URL Redirection to Untrusted Site ('Open Redirect')

A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.

CVEs (1,576)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2016-0928 1Pivotal 1Cloud Foundry Elastic Runtime May 6, 2026 Sep 18, 2016 N/A· v4 7.4 HIGH· v3 5.8 MEDIUM· v2 Multiple open redirect vulnerabilities in Pivotal Cloud Foundry (PCF) Elastic Runtime before 1.6.30 and 1.7.x before 1.7.8 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via...Show more Multiple open redirect vulnerabilities in Pivotal Cloud Foundry (PCF) Elastic Runtime before 1.6.30 and 1.7.x before 1.7.8 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.Show less
CVE-2016-5878 1Ibm 1Filenet Workplace May 6, 2026 Aug 8, 2016 N/A· v4 6.8 MEDIUM· v3 4.9 MEDIUM· v2 Open redirect vulnerability in IBM FileNet Workplace 4.0.2 before 4.0.2.14 allows remote authenticated users to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.
CVE-2016-4604 1Apple 1Safari May 6, 2026 Jul 22, 2016 N/A· v4 5.4 MEDIUM· v3 5.8 MEDIUM· v2 Safari in Apple iOS before 9.3.3 allows remote attackers to spoof the displayed URL via an HTTP response specifying redirection to an invalid TCP port number.
CVE-2016-5385 8Debian DrupalFedoraproject+5 more 13Communications User Data Repository Debian LinuxDrupal+10 more May 6, 2026 Jul 19, 2016 N/A· v4 8.1 HIGH· v3 5.1 MEDIUM· v2 PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, whi...Show more PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, as demonstrated by (1) an application that makes a getenv('HTTP_PROXY') call or (2) a CGI configuration of PHP, aka an "httpoxy" issue.Show less
CVE-2015-5354 1Novius Os 1Novius Os May 6, 2026 Jul 1, 2015 N/A· v4 N/A· v3 5.8 MEDIUM· v2 Open redirect vulnerability in Novius OS 5.0.1 (Elche) allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the redirect parameter to admin/nos/login.
CVE-2015-0697 1Cisco 1Telepresence Tc Software May 6, 2026 Apr 15, 2015 N/A· v4 N/A· v3 5.8 MEDIUM· v2 Open redirect vulnerability in the login page in Cisco TC Software before 6.3-26 and 7.x before 7.3.0 on Cisco TelePresence Collaboration Desk and Room Endpoints devices allows remote attackers to redirect users to arbit...Show more Open redirect vulnerability in the login page in Cisco TC Software before 6.3-26 and 7.x before 7.3.0 on Cisco TelePresence Collaboration Desk and Room Endpoints devices allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors, aka Bug ID CSCuq94980.Show less
CVE-2011-1594 1Redhat 2Network Satellite Spacewalk Apr 29, 2026 Feb 5, 2014 N/A· v4 6.5 MEDIUM· v3 5.8 MEDIUM· v2 A flaw was found in Spacewalk, as used in Red Hat Network Satellite. This open redirect vulnerability allows remote attackers to redirect users to arbitrary web sites by manipulating a URL in the url_bounce parameter. Th...Show more A flaw was found in Spacewalk, as used in Red Hat Network Satellite. This open redirect vulnerability allows remote attackers to redirect users to arbitrary web sites by manipulating a URL in the url_bounce parameter. This can enable attackers to conduct phishing attacks, potentially leading to unauthorized information disclosure or credential theft.Show less
CVE-2012-0518 1Oracle 1Fusion Middleware Apr 22, 2026 Oct 16, 2012 N/A· v4 4.7 MEDIUM· v3 4.3 MEDIUM· v2 Unspecified vulnerability in the Oracle Application Server Single Sign-On component in Oracle Fusion Middleware 10.1.4.3.0 allows remote attackers to affect integrity via unknown vectors related to Redirects, a different...Show more Unspecified vulnerability in the Oracle Application Server Single Sign-On component in Oracle Fusion Middleware 10.1.4.3.0 allows remote attackers to affect integrity via unknown vectors related to Redirects, a different vulnerability than CVE-2012-3175.Show less
CVE-2009-3832 1Opera 1Opera Browser Apr 23, 2026 Oct 30, 2009 N/A· v4 N/A· v3 5.8 MEDIUM· v2 Opera before 10.01 on Windows does not prevent use of Web fonts in rendering the product's own user interface, which allows remote attackers to spoof the address field via a crafted web site.
CVE-2008-1547 1Microsoft 1Exchange Server Apr 23, 2026 Oct 21, 2008 N/A· v4 N/A· v3 4.3 MEDIUM· v2 Open redirect vulnerability in exchweb/bin/redir.asp in Microsoft Outlook Web Access (OWA) for Exchange Server 2003 SP2 (aka build 6.5.7638) allows remote attackers to redirect users to arbitrary web sites and conduct ph...Show more Open redirect vulnerability in exchweb/bin/redir.asp in Microsoft Outlook Web Access (OWA) for Exchange Server 2003 SP2 (aka build 6.5.7638) allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the URL parameter.Show less
CVE-2008-2951 2Edgewall Fedoraproject 2Fedora Trac Apr 23, 2026 Jul 27, 2008 N/A· v4 6.1 MEDIUM· v3 5.8 MEDIUM· v2 Open redirect vulnerability in the search script in Trac before 0.10.5 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the q parameter, possibly related to the q...Show more Open redirect vulnerability in the search script in Trac before 0.10.5 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the q parameter, possibly related to the quickjump function.Show less
CVE-2008-2052 1Bitrix24 1Bitrix Site Manager Apr 23, 2026 May 2, 2008 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Open redirect vulnerability in redirect.php in Bitrix Site Manager 6.5 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the goto parameter.
CVE-2005-4206 1Blackboard 1Academic Suite Apr 16, 2026 Dec 13, 2005 N/A· v4 6.1 MEDIUM· v3 4.0 MEDIUM· v2 Blackboard Learning and Community Portal System in Academic Suite 6.3.1.424, 6.2.3.23, and other versions before 6 allows remote attackers to redirect users to other URLs and conduct phishing attacks via a modified url p...Show more Blackboard Learning and Community Portal System in Academic Suite 6.3.1.424, 6.2.3.23, and other versions before 6 allows remote attackers to redirect users to other URLs and conduct phishing attacks via a modified url parameter to frameset.jsp, which loads the URL into a frame and causes it to appear to be part of a valid page.Show less
CVE-2005-1475 1Opera 1Opera Browser Apr 16, 2026 Jun 16, 2005 N/A· v4 N/A· v3 7.5 HIGH· v2 The XMLHttpRequest object in Opera 8.0 Final Build 1095 allows remote attackers to bypass access restrictions and perform unauthorized actions on other domains via a redirect.
CVE-2005-0420 1Microsoft 1Exchange Server Apr 16, 2026 Apr 27, 2005 N/A· v4 N/A· v3 5.8 MEDIUM· v2 Microsoft Outlook Web Access (OWA), when used with Exchange, allows remote attackers to redirect users to arbitrary URLs for login via a link to the owalogon.asp application.
CVE-2004-2260 1Opera 1Opera Browser Apr 16, 2026 Dec 31, 2004 N/A· v4 N/A· v3 5.0 MEDIUM· v2 Opera Browser 7.23, and other versions before 7.50, updates the address bar as soon as the user clicks a link, which allows remote attackers to redirect to other sites via the onUnload attribute.

Previous 1...75 76 77 7879