Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
2,137 results · page 21 of 43
Aug 23, 2022In Apache ActiveMQ Artemis prior to 2.24.0, an attacker could show malicious content and/or redirect users to a malicious URL in the web console by using HTML iCVE-2022-35278 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 6.1
In Apache ActiveMQ Artemis prior to 2.24.0, an attacker could show malicious content and/or redirect users to a malicious URL in the web console by using HTML in the name of an address or queue.
- Product
- Apache ActiveMQ Artemis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orgsecurity.netapp.com
Aug 22, 2022Python 3.x through 3.10 has an open redirection vulnerability in lib/http/server.py due to no protection against multiple (/) at the beginning of URI path whichCVE-2021-28861 · Other software · Siemens · reported by MITREHigh 7.4
Python 3.x through 3.10 has an open redirection vulnerability in lib/http/server.py due to no protection against multiple (/) at the beginning of URI path which may leads to information disclosure. NOTE: this is disputed by a third party because the http.server.html documentation page states "Warning: http.server is not recommended for production. It only implements basic security checks."
- Product
- SIMATIC S7-1500 CPU 1518-4 PN/DP MFP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.python.orggithub.com
Aug 22, 2022Pega Platform from 8.5.4 to 8.7.3 is affected by an XSS issue with an unauthenticated user and the redirect parameter.CVE-2022-35654 · Other software · Pegasystems · reported by security@pega.comMedium 6.1
Pega Platform from 8.5.4 to 8.7.3 is affected by an XSS issue with an unauthenticated user and the redirect parameter.
- Product
- Pega Infinity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.pega.comsupport.pega.com
Aug 16, 2022An open redirect vulnerability exists in CERT/CC VINCE software prior to 1.50.0.CVE-2022-25799 · Other software · CERT/CC · reported by cret@cert.orgMedium 6.1
An open redirect vulnerability exists in CERT/CC VINCE software prior to 1.50.0. An attacker could send a link that has a specially crafted URL and convince the user to click the link. When an authenticated user clicks the link, the authenticated user's browser could be redirected to a malicious site that is designed to impersonate a legitimate website. The attacker could trick the user and potentially acquire sensitive information such as the user's credentials.
- Product
- VINCE - The Vulnerability Information and Coordination Environment
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcheatsheetseries.owasp.orggithub.com
Aug 5, 2022Intent redirection vulnerability using implicit intent in Samsung email prior to version 6.1.70.20 allows attacker to get sensitive information.CVE-2022-36837 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 6.2
Intent redirection vulnerability using implicit intent in Samsung email prior to version 6.1.70.20 allows attacker to get sensitive information.
- Product
- Samsung email
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.comsecurity.samsungmobile.com
Jul 28, 2022Unauthenticated redirection to a malicious websiteCVE-2022-27509 · Other software · Citirx · reported by secure@citrix.comMedium 6.1
Unauthenticated redirection to a malicious website
- Product
- Citrix Application Delivery Management (Citrix ADC) and Citrix Gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.citrix.comsupport.citrix.com
Jul 26, 2022Open redirect vulnerability in Booked versions prior to 3.3 allows a remote unauthenticated attacker to redirect a user to an arbitrary web site and conduct a pCVE-2022-30706 · Other software · Twinkle Toes Software · reported by vultures@jpcert.or.jpMedium 6.1
Open redirect vulnerability in Booked versions prior to 3.3 allows a remote unauthenticated attacker to redirect a user to an arbitrary web site and conduct a phishing attack by having a user to access a specially crafted URL.
- Product
- Booked
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjvn.jpbookedscheduler.com
Jul 25, 2022An open redirect issue was found in Moodle due to improper sanitization of user-supplied data in mobile auto-login feature.CVE-2022-35652 · Other software · Moodle · reported by patrick@puiterwijk.orgMedium 6.1
An open redirect issue was found in Moodle due to improper sanitization of user-supplied data in mobile auto-login feature. A remote attacker can create a link that leads to a trusted website, however, when clicked, it redirects the victims to arbitrary URL/domain. Successful exploitation of this vulnerability may allow a remote attacker to perform a phishing attack and steal potentially sensitive information.
- Product
- Moodle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.moodle.orgbugzilla.redhat.com
Jul 21, 2022Authorization headers are cleared on cross-origin redirect.CVE-2022-31151 · Other software · nodejs · reported by GitHubLow 3.7
Authorization headers are cleared on cross-origin redirect. However, cookie headers which are sensitive headers and are official headers found in the spec, remain uncleared. There are active users using cookie headers in undici. This may lead to accidental leakage of cookie to a 3rd-party site or a malicious attacker who can control the redirection target (ie. an open redirector) to leak the cookie to the 3rd party site. This was patched in v5.7.1. By default, this vulnerability is not exploitable. Do not enable redirections, i.e. `maxRedirections: 0` (the default).
- Product
- undici
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2022Best Practical Request Tracker (RT) before 5.0.3 has an Open Redirect via a ticket search.CVE-2022-25803 · Other software · Bestpractical · reported by MITREMedium 6.1
Best Practical Request Tracker (RT) before 5.0.3 has an Open Redirect via a ticket search.
- Product
- Request Tracker
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.bestpractical.comdocs.bestpractical.com
Jul 12, 2022Intent redirection vulnerability using implict intent in Camera prior to versions 12.0.01.64 ,12.0.3.23, 12.0.0.98, 12.0.6.11, 12.0.3.19 in Android S(12) allowsCVE-2022-33712 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 5.3
Intent redirection vulnerability using implict intent in Camera prior to versions 12.0.01.64 ,12.0.3.23, 12.0.0.98, 12.0.6.11, 12.0.3.19 in Android S(12) allows attacker to get sensitive information.
- Product
- Camera
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.comsecurity.samsungmobile.com
Jul 6, 2022HTML injection vulnerability in secure messages of Devolutions Server before 2022.2 allows attackers to alter the rendering of the page or redirect a user to anCVE-2022-2316 · Other software · Devolutions · reported by security@devolutions.netMedium 5.4
HTML injection vulnerability in secure messages of Devolutions Server before 2022.2 allows attackers to alter the rendering of the page or redirect a user to another site.
- Product
- Devolutions Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddevolutions.netdevolutions.net
Jul 4, 2022Redirection for Contact Form 7: Does not escape a link generated before outputting it in an attributeCVE-2022-0250 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Redirection for Contact Form 7 WordPress plugin before 2.5.0 does not escape a link generated before outputting it in an attribute, leading to a Reflected Cross-Site Scripting
- Product
- Redirection for Contact Form 7
- Fixed in
- 2.5.0
- What to do
- Update Redirection for Contact Form 7 to 2.5.0 or newer.
Jul 1, 2022An open redirect vulnerability in GitLab EE/CE affecting all versions from 11.1 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1.1, allows an attaCVE-2022-2250 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 4.7
An open redirect vulnerability in GitLab EE/CE affecting all versions from 11.1 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1.1, allows an attacker to redirect users to an arbitrary location if they trust the URL.
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 29, 2022Open Redirect in GitHub repository microweber/microweber prior to 1.2.19.CVE-2022-2252 · Other software · microweber · reported by security@huntr.devMedium 6.1
Open Redirect in GitHub repository microweber/microweber prior to 1.2.19.
- Product
- microweber/microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 29, 2022ApiFest OAuth 2.0 Server 0.3.1 does not validate the redirect URI in accordance with RFC 6749 and is susceptible to an open redirector attack.CVE-2020-26877 · Other software · Apifest · reported by MITREMedium 6.1
ApiFest OAuth 2.0 Server 0.3.1 does not validate the redirect URI in accordance with RFC 6749 and is susceptible to an open redirector attack. Specifically, it directly sends an authorization code to the redirect URI submitted with the authorization request, without checking whether the redirect URI is registered by the client who initiated the request. This allows an attacker to craft a request with a manipulated redirect URI (redirect_uri parameter), which is under the attacker's control, and consequently obtain the leaked authorization code when the server redirects the client to the manipulated redirect URI with an authorization code. NOTE: this is similar to CVE-2019-3778.
- Product
- Oauth 2.0 Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 28, 2022In Nagios XI through 5.8.5, an open redirect vulnerability exists in the login function that could lead to spoofing.CVE-2022-29272 · Other software · Nagios · reported by MITREMedium 6.1
In Nagios XI through 5.8.5, an open redirect vulnerability exists in the login function that could lead to spoofing.
- Product
- Nagios XI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordassets.nagios.comgithub.com
Jun 26, 2022Open redirect vulnerability in web2py versions prior to 2.22.5 allows a remote attacker to redirect a user to an arbitrary web site and conduct a phishing attacCVE-2022-33146 · Other software · web2py · reported by vultures@jpcert.or.jpMedium 6.1
Open redirect vulnerability in web2py versions prior to 2.22.5 allows a remote attacker to redirect a user to an arbitrary web site and conduct a phishing attack by having a user to access a specially crafted URL.
- Product
- web2py
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 22, 2022In habitica versions v4.119.0 through v4.232.2 are vulnerable to open redirect via the login page.CVE-2022-23078 · Other software · habitica · reported by vulnerabilitylab@mend.ioMedium 5.8
In habitica versions v4.119.0 through v4.232.2 are vulnerable to open redirect via the login page.
- Product
- habitica
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 18, 2022The got package before 12.1.0 (also fixed in 11.8.5) for Node.js allows a redirect to a UNIX socket.CVE-2022-33987 · Other software · GOT Project · reported by MITREMedium 5.3
The got package before 12.1.0 (also fixed in 11.8.5) for Node.js allows a redirect to a UNIX socket.
- Product
- GOT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 17, 2022An issue was discovered in u5cms verion 8.3.5 There is a URL redirection vulnerability that can cause a user's browser to be redirected to another site via /logCVE-2022-32444 · Other software · Yuba · reported by MITREMedium 6.1
An issue was discovered in u5cms verion 8.3.5 There is a URL redirection vulnerability that can cause a user's browser to be redirected to another site via /loginsave.php.
- Product
- U5cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 2, 2022Caddy v2.4 was discovered to contain an open redirect vulnerability.CVE-2022-29718 · Other software · Caddyserver · reported by MITREMedium 6.1
Caddy v2.4 was discovered to contain an open redirect vulnerability. A remote unauthenticated attacker may exploit this vulnerability to redirect users to arbitrary web URLs by tricking the victim users to click on crafted links.
- Product
- Caddy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.fedoraproject.org
Jun 2, 2022A insufficiently protected credentials vulnerability in fixed in curl 7.83.0 might leak authentication or cookie header data on HTTP redirects to the same host CVE-2022-27776 · Other software · Siemens · reported by support@hackerone.comMedium 6.5
A insufficiently protected credentials vulnerability in fixed in curl 7.83.0 might leak authentication or cookie header data on HTTP redirects to the same host but another port number.
- Product
- SIMATIC S7-1500 CPU 1518-4 PN/DP MFP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhackerone.comlists.debian.org
Jun 2, 2022E-Series SANtricity OS Controller Software 11.x versions through 11.70.2 are vulnerable to host header injection attacks that could allow an attacker to redirecCVE-2022-23237 · Other software · Netapp · reported by security-alert@netapp.comMedium 6.1
E-Series SANtricity OS Controller Software 11.x versions through 11.70.2 are vulnerable to host header injection attacks that could allow an attacker to redirect users to malicious websites.
- Product
- E-series Santricity OS Controller
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.netapp.comsecurity.netapp.com
May 25, 2022go-getter up to 1.5.11 and 2.0.2 allowed protocol switching, endless redirect, and configuration bypass via abuse of custom HTTP response header processing.CVE-2022-26945 · Other software · Hashicorp · reported by MITRECritical 9.8
go-getter up to 1.5.11 and 2.0.2 allowed protocol switching, endless redirect, and configuration bypass via abuse of custom HTTP response header processing. Fixed in 1.6.1 and 2.1.0.
- Product
- Go-getter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddiscuss.hashicorp.comdiscuss.hashicorp.com
May 18, 2022Open redirect via user-controlled query parameter.CVE-2022-30992 · Other software · Acronis · reported by security@acronis.comMedium 6.1
Open redirect via user-controlled query parameter. The following products are affected: Acronis Cyber Protect 15 (Linux, Windows) before build 29240
- Product
- Acronis Cyber Protect 15
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity-advisory.acronis.comsecurity-advisory.acronis.com
May 12, 2022Sysaid – sysaid Open Redirect - An Attacker can change the redirect link at the parameter "redirectURL" from"GET" request from the url location: /CommunitySSOReCVE-2022-22797 · Other software · SysAid · reported by cna@cyber.gov.ilMedium 4.6
Sysaid – sysaid Open Redirect - An Attacker can change the redirect link at the parameter "redirectURL" from"GET" request from the url location: /CommunitySSORedirect.jsp?redirectURL=https://google.com. Unvalidated redirects and forwards are possible when a web application accepts untrusted input that could cause the web application to redirect the request to a URL contained within untrusted input. By modifying untrusted URL input to a malicious site, an attacker may successfully launch a phishing scam and steal user credentials.
- Product
- Sysaid
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 10, 2022In onEntryUpdated of OngoingCallController.kt, it is possible to launch non-exported activities due to intent redirection.CVE-2022-20116 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In onEntryUpdated of OngoingCallController.kt, it is possible to launch non-exported activities due to intent redirection. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12 Android-12LAndroid ID: A-212467440
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
May 10, 2022Ultimate Member: Arbitrary redirectsCVE-2022-1209 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Ultimate Member plugin for WordPress is vulnerable to arbitrary redirects due to insufficient validation on supplied URLs in the social fields of the Profile Page, which makes it possible for attackers to redirect unsuspecting victims in versions up to, and including, 2.3.1.
- Product
- Ultimate Member
- Affected
- up to 2.3.1
- What to do
- Affects up to 2.3.1. Update Ultimate Member to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 5, 2022An open redirect vulnerability has been reported to affect QNAP device running QuTScloud, QuTS hero and QTS.CVE-2021-44054 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twMedium 4.3
An open redirect vulnerability has been reported to affect QNAP device running QuTScloud, QuTS hero and QTS. If exploited, this vulnerability allows attackers to redirect users to an untrusted page that contains malware. We have already fixed this vulnerability in the following versions of QuTScloud, QuTS hero and QTS: QuTScloud c5.0.1.1949 and later QuTS hero h5.0.0.1949 build 20220215 and later QuTS hero h4.5.4.1951 build 20220218 and later QTS 5.0.0.1986 build 20220324 and later QTS 4.5.4.1991 build 20220329 and later
- Product
- QuTScloud
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 4, 2022In nopCommerce 4.50.1, an open redirect vulnerability can be triggered by luring a user to authenticate to a nopCommerce page by clicking on a crafted link.CVE-2022-27461 · Websites & servers · Nopcommerce · reported by MITREMedium 6.1
In nopCommerce 4.50.1, an open redirect vulnerability can be triggered by luring a user to authenticate to a nopCommerce page by clicking on a crafted link.
- Product
- Nopcommerce
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtf1t.gitbook.iotf1t.gitbook.io
May 2, 2022Potential open redirection vulnerability when URL is crafted in specific format in NetIQ Access Manager prior to 5.0.2CVE-2022-26326 · Other software · Micro Focus · reported by security@opentext.comMedium 4
Potential open redirection vulnerability when URL is crafted in specific format in NetIQ Access Manager prior to 5.0.2
- Product
- NetIQ Access Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmicrofocus.commicrofocus.com
Apr 25, 2022English WordPress Admin: Does not validate the admin_custom_language_return_url before redirecting users o itCVE-2021-25111 · WordPress plugins & themes · reported by WPScanMedium 6.1
The English WordPress Admin WordPress plugin before 1.5.2 does not validate the admin_custom_language_return_url before redirecting users o it, leading to an open redirect issue
- Product
- English WordPress Admin
- Fixed in
- 1.5.2
- What to do
- Update English WordPress Admin to 1.5.2 or newer.
Apr 21, 2022An intent redirection vulnerability in the Mi App Store product.CVE-2020-14118 · Other software · MI · reported by security@xiaomi.comMedium 6.1
An intent redirection vulnerability in the Mi App Store product. This vulnerability is caused by the Mi App Store does not verify the validity of the incoming data, can cause the app store to automatically download and install apps.
- Product
- MI App Store
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtrust.mi.comtrust.mi.com
Apr 21, 2022An intent redirection vulnerability in the Mi Browser product.CVE-2020-14116 · Other software · MI · reported by security@xiaomi.comHigh 7.5
An intent redirection vulnerability in the Mi Browser product. This vulnerability is caused by the Mi Browser does not verify the validity of the incoming data. Attackers can perform sensitive operations by exploiting this.
- Product
- MI Browser
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtrust.mi.comtrust.mi.com
Apr 20, 2022The CreateRedirect extension before 2022-04-14 for MediaWiki does not properly check whether the user has permissions to edit the target page.CVE-2022-29547 · Other software · Mediawiki · reported by MITREHigh 7.5
The CreateRedirect extension before 2022-04-14 for MediaWiki does not properly check whether the user has permissions to edit the target page. This could lead to an unauthorised (or blocked) user being able to edit a page.
- Product
- Createredirect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgerrit.wikimedia.orgphabricator.miraheze.org
Apr 20, 2022A URL redirection vulnerability in Skyhigh SWG in main releases 10.x prior to 10.2.9, 9.x prior to 9.2.20, 8.x prior to 8.2.27, and 7.x prior to 7.8.2.31, and cCVE-2022-1254 · Other software · McAfee,LLC · reported by trellixpsirt@trellix.comMedium 6.1
A URL redirection vulnerability in Skyhigh SWG in main releases 10.x prior to 10.2.9, 9.x prior to 9.2.20, 8.x prior to 8.2.27, and 7.x prior to 7.8.2.31, and controlled release 11.x prior to 11.1.3 allows a remote attacker to redirect a user to a malicious website controlled by the attacker. This is possible because SWG incorrectly creates a HTTP redirect response when a user clicks a carefully constructed URL. Following the redirect response, the new request is still filtered by the SWG policy.
- Product
- Secure Web Gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkc.mcafee.comkc.mcafee.com
Apr 19, 2022Automated Logic's WebCtrl Server Version 6.1 'Help' index pages are vulnerable to open redirection.CVE-2022-1019 · Other software · Automated Logic · reported by ics-cert@hq.dhs.govMedium 5.2
Automated Logic's WebCtrl Server Version 6.1 'Help' index pages are vulnerable to open redirection. The vulnerability allows an attacker to send a maliciously crafted URL which could result in redirecting the user to a malicious webpage or downloading a malicious file.
- Product
- WebCtrl Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcorporate.carrier.comcorporate.carrier.com
Apr 19, 2022HashiCorp Consul and Consul Enterprise up to 1.9.16, 1.10.9, and 1.11.4 may allow server side request forgery when the Consul client agent follows redirects retCVE-2022-29153 · Other software · Hashicorp · reported by MITREHigh 7.5
HashiCorp Consul and Consul Enterprise up to 1.9.16, 1.10.9, and 1.11.4 may allow server side request forgery when the Consul client agent follows redirects returned by HTTP health check endpoints. Fixed in 1.9.17, 1.10.10, and 1.11.5.
- Product
- Consul
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddiscuss.hashicorp.comdiscuss.hashicorp.com
Apr 19, 2022Open redirect vulnerability via endpoint authorize_and_redirect/?redirect= in GitHub repository posthog/posthog prior to 1.34.1.CVE-2022-0645 · Other software · posthog · reported by security@huntr.devMedium 6.1
Open redirect vulnerability via endpoint authorize_and_redirect/?redirect= in GitHub repository posthog/posthog prior to 1.34.1.
- Product
- posthog/posthog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 14, 2022An open redirect vulnerability in the administrative interface of the B.CVE-2020-25154 · Other software · B. Braun Melsungen AG · reported by ics-cert@hq.dhs.govMedium 5.4
An open redirect vulnerability in the administrative interface of the B. Braun Melsungen AG SpaceCom device Version L81/U61 and earlier, and the Data module compactplus Versions A10 and A11 allows attackers to redirect users to malicious websites.
- Product
- SpaceCom
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 12, 2022SAP NetWeaver ABAP Server and ABAP Platform - versions 740, 750, 787, allows an unauthenticated attacker to redirect users to a malicious site due to insufficieCVE-2022-28215 · Network & remote access · SAP SE · reported by cna@sap.comMedium 4.7
SAP NetWeaver ABAP Server and ABAP Platform - versions 740, 750, 787, allows an unauthenticated attacker to redirect users to a malicious site due to insufficient URL validation. This could lead to the user being tricked to disclose personal information.
- Product
- SAP NetWeaver ABAP Server and ABAP Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlaunchpad.support.sap.comsap.com
Apr 6, 2022OrangeHRM 4.10 is vulnerable to a Host header injection redirect via viewPersonalDetails endpoint.CVE-2022-27110 · Other software · Orangehrm · reported by MITREMedium 5.4
OrangeHRM 4.10 is vulnerable to a Host header injection redirect via viewPersonalDetails endpoint.
- Product
- Orangehrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2022OrangeHRM 4.10 suffers from a Referer header injection redirect vulnerability.CVE-2022-27109 · Other software · Orangehrm · reported by MITREMedium 5.4
OrangeHRM 4.10 suffers from a Referer header injection redirect vulnerability.
- Product
- Orangehrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 5, 2022Open redirect vulnerability in objects/login.json.php in WWBN AVideo through 11.6, allows attackers to arbitrarily redirect users from a crafted url to the logiCVE-2022-27463 · Other software · Wwbn · reported by MITREMedium 6.1
Open redirect vulnerability in objects/login.json.php in WWBN AVideo through 11.6, allows attackers to arbitrarily redirect users from a crafted url to the login page.
- Product
- Avideo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 5, 2022An intent redirection issue was doscovered in Sina Weibo Android SDK 4.2.7 (com.sina.weibo.sdk.share.WbShareTransActivity), any unexported Activities could be sCVE-2020-23349 · Other software · Weibo · reported by MITREHigh 7.5
An intent redirection issue was doscovered in Sina Weibo Android SDK 4.2.7 (com.sina.weibo.sdk.share.WbShareTransActivity), any unexported Activities could be started by the com.sina.weibo.sdk.share.WbShareTransActivity.
- Product
- Android Software Development KIT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 29, 2022Archer 6.x through 6.9 P2 (6.9.0.2) is affected by an open redirect vulnerability.CVE-2022-26950 · Other software · RSA · reported by MITREMedium 5.4
Archer 6.x through 6.9 P2 (6.9.0.2) is affected by an open redirect vulnerability. A remote unprivileged attacker may potentially redirect legitimate users to arbitrary web sites and conduct phishing attacks. The attacker could then steal the victims' credentials and silently authenticate them to the Archer application without the victims realizing an attack occurred.
- Product
- Archer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarcherirm.communityarcherirm.community
Mar 28, 2022Mapping Multiple URLs Redirect Same Page: Does not sanitize and escape the mmursp_id parameter before outputting it back in an admin pageCVE-2022-0599 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Mapping Multiple URLs Redirect Same Page WordPress plugin through 5.8 does not sanitize and escape the mmursp_id parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting.
- Product
- Mapping Multiple URLs Redirect Same Page
- Affected
- up to 5.8
- What to do
- Affects up to 5.8. Update Mapping Multiple URLs Redirect Same Page to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 24, 2022Open Redirect on login in GitHub repository go-gitea/gitea prior to 1.16.5.CVE-2022-1058 · Other software · go-gitea · reported by security@huntr.devMedium 6.1
Open Redirect on login in GitHub repository go-gitea/gitea prior to 1.16.5.
- Product
- go-gitea/gitea
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 21, 2022Cscms Music Portal System v4.2 was discovered to contain a redirection vulnerability via the backurl parameter.CVE-2022-27090 · Other software · Chshcms · reported by MITREMedium 5.4
Cscms Music Portal System v4.2 was discovered to contain a redirection vulnerability via the backurl parameter.
- Product
- Cscms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.