URL Redirection to Untrusted Site ('Open Redirect')

A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.

CVEs (1,802)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2019-6021 1Ricoh 1Limedio Jun 17, 2026 Dec 26, 2019 N/A· v4 6.1 MEDIUM· v3 5.8 MEDIUM· v2 Open redirect vulnerability in Library Information Management System LIMEDIO all versions allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a specially crafted URL.
CVE-2019-6020 1Alfasado 1Powercms Jun 17, 2026 Dec 26, 2019 N/A· v4 6.1 MEDIUM· v3 5.8 MEDIUM· v2 Open redirect vulnerability in PowerCMS 5.12 and earlier (PowerCMS 5.x), 4.42 and earlier (PowerCMS 4.x), and 3.293 and earlier (PowerCMS 3.x) allows remote attackers to redirect users to arbitrary web sites and conduct...Show more Open redirect vulnerability in PowerCMS 5.12 and earlier (PowerCMS 5.x), 4.42 and earlier (PowerCMS 4.x), and 3.293 and earlier (PowerCMS 3.x) allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a specially crafted URL.Show less
CVE-2018-18288 1Crushftp 1Crushftp Nov 21, 2024 Dec 26, 2019 N/A· v4 6.1 MEDIUM· v3 5.8 MEDIUM· v2 CrushFTP through 8.3.0 is vulnerable to credentials theft via URL redirection.
CVE-2019-18781 1Zohocorp 1Manageengine Adselfservice Plus Jun 17, 2026 Dec 18, 2019 N/A· v4 6.1 MEDIUM· v3 5.8 MEDIUM· v2 An open redirect vulnerability was discovered in Zoho ManageEngine ADSelfService Plus 5.x before 5809 that allows attackers to force users who click on a crafted link to be sent to a specified external site.
CVE-2019-8791 1Apple 1Shazam Jun 17, 2026 Dec 18, 2019 N/A· v4 6.1 MEDIUM· v3 5.8 MEDIUM· v2 An issue existed in the parsing of URL schemes. This issue was addressed with improved URL validation. This issue is fixed in Shazam Android App Version 9.25.0, Shazam iOS App Version 12.11.0. Processing a maliciously cr...Show more An issue existed in the parsing of URL schemes. This issue was addressed with improved URL validation. This issue is fixed in Shazam Android App Version 9.25.0, Shazam iOS App Version 12.11.0. Processing a maliciously crafted URL may lead to an open redirect.Show less
CVE-2019-19775 1Zulip 1Zulip Server Jun 17, 2026 Dec 18, 2019 N/A· v4 6.1 MEDIUM· v3 5.8 MEDIUM· v2 The image thumbnailing handler in Zulip Server versions 1.9.0 to before 2.0.8 allowed an open redirect that was visible to logged-in users.
CVE-2014-3652 1Redhat 1Keycloak Nov 21, 2024 Dec 15, 2019 N/A· v4 6.1 MEDIUM· v3 5.8 MEDIUM· v2 JBoss KeyCloak: Open redirect vulnerability via failure to validate the redirect URL.
CVE-2019-19709 2Debian Mediawiki 2Debian Linux Mediawiki Jun 17, 2026 Dec 11, 2019 N/A· v4 6.1 MEDIUM· v3 5.8 MEDIUM· v2 MediaWiki through 1.33.1 allows attackers to bypass the Title_blacklist protection mechanism by starting with an arbitrary title, establishing a non-resolvable redirect for the associated page, and using redirect=1 in th...Show more MediaWiki through 1.33.1 allows attackers to bypass the Title_blacklist protection mechanism by starting with an arbitrary title, establishing a non-resolvable redirect for the associated page, and using redirect=1 in the action API when editing that page.Show less
CVE-2019-1486 1Microsoft 2Visual Studio 2019 Visual Studio Live Share Jun 17, 2026 Dec 10, 2019 N/A· v4 6.1 MEDIUM· v3 5.8 MEDIUM· v2 A spoofing vulnerability exists in Visual Studio Live Share when a guest connected to a Live Share session is redirected to an arbitrary URL specified by the session host, aka 'Visual Studio Live Share Spoofing Vulnerabi...Show more A spoofing vulnerability exists in Visual Studio Live Share when a guest connected to a Live Share session is redirected to an arbitrary URL specified by the session host, aka 'Visual Studio Live Share Spoofing Vulnerability'.Show less
CVE-2019-19703 1Jetbrains 1Ktor Jun 17, 2026 Dec 10, 2019 N/A· v4 6.1 MEDIUM· v3 5.8 MEDIUM· v2 In Ktor through 1.2.6, the client resends data from the HTTP Authorization header to a redirect location.
CVE-2016-1000107 1Erlang 1Erlang/otp Nov 21, 2024 Dec 10, 2019 N/A· v4 6.1 MEDIUM· v3 5.8 MEDIUM· v2 inets in Erlang possibly 22.1 and earlier follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow r...Show more inets in Erlang possibly 22.1 and earlier follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an "httpoxy" issue.Show less
CVE-2016-1000108 2Debian Yaws 2Debian Linux Yaws Nov 21, 2024 Dec 10, 2019 N/A· v4 6.1 MEDIUM· v3 5.8 MEDIUM· v2 yaws before 2.0.4 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect CGI applications from the presence of untrusted client data in the HTTP_PROXY environment variable,...Show more yaws before 2.0.4 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect CGI applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect a CGI application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an "httpoxy" issue.Show less
CVE-2018-1002102 2Fedoraproject Kubernetes 2Fedora Kubernetes Nov 21, 2024 Dec 5, 2019 N/A· v4 2.6 LOW· v3 2.1 LOW· v2 Improper validation of URL redirection in the Kubernetes API server in versions prior to v1.14.0 allows an attacker-controlled Kubelet to redirect API server requests from streaming endpoints to arbitrary hosts. Impacted...Show more Improper validation of URL redirection in the Kubernetes API server in versions prior to v1.14.0 allows an attacker-controlled Kubelet to redirect API server requests from streaming endpoints to arbitrary hosts. Impacted API servers will follow the redirect as a GET request with client-certificate credentials for authenticating to the Kubelet.Show less
CVE-2016-1000110 3Debian FedoraprojectPython 3Debian Linux FedoraPython Nov 21, 2024 Nov 27, 2019 N/A· v4 6.1 MEDIUM· v3 5.8 MEDIUM· v2 The CGIHandler class in Python before 2.7.12 does not protect against the HTTP_PROXY variable name clash in a CGI script, which could allow a remote attacker to redirect HTTP requests.
CVE-2019-18451 1Gitlab 1Gitlab Jun 17, 2026 Nov 26, 2019 N/A· v4 6.1 MEDIUM· v3 5.8 MEDIUM· v2 An issue was discovered in GitLab Community and Enterprise Edition 10.7.4 through 12.4 in the InternalRedirect filtering feature. It has an Open Redirect.
CVE-2019-15688 1Kaspersky 5Anti Virus Internet SecuritySecurity Cloud+2 more Jun 17, 2026 Nov 26, 2019 N/A· v4 6.1 MEDIUM· v3 5.8 MEDIUM· v2 Kaspersky Anti-Virus, Kaspersky Internet Security, Kaspersky Total Security, Kaspersky Free Anti-Virus, Kaspersky Small Office Security, Kaspersky Security Cloud up to 2020, the web protection component did not adequatel...Show more Kaspersky Anti-Virus, Kaspersky Internet Security, Kaspersky Total Security, Kaspersky Free Anti-Virus, Kaspersky Small Office Security, Kaspersky Security Cloud up to 2020, the web protection component did not adequately inform the user about the threat of redirecting to an untrusted site. Bypass.Show less
CVE-2019-14857 1Openidc 1Mod Auth Openidc Jun 17, 2026 Nov 26, 2019 N/A· v4 6.1 MEDIUM· v3 5.8 MEDIUM· v2 A flaw was found in mod_auth_openidc before version 2.4.0.1. An open redirect issue exists in URLs with trailing slashes similar to CVE-2019-3877 in mod_auth_mellon.
CVE-2014-2213 1Posh Project 1Posh Nov 21, 2024 Nov 22, 2019 N/A· v4 6.1 MEDIUM· v3 5.8 MEDIUM· v2 Open redirect vulnerability in the password reset functionality in POSH 3.0 through 3.2.1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the redirect parameter...Show more Open redirect vulnerability in the password reset functionality in POSH 3.0 through 3.2.1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the redirect parameter to portal/scr_sendmd5.php.Show less
CVE-2019-15073 1Openfind 1Mail2000 Jun 17, 2026 Nov 20, 2019 N/A· v4 6.1 MEDIUM· v3 5.8 MEDIUM· v2 An Open Redirect vulnerability for all browsers in MAIL2000 through version 6.0 and 7.0, which will redirect to a malicious site without authentication. This vulnerability affects many mail system of governments, organiz...Show more An Open Redirect vulnerability for all browsers in MAIL2000 through version 6.0 and 7.0, which will redirect to a malicious site without authentication. This vulnerability affects many mail system of governments, organizations, companies and universities.Show less
CVE-2018-13257 1Blackboard 1Blackboard Learn Nov 21, 2024 Nov 18, 2019 N/A· v4 6.1 MEDIUM· v3 5.8 MEDIUM· v2 The bb-auth-provider-cas authentication module within Blackboard Learn 2018-07-02 is susceptible to HTTP host header spoofing during Central Authentication Service (CAS) service ticket validation, enabling a phishing att...Show more The bb-auth-provider-cas authentication module within Blackboard Learn 2018-07-02 is susceptible to HTTP host header spoofing during Central Authentication Service (CAS) service ticket validation, enabling a phishing attack from the CAS server login page.Show less

Previous 1...747576...91 Next