 6.0 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vul...Show more IBM Rhapsody DM 5.0 and 6.0 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web site that would appear to be trusted. This could allow the attacker to obtain highly sensitive information or conduct further attacks against the victim.Show less
CVE-2017-11586 1Finecms 1Finecms May 13, 2026 Jul 24, 2017 N/A· v4 6.1 MEDIUM· v3 5.8 MEDIUM· v2 dayrui FineCms 5.0.9 has URL Redirector Abuse via the url parameter in a sync action, related to controllers/Weixin.php.
CVE-2017-1223 1Ibm 1Bigfix Platform May 13, 2026 Jul 19, 2017 N/A· v4 6.1 MEDIUM· v3 5.8 MEDIUM· v2 IBM Tivoli Endpoint Manager could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vul...Show more IBM Tivoli Endpoint Manager could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web site that would appear to be trusted. This could allow the attacker to obtain highly sensitive information or conduct further attacks against the victim. IBM X-Force ID: 123902.Show less
CVE-2017-1000070 1Oauth2 Proxy Project 1Oauth2 Proxy May 13, 2026 Jul 17, 2017 N/A· v4 6.1 MEDIUM· v3 5.8 MEDIUM· v2 The Bitly oauth2_proxy in version 2.1 and earlier was affected by an open redirect vulnerability during the start and termination of the 2-legged OAuth flow. This issue was caused by improper input validation and a viola...Show more The Bitly oauth2_proxy in version 2.1 and earlier was affected by an open redirect vulnerability during the start and termination of the 2-legged OAuth flow. This issue was caused by improper input validation and a violation of RFC-6819Show less
CVE-2017-1000027 1Koozali 1Sme Server May 13, 2026 Jul 17, 2017 N/A· v4 6.1 MEDIUM· v3 5.8 MEDIUM· v2 Koozali Foundation SME Server versions 8.x, 9.x, 10.x are vulnerable to an open URL redirect vulnerability in the user web login function resulting in unauthorized account access.
CVE-2017-1000013 1Phpmyadmin 1Phpmyadmin May 13, 2026 Jul 17, 2017 N/A· v4 6.1 MEDIUM· v3 5.8 MEDIUM· v2 phpMyAdmin 4.0, 4.4, and 4.6 are vulnerable to an open redirect weakness
CVE-2016-8953 1Ibm 1Emptoris Sourcing May 13, 2026 Jul 12, 2017 N/A· v4 5.4 MEDIUM· v3 4.9 MEDIUM· v2 IBM Emptoris Sourcing 9.5.x through 10.1.x could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially-crafted Web site, a remote attacker could e...Show more IBM Emptoris Sourcing 9.5.x through 10.1.x could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web site that would appear to be trusted. This could allow the attacker to obtain highly sensitive information or conduct further attacks against the victim. IBM X-Force ID: 118840.Show less
CVE-2016-8947 1Ibm 1Emptoris Sourcing May 13, 2026 Jul 12, 2017 N/A· v4 6.1 MEDIUM· v3 5.8 MEDIUM· v2 IBM Emptoris Sourcing 9.5.x through 10.1.x could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially-crafted Web site, a remote attacker could e...Show more IBM Emptoris Sourcing 9.5.x through 10.1.x could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web site that would appear to be trusted. This could allow the attacker to obtain highly sensitive information or conduct further attacks against the victim. IBM X-Force ID: 118834Show less
CVE-2017-8621 1Microsoft 1Exchange Server May 13, 2026 Jul 11, 2017 N/A· v4 6.1 MEDIUM· v3 5.8 MEDIUM· v2 Microsoft Exchange Server 2010 SP3, Exchange Server 2013 SP3, Exchange Server 2013 CU16, and Exchange Server 2016 CU5 allows an open redirect vulnerability that could lead to spoofing, aka "Microsoft Exchange Open Redire...Show more Microsoft Exchange Server 2010 SP3, Exchange Server 2013 SP3, Exchange Server 2013 CU16, and Exchange Server 2016 CU5 allows an open redirect vulnerability that could lead to spoofing, aka "Microsoft Exchange Open Redirect Vulnerability".Show less
CVE-2017-1398 1Ibm 1Websphere Commerce May 13, 2026 Jul 10, 2017 N/A· v4 6.1 MEDIUM· v3 5.8 MEDIUM· v2 IBM WebSphere Commerce Enterprise, Professional, Express, and Developer 6.0, 7.0, and 8.0 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specia...Show more IBM WebSphere Commerce Enterprise, Professional, Express, and Developer 6.0, 7.0, and 8.0 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web site that would appear to be trusted. This could allow the attacker to obtain highly sensitive information or conduct further attacks against the victim. IBM X-Force ID: 127385.Show less

Previous 1...747576...79 Next