Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
2,137 results · page 19 of 43
May 3, 2023A URL redirection to untrusted site ('Open Redirect') vulnerability [CWE-601] in FortiNAC-F version 7.2.0, FortiNAC version 9.4.1 and below, 9.2 all versions, 9CVE-2022-43950 · Network & remote access · Fortinet · reported by psirt@fortinet.comMedium 4.3
A URL redirection to untrusted site ('Open Redirect') vulnerability [CWE-601] in FortiNAC-F version 7.2.0, FortiNAC version 9.4.1 and below, 9.2 all versions, 9.1 all versions, 8.8 all versions, 8.7 all versions may allow an unauthenticated attacker to redirect users to any arbitrary website via a crafted URL.
- Product
- FortiNAC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfortiguard.comfortiguard.com
May 2, 2023Mattermost Desktop App fails to validate a mattermost server redirection and navigates to an arbitrary website CVE-2023-2000 · Other software · Mattermost · reported by responsibledisclosure@mattermost.comMedium 5.4
Mattermost Desktop App fails to validate a mattermost server redirection and navigates to an arbitrary website
- Product
- Mattermost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmattermost.commattermost.com
Apr 21, 2023NVIDIA DGX A100 SBIOS contains a vulnerability where an attacker may modify arbitrary memory of SMRAM by exploiting the GenericSio and LegacySmmSredir SMM APIs.CVE-2023-0202 · Other software · NVIDIA · reported by psirt@nvidia.comHigh 7.5
NVIDIA DGX A100 SBIOS contains a vulnerability where an attacker may modify arbitrary memory of SMRAM by exploiting the GenericSio and LegacySmmSredir SMM APIs. A successful exploit of this vulnerability may lead to denial of service, escalation of privileges, and information disclosure.
- Product
- NVIDIA DGX servers
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnvidia.custhelp.comnvidia.custhelp.com
Apr 17, 2023Redirection: Does not have CSRF checks in the uninstall actionCVE-2023-1331 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Redirection WordPress plugin before 1.1.5 does not have CSRF checks in the uninstall action, which could allow attackers to make logged in admins delete all the redirections through a CSRF attack.
- Product
- Redirection
- Fixed in
- 1.1.5
- What to do
- Update Redirection to 1.1.5 or newer.
Apr 15, 2023In the External Redirect Warning Plugin 1.3 for MyBB, the redirect URL (aka external.php?url=) is vulnerable to XSS.CVE-2022-28353 · Other software · External Redirect Warning Project · reported by MITREMedium 6.1
In the External Redirect Warning Plugin 1.3 for MyBB, the redirect URL (aka external.php?url=) is vulnerable to XSS.
- Product
- External Redirect Warning
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comcommunity.mybb.com
Apr 14, 2023There exists an open redirect within the response list update functionality of ServiceNow.CVE-2022-46886 · Other software · ServiceNow · reported by psirt@servicenow.comMedium 5.5
There exists an open redirect within the response list update functionality of ServiceNow. This allows attackers to redirect users to arbitrary domains when clicking on a URL within a service-now domain.
- Product
- ServiceNow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.servicenow.comsupport.servicenow.com
Apr 11, 2023A url redirection to untrusted site ('open redirect') in Fortinet FortiOS version 7.2.0 through 7.2.3, FortiOS version 7.0.0 through 7.0.9, FortiOS versions 6.4CVE-2023-22641 · Network & remote access · Fortinet · reported by psirt@fortinet.comMedium 4.1
A url redirection to untrusted site ('open redirect') in Fortinet FortiOS version 7.2.0 through 7.2.3, FortiOS version 7.0.0 through 7.0.9, FortiOS versions 6.4.0 through 6.4.12, FortiOS all versions 6.2, FortiOS all versions 6.0, FortiProxy version 7.2.0 through 7.2.2, FortiProxy version 7.0.0 through 7.0.8, FortiProxy all versions 2.0, FortiProxy all versions 1.2, FortiProxy all versions 1.1, FortiProxy all versions 1.0 allows an authenticated attacker to execute unauthorized code or commands via specially crafted requests.
- Product
- FortiOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfortiguard.comfortiguard.com
Apr 10, 2023A man in the middle can redirect traffic to a malicious server in a compromised configuration.CVE-2023-26467 · Other software · Pegasystems · reported by security@pega.comMedium 5.4
A man in the middle can redirect traffic to a malicious server in a compromised configuration.
- Product
- RPA: Synchronization Engine
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.pega.comsupport.pega.com
Apr 10, 2023A XSS vulnerability was identified in the ServiceNow UI page assessment_redirect.CVE-2022-39048 · Other software · Servicenow · reported by psirt@servicenow.comMedium 6.1
A XSS vulnerability was identified in the ServiceNow UI page assessment_redirect. To exploit this vulnerability, an attacker would need to persuade an authenticated user to click a maliciously crafted URL. Successful exploitation potentially could be used to conduct various client-side attacks, including, but not limited to, phishing, redirection, theft of CSRF tokens, and use of an authenticated user's browser or session to attack other systems.
- Product
- Now Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.servicenow.comsupport.servicenow.com
Apr 5, 2023 Dell Streaming Data Platform prior to 1.4 contains Open Redirect vulnerability.CVE-2023-28069 · Other software · Dell · reported by security_alert@emc.comMedium 6.1
Dell Streaming Data Platform prior to 1.4 contains Open Redirect vulnerability. A remote unauthenticated attacker can phish the legitimate user to redirect to malicious website leading to information disclosure and launch of phishing attacks.
- Product
- Streaming Data Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 3, 2023Redirection: Does not add nonce verification in placeCVE-2023-1330 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Redirection WordPress plugin before 1.1.4 does not add nonce verification in place when adding the redirect, which could allow attackers to add redirects via a CSRF attack.
- Product
- Redirection
- Fixed in
- 1.1.4
- What to do
- Update Redirection to 1.1.4 or newer.
Mar 27, 2023The BatteryHealthActivity has a redirection vulnerability.CVE-2022-48358 · Other software · Huawei · reported by psirt@huawei.comHigh 7.4
The BatteryHealthActivity has a redirection vulnerability. Successful exploitation of this vulnerability by a malicious app can cause service exceptions.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comdevice.harmonyos.com
Mar 24, 2023SQL injection vulnerability found in PrestaShop smplredirectionsmanager v.1.1.19 and before allow a remote attacker to gain privileges via the SmplTools::getMatCVE-2023-26864 · Other software · Smplredirectionsmanager Project · reported by MITRECritical 9.8
SQL injection vulnerability found in PrestaShop smplredirectionsmanager v.1.1.19 and before allow a remote attacker to gain privileges via the SmplTools::getMatchingRedirectionsFromPartscomponent.
- Product
- Smplredirectionsmanager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfriends-of-presta.github.iofriends-of-presta.github.io
Mar 22, 2023Experience Manager versions 6.5.15.0 (and earlier) are affected by a URL Redirection to Untrusted Site ('Open Redirect') vulnerability.CVE-2023-22266 · Other software · Adobe · reported by AdobeMedium 5.4
Experience Manager versions 6.5.15.0 (and earlier) are affected by a URL Redirection to Untrusted Site ('Open Redirect') vulnerability. A low-privilege authenticated attacker could leverage this vulnerability to redirect users to malicious websites. Exploitation of this issue requires user interaction.
- Product
- Experience Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelpx.adobe.comhelpx.adobe.com
Mar 22, 2023Experience Manager versions 6.5.15.0 (and earlier) are affected by a URL Redirection to Untrusted Site ('Open Redirect') vulnerability.CVE-2023-22265 · Other software · Adobe · reported by AdobeMedium 5.4
Experience Manager versions 6.5.15.0 (and earlier) are affected by a URL Redirection to Untrusted Site ('Open Redirect') vulnerability. A low-privilege authenticated attacker could leverage this vulnerability to redirect users to malicious websites. Exploitation of this issue requires user interaction.
- Product
- Experience Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelpx.adobe.comhelpx.adobe.com
Mar 22, 2023Experience Manager versions 6.5.15.0 (and earlier) are affected by a URL Redirection to Untrusted Site ('Open Redirect') vulnerability.CVE-2023-22264 · Other software · Adobe · reported by AdobeMedium 5.4
Experience Manager versions 6.5.15.0 (and earlier) are affected by a URL Redirection to Untrusted Site ('Open Redirect') vulnerability. A low-privilege authenticated attacker could leverage this vulnerability to redirect users to malicious websites. Exploitation of this issue requires user interaction.
- Product
- Experience Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelpx.adobe.comhelpx.adobe.com
Mar 22, 2023Experience Manager versions 6.5.15.0 (and earlier) are affected by a URL Redirection to Untrusted Site ('Open Redirect') vulnerability.CVE-2023-22263 · Other software · Adobe · reported by AdobeMedium 5.4
Experience Manager versions 6.5.15.0 (and earlier) are affected by a URL Redirection to Untrusted Site ('Open Redirect') vulnerability. A low-privilege authenticated attacker could leverage this vulnerability to redirect users to malicious websites. Exploitation of this issue requires user interaction.
- Product
- Experience Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelpx.adobe.comhelpx.adobe.com
Mar 22, 2023Experience Manager versions 6.5.15.0 (and earlier) are affected by a URL Redirection to Untrusted Site ('Open Redirect') vulnerability.CVE-2023-22262 · Other software · Adobe · reported by AdobeMedium 5.4
Experience Manager versions 6.5.15.0 (and earlier) are affected by a URL Redirection to Untrusted Site ('Open Redirect') vulnerability. A low-privilege authenticated attacker could leverage this vulnerability to redirect users to malicious websites. Exploitation of this issue requires user interaction.
- Product
- Experience Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelpx.adobe.comhelpx.adobe.com
Mar 22, 2023Experience Manager versions 6.5.15.0 (and earlier) are affected by a URL Redirection to Untrusted Site ('Open Redirect') vulnerability.CVE-2023-22261 · Other software · Adobe · reported by AdobeMedium 5.4
Experience Manager versions 6.5.15.0 (and earlier) are affected by a URL Redirection to Untrusted Site ('Open Redirect') vulnerability. A low-privilege authenticated attacker could leverage this vulnerability to redirect users to malicious websites. Exploitation of this issue requires user interaction.
- Product
- Experience Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelpx.adobe.comhelpx.adobe.com
Mar 22, 2023Experience Manager versions 6.5.15.0 (and earlier) are affected by a URL Redirection to Untrusted Site ('Open Redirect') vulnerability.CVE-2023-22260 · Other software · Adobe · reported by AdobeMedium 5.4
Experience Manager versions 6.5.15.0 (and earlier) are affected by a URL Redirection to Untrusted Site ('Open Redirect') vulnerability. A low-privilege authenticated attacker could leverage this vulnerability to redirect users to malicious websites. Exploitation of this issue requires user interaction.
- Product
- Experience Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelpx.adobe.comhelpx.adobe.com
Mar 22, 2023Experience Manager versions 6.5.15.0 (and earlier) are affected by a URL Redirection to Untrusted Site ('Open Redirect') vulnerability.CVE-2023-22259 · Other software · Adobe · reported by AdobeMedium 5.4
Experience Manager versions 6.5.15.0 (and earlier) are affected by a URL Redirection to Untrusted Site ('Open Redirect') vulnerability. A low-privilege authenticated attacker could leverage this vulnerability to redirect users to malicious websites. Exploitation of this issue requires user interaction.
- Product
- Experience Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelpx.adobe.comhelpx.adobe.com
Mar 22, 2023Experience Manager versions 6.5.15.0 (and earlier) are affected by a URL Redirection to Untrusted Site ('Open Redirect') vulnerability.CVE-2023-22258 · Other software · Adobe · reported by AdobeMedium 5.4
Experience Manager versions 6.5.15.0 (and earlier) are affected by a URL Redirection to Untrusted Site ('Open Redirect') vulnerability. A low-privilege authenticated attacker could leverage this vulnerability to redirect users to malicious websites. Exploitation of this issue requires user interaction.
- Product
- Experience Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelpx.adobe.comhelpx.adobe.com
Mar 22, 2023Experience Manager versions 6.5.15.0 (and earlier) are affected by a URL Redirection to Untrusted Site ('Open Redirect') vulnerability.CVE-2023-22257 · Other software · Adobe · reported by AdobeMedium 5.4
Experience Manager versions 6.5.15.0 (and earlier) are affected by a URL Redirection to Untrusted Site ('Open Redirect') vulnerability. A low-privilege authenticated attacker could leverage this vulnerability to redirect users to malicious websites. Exploitation of this issue requires user interaction.
- Product
- Experience Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelpx.adobe.comhelpx.adobe.com
Mar 22, 2023Experience Manager versions 6.5.15.0 (and earlier) are affected by a URL Redirection to Untrusted Site ('Open Redirect') vulnerability.CVE-2023-22256 · Other software · Adobe · reported by AdobeMedium 5.4
Experience Manager versions 6.5.15.0 (and earlier) are affected by a URL Redirection to Untrusted Site ('Open Redirect') vulnerability. A low-privilege authenticated attacker could leverage this vulnerability to redirect users to malicious websites. Exploitation of this issue requires user interaction.
- Product
- Experience Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelpx.adobe.comhelpx.adobe.com
Mar 20, 2023Rapid7 InsightVM versions 6.6.178 and lower suffers from an open redirect vulnerability, whereby an attacker has the ability to redirect the user to a site of tCVE-2023-0681 · Other software · Rapid7 · reported by cve@rapid7.comMedium 4.3
Rapid7 InsightVM versions 6.6.178 and lower suffers from an open redirect vulnerability, whereby an attacker has the ability to redirect the user to a site of the attacker’s choice using the ‘page’ parameter of the ‘data/console/redirect’ component of the application. This issue was resolved in the February, 2023 release of version 6.6.179.
- Product
- Nexpose
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.rapid7.comdocs.rapid7.com
Mar 16, 2023The Request package through 2.88.1 for Node.js allows a bypass of SSRF mitigations via an attacker-controller server that does a cross-protocol redirect (HTTP tCVE-2023-28155 · Other software · Request Project · reported by MITREMedium 6.1
The Request package through 2.88.1 for Node.js allows a bypass of SSRF mitigations via an attacker-controller server that does a cross-protocol redirect (HTTP to HTTPS, or HTTPS to HTTP). NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
- Product
- Request
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddoyensec.comgithub.com
Mar 9, 2023An issue has been discovered in GitLab DAST analyzer affecting all versions starting from 1.47 before 3.0.51, which sends custom request headers in redirects.CVE-2022-4317 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 5
An issue has been discovered in GitLab DAST analyzer affecting all versions starting from 1.47 before 3.0.51, which sends custom request headers in redirects.
- Product
- DAST
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 6, 2023PMB v7.4.6 was discovered to contain an open redirect vulnerability via the component /opac_css/pmb.php.CVE-2023-24735 · Other software · Sigb · reported by MITREMedium 6.1
PMB v7.4.6 was discovered to contain an open redirect vulnerability via the component /opac_css/pmb.php. This vulnerability allows attackers to redirect victim users to an external domain via a crafted URL.
- Product
- PMB
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 6, 2023In Moodle, insufficient redirect handling made it possible to blindly bypass cURL blocked hosts/allowed ports restrictions, resulting in a blind SSRF risk.CVE-2021-36396 · Other software · Moodle · reported by patrick@puiterwijk.orgHigh 7.5
In Moodle, insufficient redirect handling made it possible to blindly bypass cURL blocked hosts/allowed ports restrictions, resulting in a blind SSRF risk.
- Product
- Moodle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 5, 2023Open redirect vulnerability exists in web2py versions prior to 2.23.1.CVE-2023-22432 · Other software · web2py · reported by vultures@jpcert.or.jpMedium 6.1
Open redirect vulnerability exists in web2py versions prior to 2.23.1. When using the tool, a web2py user may be redirected to an arbitrary website by accessing a specially crafted URL. As a result, the user may become a victim of a phishing attack.
- Product
- web2py
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 28, 2023An open redirect vulnerability exposes OpenCATS to template injection due to improper validation of user-supplied GET parameters.CVE-2023-27292 · Other software · Opencats · reported by vulnreport@tenable.comMedium 5.4
An open redirect vulnerability exposes OpenCATS to template injection due to improper validation of user-supplied GET parameters.
- Product
- Opencats
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtenable.comtenable.com
Feb 27, 2023Registration Forms: Does not properly validate the redirection URLCVE-2023-0552 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Registration Forms WordPress plugin before 3.8.2.3 does not properly validate the redirection URL when logging in and login out, leading to an Open Redirect vulnerability
- Product
- Registration Forms
- Fixed in
- 3.8.2.3
- What to do
- Update Registration Forms to 3.8.2.3 or newer.
Feb 23, 2023SquaredUp Dashboard Server SCOM edition before 5.7.1 GA allows open redirection.CVE-2022-46784 · Other software · Squaredup · reported by MITREMedium 6.1
SquaredUp Dashboard Server SCOM edition before 5.7.1 GA allows open redirection. (The issue was originally found in 5.5.1 GA.)
- Product
- Dashboard Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordscomsupport.squaredup.comscomsupport.squaredup.com
Feb 21, 2023An open redirect issue was discovered in Kibana that could lead to a user being redirected to an arbitrary website if they use a maliciously crafted Kibana URL.CVE-2022-38779 · Other software · Elastic · reported by security@elastic.coMedium 6.1
An open redirect issue was discovered in Kibana that could lead to a user being redirected to an arbitrary website if they use a maliciously crafted Kibana URL.
- Product
- kibana
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddiscuss.elastic.coelastic.co
Feb 16, 2023open redirect in pollbot (pollbot.services.mozilla.com) in versions before 1.4.6CVE-2022-0637 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 6.1
open redirect in pollbot (pollbot.services.mozilla.com) in versions before 1.4.6
- Product
- Pollbot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgbugzilla.mozilla.org
Feb 13, 2023SAP Solution Manager - version 720, allows an authenticated attacker to redirect users to a malicious site due to insufficient URL validation.CVE-2023-23855 · Network & remote access · SAP · reported by cna@sap.comMedium 6.5
SAP Solution Manager - version 720, allows an authenticated attacker to redirect users to a malicious site due to insufficient URL validation. A successful attack could lead an attacker to read or modify the information or expose the user to a phishing attack. As a result, it has a low impact to confidentiality, integrity and availability.
- Product
- Solution Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlaunchpad.support.sap.comsap.com
Feb 11, 2023An open redirect to malicious sites can occur when accessing the "Feedback" action on the manager page.CVE-2022-38657 · Other software · HCL Software · reported by psirt@hcl.comHigh 8.2
An open redirect to malicious sites can occur when accessing the "Feedback" action on the manager page.
- Product
- Leap
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Feb 9, 2023Prior to commit 51867e0d15a6d7f80d5b714fd0e9976b9c160bb0, https://github.com/brave/adblock-lists removed redirect interceptors on some websites like Facebook inCVE-2023-22798 · Other software · Brave · reported by support@hackerone.comMedium 6.1
Prior to commit 51867e0d15a6d7f80d5b714fd0e9976b9c160bb0, https://github.com/brave/adblock-lists removed redirect interceptors on some websites like Facebook in which the redirect interceptor may have been there for security purposes. This could potentially cause open redirects on these websites. Brave's redirect interceptor removal feature is known as "debouncing" and is intended to remove unnecessary redirects that track users across the web.
- Product
- Adblock-lists
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhackerone.comhackerone.com
Feb 9, 2023An open redirect vulnerability is fixed in Rails 7.0.4.1 with the new protection against open redirects from calling redirect_to with untrusted user input.CVE-2023-22797 · Other software · Actionpack Project · reported by support@hackerone.comMedium 6.1
An open redirect vulnerability is fixed in Rails 7.0.4.1 with the new protection against open redirects from calling redirect_to with untrusted user input. In prior versions the developer was fully responsible for only providing trusted input. However the check introduced could allow an attacker to bypass with a carefully crafted URL resulting in an open redirect vulnerability.
- Product
- Actionpack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddiscuss.rubyonrails.orgdiscuss.rubyonrails.org
Feb 8, 2023Open Redirect in GitHub repository btcpayserver/btcpayserver prior to 1.7.6.CVE-2023-0748 · Other software · btcpayserver · reported by security@huntr.devMedium 6.4
Open Redirect in GitHub repository btcpayserver/btcpayserver prior to 1.7.6.
- Product
- btcpayserver/btcpayserver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 6, 2023Caddy v2.4.6 was discovered to contain an open redirection vulnerability which allows attackers to redirect users to phishing websites via crafted URLs.CVE-2022-28923 · Other software · Caddyserver · reported by MITREMedium 6.1
Caddy v2.4.6 was discovered to contain an open redirection vulnerability which allows attackers to redirect users to phishing websites via crafted URLs.
- Product
- Caddy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 6, 2023Online Food Ordering System v2 was discovered to contain a cross-site scripting (XSS) vulnerability via the redirect parameter in login.php.CVE-2023-24192 · Other software · Oretnom23 · reported by MITREMedium 6.1
Online Food Ordering System v2 was discovered to contain a cross-site scripting (XSS) vulnerability via the redirect parameter in login.php.
- Product
- Online Food Ordering System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsourcecodester.com
Feb 6, 2023Online Food Ordering System v2 was discovered to contain a cross-site scripting (XSS) vulnerability via the redirect parameter in signup.php.CVE-2023-24191 · Other software · Oretnom23 · reported by MITREMedium 6.1
Online Food Ordering System v2 was discovered to contain a cross-site scripting (XSS) vulnerability via the redirect parameter in signup.php.
- Product
- Online Food Ordering System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsourcecodester.com
Feb 1, 2023On versions 17.0.x before 17.0.0.2, 16.1.x before 16.1.3.3, 15.1.x before 15.1.7, 14.1.x before 14.1.5.3, and all versions of 13.1.x, an open redirect vulnerabiCVE-2023-22418 · Network & remote access · F5 · reported by f5sirt@f5.comMedium 6.1
On versions 17.0.x before 17.0.0.2, 16.1.x before 16.1.3.3, 15.1.x before 15.1.7, 14.1.x before 14.1.5.3, and all versions of 13.1.x, an open redirect vulnerability exists on virtual servers enabled with a BIG-IP APM access policy. This vulnerability allows an unauthenticated malicious attacker to build an open redirect URI. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
- Product
- BIG-IP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 26, 2023Jenkins OpenID Plugin 2.4 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins.CVE-2023-24445 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.comMedium 6.1
Jenkins OpenID Plugin 2.4 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins.
- Product
- Jenkins OpenID Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 21, 2023A Host Header Injection issue on the Login page of Plesk Obsidian through 18.0.49 allows attackers to redirect users to malicious websites via a Host request heCVE-2023-24044 · Websites & servers · Plesk · reported by MITREMedium 6.1
A Host Header Injection issue on the Login page of Plesk Obsidian through 18.0.49 allows attackers to redirect users to malicious websites via a Host request header. NOTE: the vendor's position is "the ability to use arbitrary domain names to access the panel is an intended feature."
- Product
- Obsidian
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.commedium.com
Jan 17, 2023Open redirect vulnerability in pgAdmin 4 versions prior to v6.14 allows a remote unauthenticated attacker to redirect a user to an arbitrary web site and conducCVE-2023-22298 · Other software · pgAdmin Project · reported by vultures@jpcert.or.jpMedium 6.1
Open redirect vulnerability in pgAdmin 4 versions prior to v6.14 allows a remote unauthenticated attacker to redirect a user to an arbitrary web site and conduct a phishing attack by having a user to access a specially crafted URL.
- Product
- pgAdmin 4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 16, 2023An authenticated attacker with update datasets permission could change a dataset link to an untrusted site, users could be redirected to this site when clickingCVE-2022-43721 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 5.4
An authenticated attacker with update datasets permission could change a dataset link to an untrusted site, users could be redirected to this site when clicking on that specific dataset. This issue affects Apache Superset version 1.5.2 and prior versions and version 2.0.0.
- Product
- Apache Superset
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orglists.apache.org
Jan 12, 2023An open redirect vulnerability exists in Okta OIDC Middleware prior to version 5.0.0 allowing an attacker to redirect a user to an arbitrary URL.CVE-2022-3145 · Other software · Okta · reported by psirt@okta.comMedium 4.7
An open redirect vulnerability exists in Okta OIDC Middleware prior to version 5.0.0 allowing an attacker to redirect a user to an arbitrary URL.
- Product
- Okta OIDC Middleware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 12, 2023Moodle Plugin - SAML Auth may allow Open Redirect through unspecified vectors.CVE-2022-39183 · Other software · Moodle Plugin - SAML Auth · reported by cna@cyber.gov.ilMedium 6.5
Moodle Plugin - SAML Auth may allow Open Redirect through unspecified vectors.
- Product
- Moodle Plugin - SAML Auth
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.