Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
2,137 results · page 17 of 43
Dec 15, 2023An Open Redirection vulnerability exists in Uffizio's GPS Tracker all versions allows an attacker to construct a URL within the application that causes a redireCVE-2020-17484 · Other software · Uffizio · reported by MITREMedium 6.1
An Open Redirection vulnerability exists in Uffizio's GPS Tracker all versions allows an attacker to construct a URL within the application that causes a redirection to an arbitrary external domain.
- Product
- GPS Tracker
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 14, 2023A flaw was found in Keycloak that prevents certain schemes in redirects, but permits them if a wildcard is appended to the token.CVE-2023-6134 · Other software · Red Hat · reported by Red HatMedium 4.6
A flaw was found in Keycloak that prevents certain schemes in redirects, but permits them if a wildcard is appended to the token. This issue could allow an attacker to submit a specially crafted request leading to cross-site scripting (XSS) or further attacks. This flaw is the result of an incomplete fix for CVE-2020-10748.
- Product
- Red Hat build of Keycloak 22
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
Dec 14, 2023The package authelia-bhf included in Beckhoffs TwinCAT/BSD is prone to an open redirect that allows a remote unprivileged attacker to redirect a user to anotherCVE-2023-6545 · Other software · Beckhoff · reported by info@cert.vde.comMedium 4.7
The package authelia-bhf included in Beckhoffs TwinCAT/BSD is prone to an open redirect that allows a remote unprivileged attacker to redirect a user to another site. This may have limited impact to integrity and does solely affect anthelia-bhf the Beckhoff fork of authelia.
- Product
- authelia-bhf of TwinCAT/BSD
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert.vde.comdownload.beckhoff.com
Dec 14, 2023URL Redirection to Untrusted Site ('Open Redirect') vulnerability when "form" authentication is used in Apache Shiro.CVE-2023-46750 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 6.1
URL Redirection to Untrusted Site ('Open Redirect') vulnerability when "form" authentication is used in Apache Shiro. Mitigation: Update to Apache Shiro 1.13.0+ or 2.0.0-alpha-4+.
- Product
- Apache Shiro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orglists.apache.org
Dec 14, 2023 A CWE-601:URL Redirection to Untrusted Site (‘Open Redirect’) vulnerability exists that could cause disclosure of information through phishing attempts over HTCVE-2023-5629 · Other software · Schneider Electric · reported by cybersecurity@se.comHigh 8.2
A CWE-601:URL Redirection to Untrusted Site (‘Open Redirect’) vulnerability exists that could cause disclosure of information through phishing attempts over HTTP.
- Product
- Trio Q-Series Ethernet Data Radio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddownload.schneider-electric.comdownload.schneider-electric.com
Dec 13, 2023Jenkins OpenId Connect Authentication Plugin 2.6 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins, allowingCVE-2023-50771 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.comMedium 6.1
Jenkins OpenId Connect Authentication Plugin 2.6 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins, allowing attackers to perform phishing attacks.
- Product
- Jenkins OpenId Connect Authentication Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comjenkins.io
Dec 13, 2023Open redirect vulnerability has been found in the Open CMS product affecting versions 14 and 15 of the 'Mercury' template.CVE-2023-6380 · Other software · Alkacon · reported by cve-coordination@incibe.esMedium 6.1
Open redirect vulnerability has been found in the Open CMS product affecting versions 14 and 15 of the 'Mercury' template. An attacker could create a specially crafted URL and send it to a specific user to redirect them to a malicious site and compromise them. Exploitation of this vulnerability is possible due to the fact that there is no proper sanitization of the 'URI' parameter.
- Product
- Open CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 9, 2023The next parameter in the /accounts/login endpoint of Seafile 9.0.6 allows attackers to redirect users to arbitrary sites.CVE-2023-28874 · Other software · Seafile · reported by MITREMedium 6.1
The next parameter in the /accounts/login endpoint of Seafile 9.0.6 allows attackers to redirect users to arbitrary sites.
- Product
- Seafile
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordherolab.usd.demanual.seafile.com
Dec 8, 2023Franklin Fueling Systems System Sentinel AnyWare (SSA) version 1.6.24.492 is vulnerable to Open Redirect.CVE-2023-48928 · Other software · Franklin-electric · reported by MITREMedium 6.1
Franklin Fueling Systems System Sentinel AnyWare (SSA) version 1.6.24.492 is vulnerable to Open Redirect. The 'path' parameter of the prefs.asp resource allows an attacker to redirect a victim user to an arbitrary web site using a crafted URL.
- Product
- System Sentinel Anyware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 7, 2023URL Redirection to Untrusted Site ('Open Redirect') vulnerability in SoftLab Integrate Google Drive – Browse, Upload, Download, Embed, Play, Share, Gallery, andCVE-2023-47548 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in SoftLab Integrate Google Drive – Browse, Upload, Download, Embed, Play, Share, Gallery, and Manage Your Google Drive Files Into Your WordPress Site.This issue affects Integrate Google Drive – Browse, Upload, Download, Embed, Play, Share, Gallery, and Manage Your Google Drive Files Into Your WordPress Site: from n/a through 1.3.2.
- Affected
- up to 1.3.2
- What to do
- Affects up to 1.3.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 7, 2023Responsive Column Widgets: URL Redirection to Untrusted Site ('Open Redirect')CVE-2023-45762 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Michael Uno (miunosoft) Responsive Column Widgets.This issue affects Responsive Column Widgets: from n/a through 1.2.7.
- Product
- Responsive Column Widgets
- Affected
- up to 1.2.7
- What to do
- Affects up to 1.2.7. Update Responsive Column Widgets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 7, 2023Landing Page Builder – Lead Page – Optin Page – Squeeze Page – WordPress Landing Pages: URL Redirection to Untrusted Site ('Open Redirect')CVE-2023-48325 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in PluginOps Landing Page Builder – Lead Page – Optin Page – Squeeze Page – WordPress Landing Pages.This issue affects Landing Page Builder – Lead Page – Optin Page – Squeeze Page – WordPress Landing Pages: from n/a through 1.5.1.5.
- Product
- Landing Page Builder – Lead Page – Optin Page – Squeeze Page – WordPress Landing Pages
- Affected
- up to 1.5.1.5
- What to do
- Affects up to 1.5.1.5. Update Landing Page Builder – Lead Page – Optin Page – Squeeze Page – WordPress Landing Pages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 7, 2023Integration for Constant Contact and Contact Form 7, WPForms, Elementor, Ninja Forms: URL Redirection to Untrusted Site ('Open Redirect')CVE-2023-47779 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in CRM Perks. Integration for Constant Contact and Contact Form 7, WPForms, Elementor, Ninja Forms.This issue affects Integration for Constant Contact and Contact Form 7, WPForms, Elementor, Ninja Forms: from n/a through 1.1.4.
- Product
- Integration for Constant Contact and Contact Form 7, WPForms, Elementor, Ninja Forms
- Affected
- up to 1.1.4
- What to do
- Affects up to 1.1.4. Update Integration for Constant Contact and Contact Form 7, WPForms, Elementor, Ninja Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 6, 2023Open redirect vulnerability in Pleasanter 1.3.47.0 and earlier allows a remote unauthenticated attacker to redirect users to arbitrary web sites via a speciallyCVE-2023-46688 · Other software · Implem Inc. · reported by vultures@jpcert.or.jpMedium 6.1
Open redirect vulnerability in Pleasanter 1.3.47.0 and earlier allows a remote unauthenticated attacker to redirect users to arbitrary web sites via a specially crafted URL.
- Product
- Pleasanter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 30, 2023 A reflected XSS vulnerability allows an open redirect when the victim clicks a malicious link to an error page on Sophos Email Appliance older than versionCVE-2021-36806 · Network & remote access · Sophos · reported by security-alert@sophos.comMedium 4.7
A reflected XSS vulnerability allows an open redirect when the victim clicks a malicious link to an error page on Sophos Email Appliance older than version 4.5.3.4.
- Product
- Sophos Email Appliance
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcommunity.sophos.comcommunity.sophos.com
Nov 27, 2023Mattermost fails to properly check a redirect URL parameter allowing for an open redirect was possible when the user clicked "Back to Mattermost" after providinCVE-2023-47168 · Other software · Mattermost · reported by responsibledisclosure@mattermost.comMedium 4.3
Mattermost fails to properly check a redirect URL parameter allowing for an open redirect was possible when the user clicked "Back to Mattermost" after providing a invalid custom url scheme in /oauth/{service}/mobile_login?redirect_to=
- Product
- Mattermost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmattermost.commattermost.com
Nov 20, 2023Seraphinite Accelerator: Does not validate the URL to redirect any authenticated user toCVE-2023-5610 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Seraphinite Accelerator WordPress plugin before 2.2.29 does not validate the URL to redirect any authenticated user to, leading to an arbitrary redirect
- Product
- Seraphinite Accelerator
- Fixed in
- 2.2.29
- What to do
- Update Seraphinite Accelerator to 2.2.29 or newer.
Nov 20, 2023Forminator: Does not properly sanitize the redirect-url field in the form submission settingsCVE-2023-5119 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Forminator WordPress plugin before 1.27.0 does not properly sanitize the redirect-url field in the form submission settings, which could allow high-privilege users such as an administrator to inject arbitrary web scripts even when the unfiltered_html capability is disallowed (for example in a multisite setup).
- Product
- Forminator
- Fixed in
- 1.27.0
- What to do
- Update Forminator to 1.27.0 or newer.
Nov 17, 2023 An open redirect vulnerability in ePolicy Orchestrator prior to 5.10.0 CP1 Update 2, allows a remote low privileged user to modify the URL parameter for the puCVE-2023-5445 · Other software · Trellix · reported by trellixpsirt@trellix.comMedium 5.4
An open redirect vulnerability in ePolicy Orchestrator prior to 5.10.0 CP1 Update 2, allows a remote low privileged user to modify the URL parameter for the purpose of redirecting URL request(s) to a malicious site. This impacts the dashboard area of the user interface. A user would need to be logged into ePO to trigger this vulnerability. To exploit this the attacker must change the HTTP payload post submission, prior to it reaching the ePO server.
- Product
- ePolicy Orchestrator
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkcm.trellix.comkcm.trellix.com
Nov 15, 2023URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Payara Platform Payara Server, Micro and Embedded (Servlet Implementation modules) allows RCVE-2023-41699 · Other software · Payara Platform · reported by 769c9ae7-73c3-4e47-ae19-903170fc3eb8Medium 6.1
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Payara Platform Payara Server, Micro and Embedded (Servlet Implementation modules) allows Redirect Access to Libraries.This issue affects Payara Server, Micro and Embedded: from 5.0.0 before 5.57.0, from 4.1.2.191 before 4.1.2.191.46, from 6.0.0 before 6.8.0, from 6.2023.1 before 6.2023.11.
- Product
- Payara Server, Micro and Embedded
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.payara.fishdocs.payara.fish
Nov 14, 2023 A CWE-601 URL Redirection to Untrusted Site vulnerability exists that could cause an openredirect vulnerability leading to a cross site scripting attack.CVE-2023-5986 · Other software · Schneider Electric · reported by cybersecurity@se.comHigh 8.2
A CWE-601 URL Redirection to Untrusted Site vulnerability exists that could cause an openredirect vulnerability leading to a cross site scripting attack. By providing a URL-encoded input attackers can cause the software’s web application to redirect to the chosen domain after a successful login is performed.
- Product
- EcoStruxure Power Monitoring Expert (PME)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddownload.schneider-electric.comdownload.schneider-electric.com
Nov 9, 2023Cross-Site Request Forgery (CSRF) vulnerability in Criss Swaim TPG Redirect plugin <= 1.0.7 versions.CVE-2023-32093 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Criss Swaim TPG Redirect plugin <= 1.0.7 versions.
- Fixed in
- 1.0.8
- What to do
- Update the plugin to 1.0.8 or newer.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Nov 6, 2023Mattermost fails to properly sanitize the request to /api/v4/redirect_location allowing an attacker, sending a specially crafted request to /api/v4/redirect_locCVE-2023-5969 · Other software · Mattermost · reported by responsibledisclosure@mattermost.comMedium 5.3
Mattermost fails to properly sanitize the request to /api/v4/redirect_location allowing an attacker, sending a specially crafted request to /api/v4/redirect_location, to fill up the memory due to caching large items.
- Product
- Mattermost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmattermost.commattermost.com
Nov 3, 2023A security issue was discovered in kube-apiserver that allows an aggregated API server to redirect client traffic to any URL.CVE-2022-3172 · Other software · Kubernetes · reported by jordan@liggitt.netMedium 5.1
A security issue was discovered in kube-apiserver that allows an aggregated API server to redirect client traffic to any URL. This could lead to the client performing unexpected actions as well as forwarding the client's API server credentials to third parties.
- Product
- kube-apiserver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comgroups.google.com
Nov 3, 2023Chunghwa Telecom NOKIA G-040W-Q Firewall function has a vulnerability of input validation for ICMP redirect messages.CVE-2023-41355 · Other software · Chunghwa Telecom · reported by twcert@cert.org.twCritical 9.8
Chunghwa Telecom NOKIA G-040W-Q Firewall function has a vulnerability of input validation for ICMP redirect messages. An unauthenticated remote attacker can exploit this vulnerability by sending a crafted package to modify the network routing table, resulting in a denial of service or sensitive information leaking.
- Product
- NOKIA G-040W-Q
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Nov 1, 2023Online Examination System v1.0 is vulnerable to multiple Open Redirect vulnerabilities.CVE-2023-45203 · Other software · Projectworlds Pvt. Limited · reported by help@fluidattacks.comMedium 6.1
Online Examination System v1.0 is vulnerable to multiple Open Redirect vulnerabilities. The 'q' parameter of the login.php resource allows an attacker to redirect a victim user to an arbitrary web site using a crafted URL.
- Product
- Online Examination System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfluidattacks.comprojectworlds.in
Nov 1, 2023Online Examination System v1.0 is vulnerable to multiple Open Redirect vulnerabilities.CVE-2023-45202 · Other software · Projectworlds Pvt. Limited · reported by help@fluidattacks.comMedium 6.1
Online Examination System v1.0 is vulnerable to multiple Open Redirect vulnerabilities. The 'q' parameter of the feed.php resource allows an attacker to redirect a victim user to an arbitrary web site using a crafted URL.
- Product
- Online Examination System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfluidattacks.comprojectworlds.in
Nov 1, 2023Online Examination System v1.0 is vulnerable to multiple Open Redirect vulnerabilities.CVE-2023-45201 · Other software · Projectworlds Pvt. Limited · reported by help@fluidattacks.comMedium 6.1
Online Examination System v1.0 is vulnerable to multiple Open Redirect vulnerabilities. The 'q' parameter of the admin.php resource allows an attacker to redirect a victim user to an arbitrary web site using a crafted URL.
- Product
- Online Examination System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfluidattacks.comprojectworlds.in
Oct 31, 2023VMware Workspace ONE UEM console contains an open redirect vulnerability.CVE-2023-20886 · Other software · VMware · reported by security@vmware.comHigh 8.8
VMware Workspace ONE UEM console contains an open redirect vulnerability. A malicious actor may be able to redirect a victim to an attacker and retrieve their SAML response to login as the victim user.
- Product
- Workspace ONE UEM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2023Potential open redirect vulnerability in opentext Service Management Automation X (SMAX) versions 2020.05, 2020.08, 2020.11, 2021.02, 2021.05, 2021.08, 2021.11CVE-2023-4964 · Other software · opentext · reported by security@opentext.comHigh 8.2
Potential open redirect vulnerability in opentext Service Management Automation X (SMAX) versions 2020.05, 2020.08, 2020.11, 2021.02, 2021.05, 2021.08, 2021.11, 2022.05, 2022.11 and opentext Asset Management X (AMX) versions 2021.08, 2021.11, 2022.05, 2022.11. The vulnerability could allow attackers to redirect a user to malicious websites.
- Product
- Service Management Automation X (SMAX)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordportal.microfocus.comportal.microfocus.com
Oct 27, 2023In notifyTimeout of CallRedirectionProcessor, there is a possible permission bypass due to a logic error in the code.CVE-2023-40130 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In notifyTimeout of CallRedirectionProcessor, there is a possible permission bypass due to a logic error in the code. This could lead to local escalation of privilege and background activity launch with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordandroid.googlesource.comsource.android.com
Oct 25, 2023Code injection via nginx.ingress.kubernetes.io/permanent-redirect annotation.CVE-2023-5044 · Other software · Kubernetes · reported by jordan@liggitt.netHigh 7.6
Code injection via nginx.ingress.kubernetes.io/permanent-redirect annotation.
- Product
- ingress-nginx
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comgithub.com
Oct 25, 2023When opening a page in reader mode, the redirect URL could have caused attacker-controlled script to execute in a reflected Cross-Site Scripting (XSS) attack.CVE-2023-5758 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 6.1
When opening a page in reader mode, the redirect URL could have caused attacker-controlled script to execute in a reflected Cross-Site Scripting (XSS) attack. This vulnerability affects Firefox for iOS < 119.
- Product
- Firefox for iOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgsecurity.gentoo.org
Oct 25, 2023TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formWlanRedirect.CVE-2023-46548 · Other software · totolink · reported by MITRECritical 9.8
TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formWlanRedirect.
- Product
- x2000r_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2023views/switch.py in django-grappelli (aka Django Grappelli) before 2.15.2 attempts to prevent external redirection with startswith("/") but this does not consideCVE-2021-46898 · Other software · Vonautomatisch · reported by MITREMedium 6.1
views/switch.py in django-grappelli (aka Django Grappelli) before 2.15.2 attempts to prevent external redirection with startswith("/") but this does not consider a protocol-relative URL (e.g., //example.com) attack.
- Product
- Django Grappelli
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 18, 2023zzzcms v2.2.0 was discovered to contain an open redirect vulnerability.CVE-2023-45909 · Other software · Zzzcms · reported by MITREMedium 6.1
zzzcms v2.2.0 was discovered to contain an open redirect vulnerability.
- Product
- Zzzphp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 17, 2023Multiple reflected cross-site scripting (XSS) vulnerabilities in the Plugin for OAuth 2.0 module's OAuth2ProviderApplicationRedirect class in Liferay Portal 7.4CVE-2023-44311 · Other software · Liferay · reported by security@liferay.comCritical 9.6
Multiple reflected cross-site scripting (XSS) vulnerabilities in the Plugin for OAuth 2.0 module's OAuth2ProviderApplicationRedirect class in Liferay Portal 7.4.3.41 through 7.4.3.89, and Liferay DXP 7.4 update 41 through update 89 allow remote attackers to inject arbitrary web script or HTML via the (1) code, or (2) error parameter. This issue is caused by an incomplete fix in CVE-2023-33941.
- Product
- DXP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordliferay.devliferay.dev
Oct 16, 2023Defender Security: Does not prevent redirects to the login page via the auth_redirect WordPress functionCVE-2023-5089 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Defender Security WordPress plugin before 4.1.0 does not prevent redirects to the login page via the auth_redirect WordPress function, allowing an unauthenticated visitor to access the login page, even when the hide login page functionality of the plugin is enabled.
- Product
- Defender Security
- Fixed in
- 4.1.0
- What to do
- Update Defender Security to 4.1.0 or newer.
Full record and what to do →NVD recordwpscan.comsprocketsecurity.com
Oct 15, 2023urllib3 before 1.24.2 does not remove the authorization HTTP header when following a cross-origin redirect (i.e., a redirect that differs in host, port, or scheCVE-2018-25091 · Other software · Python · reported by MITREMedium 6.1
urllib3 before 1.24.2 does not remove the authorization HTTP header when following a cross-origin redirect (i.e., a redirect that differs in host, port, or scheme). This can allow for credentials in the authorization header to be exposed to unintended hosts or transmitted in cleartext. NOTE: this issue exists because of an incomplete fix for CVE-2018-20060 (which was case-sensitive).
- Product
- Urllib3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2023Cross-Site Request Forgery (CSRF) vulnerability in WP Doctor WooCommerce Login Redirect plugin <= 2.2.4 versions.CVE-2023-44995 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in WP Doctor WooCommerce Login Redirect plugin <= 2.2.4 versions.
- What to do
- Update the plugin to the newest version.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Oct 9, 2023Cross Site Scripting (XSS) vulnerability in mooSocial v.3.1.8 allows a remote attacker to execute arbitrary code via a crafted payload to the admin_redirect_urlCVE-2023-44812 · Other software · Moosocial · reported by MITREMedium 6.1
Cross Site Scripting (XSS) vulnerability in mooSocial v.3.1.8 allows a remote attacker to execute arbitrary code via a crafted payload to the admin_redirect_url parameter of the user login function.
- Product
- Moosocial
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 4, 2023Open Redirect in GitHub repository mosparo/mosparo prior to 1.0.2.CVE-2023-5375 · Other software · mosparo · reported by security@huntr.devMedium 6.1
Open Redirect in GitHub repository mosparo/mosparo prior to 1.0.2.
- Product
- mosparo/mosparo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 27, 2023The vulnerability is an intent redirection in LG ThinQ Service ("com.lge.lms2") in the "com/lge/lms/things/ui/notification/NotificationManager.java" file.CVE-2023-44121 · Other software · LG Electronics · reported by product.security@lge.comMedium 5
The vulnerability is an intent redirection in LG ThinQ Service ("com.lge.lms2") in the "com/lge/lms/things/ui/notification/NotificationManager.java" file. This vulnerability could be exploited by a third-party app installed on an LG device by sending a broadcast with the action "com.lge.lms.things.notification.ACTION". Additionally, this vulnerability is very dangerous because LG ThinQ Service is a system app (having android:sharedUserId="android.uid.system" setting). Intent redirection in this app leads to accessing arbitrary not exported activities of absolutely all apps.
- Product
- LG V60 Thin Q 5G(LMV600VM)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlgsecurity.lge.comlgsecurity.lge.com
Sep 25, 2023A reflected cross-site scripting (XSS) vulnerability in the data[redirect_url] parameter of mooSocial v3.1.8 allows attackers to steal user's session cookies anCVE-2023-43325 · Other software · Moosocial · reported by MITREMedium 6.1
A reflected cross-site scripting (XSS) vulnerability in the data[redirect_url] parameter of mooSocial v3.1.8 allows attackers to steal user's session cookies and impersonate their account via a crafted URL.
- Product
- Moosocial
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.commoosocial.com
Sep 25, 2023Redirection permission verification vulnerability in the home screen module.CVE-2023-41302 · Other software · Huawei · reported by psirt@huawei.comHigh 7.5
Redirection permission verification vulnerability in the home screen module. Successful exploitation of this vulnerability may cause features to perform abnormally.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comdevice.harmonyos.com
Sep 11, 2023An open redirect vulnerability in the sanitize_url() parameter of CouchCMS v2.3 allows attackers to redirect a victim user to an arbitrary web site via a crafteCVE-2023-41609 · Other software · Couchcms · reported by MITREMedium 6.1
An open redirect vulnerability in the sanitize_url() parameter of CouchCMS v2.3 allows attackers to redirect a victim user to an arbitrary web site via a crafted URL.
- Product
- Couchcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2023SAP S/4HANA Manage Catalog Items and Cross-Catalog searches Fiori apps allow an attacker to redirect users to a malicious site due to insufficient URL validatioCVE-2023-40306 · Network & remote access · SAP SE · reported by cna@sap.comMedium 6.1
SAP S/4HANA Manage Catalog Items and Cross-Catalog searches Fiori apps allow an attacker to redirect users to a malicious site due to insufficient URL validation. As a result, it may have a slight impact on confidentiality and integrity.
- Product
- SAP S/4HANA (Manage Catalog Items and Cross-Catalog search)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 6, 2023A vulnerability in the web-based management interface of Cisco HyperFlex HX Data Platform could allow an unauthenticated, remote attacker to redirect a user to CVE-2023-20263 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 4.7
A vulnerability in the web-based management interface of Cisco HyperFlex HX Data Platform could allow an unauthenticated, remote attacker to redirect a user to a malicious web page. This vulnerability is due to improper input validation of the parameters in an HTTP request. An attacker could exploit this vulnerability by persuading a user to click a crafted link. A successful exploit could allow the attacker to redirect a user to a malicious website.
- Product
- Cisco HyperFlex HX Data Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsec.cloudapps.cisco.comsec.cloudapps.cisco.com
Sep 6, 2023Intent redirection vulnerability in PackageInstallerCHN prior to version 13.1.03.00 allows local attacker to access arbitrary file.CVE-2023-30728 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 4.4
Intent redirection vulnerability in PackageInstallerCHN prior to version 13.1.03.00 allows local attacker to access arbitrary file. This vulnerability requires user interaction.
- Product
- PackageInstallerCHN
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.comsecurity.samsungmobile.com
Sep 5, 2023Open redirect vulnerability in VI Web Client prior to 7.9.6 allows a remote unauthenticated attacker to redirect users to arbitrary web sites and conduct phishiCVE-2023-38574 · Other software · i-PRO Co., Ltd. · reported by vultures@jpcert.or.jpMedium 6.1
Open redirect vulnerability in VI Web Client prior to 7.9.6 allows a remote unauthenticated attacker to redirect users to arbitrary web sites and conduct phishing attacks via a specially crafted URL.
- Product
- VI Web Client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.