Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
2,137 results · page 23 of 43
Dec 1, 2021showdoc is vulnerable to URL Redirection to Untrusted SiteCVE-2021-3989 · Other software · star7th · reported by security@huntr.devMedium 6.1
showdoc is vulnerable to URL Redirection to Untrusted Site
- Product
- star7th/showdoc
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 30, 2021An open redirect through HTML injection in confidential messages in Cryptshare before 5.1.0 allows remote attackers (with permission to provide confidential mesCVE-2021-42564 · Other software · Cryptshare · reported by MITREMedium 5.4
An open redirect through HTML injection in confidential messages in Cryptshare before 5.1.0 allows remote attackers (with permission to provide confidential messages via Cryptshare) to redirect targeted victims to any URL via the '<meta http-equiv="refresh"' substring in the editor parameter.
- Product
- Cryptshare Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 18, 2021A remote authenticated attacker with write access to a PI Server could trick a user into interacting with a PI Web API endpoint and redirect them to a maliciousCVE-2021-43549 · Other software · OSIsoft · reported by ics-cert@hq.dhs.govMedium 6.9
A remote authenticated attacker with write access to a PI Server could trick a user into interacting with a PI Web API endpoint and redirect them to a malicious website. As a result, a victim may disclose sensitive information to the attacker or be provided with false information.
- Product
- PI Web API
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordus-cert.cisa.govus-cert.cisa.gov
Nov 18, 2021A flaw was discovered in Puppet Agent and Puppet Server that may result in a leak of HTTP credentials when following HTTP redirects to a different host.CVE-2021-27023 · Other software · Puppet · reported by security@puppet.comCritical 9.8
A flaw was discovered in Puppet Agent and Puppet Server that may result in a leak of HTTP credentials when following HTTP redirects to a different host. This is similar to CVE-2018-1000007
- Product
- Puppet Agent
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.fedoraproject.orgpuppet.com
Nov 17, 2021QR Redirector: Does not sanitise and escape some of the QR Redirect fieldsCVE-2021-24854 · WordPress plugins & themes · reported by WPScanMedium 5.4
The QR Redirector WordPress plugin before 1.6.1 does not sanitise and escape some of the QR Redirect fields, which could allow users with a role as low as Contributor perform Stored Cross-Site Scripting attacks.
- Product
- QR Redirector
- Fixed in
- 1.6.1
- What to do
- Update QR Redirector to 1.6.1 or newer.
Nov 17, 2021QR Redirector: Does not have capability and CSRF checksCVE-2021-24853 · WordPress plugins & themes · reported by WPScanMedium 4.3
The QR Redirector WordPress plugin before 1.6 does not have capability and CSRF checks when saving bulk QR Redirector settings via the qr_save_bulk AJAX action, which could allow any authenticated user, such as subscriber to change the redirect response status code of arbitrary QR Redirects
- Product
- QR Redirector
- Fixed in
- 1.6
- What to do
- Update QR Redirector to 1.6 or newer.
Nov 17, 2021The importFromRedirection AJAX action of the SEO Redirection Plugin – 301 Redirect Manager WordPress plugin before 8.2, available to any authenticated user, doeCVE-2021-24847 · WordPress plugins & themes · reported by WPScanHigh 8.8
The importFromRedirection AJAX action of the SEO Redirection Plugin – 301 Redirect Manager WordPress plugin before 8.2, available to any authenticated user, does not properly sanitise the offset parameter before using it in a SQL statement, leading an SQL injection when the redirection plugin is also installed
- Product
- SEO Redirection Plugin – 301 Redirect Manager
- Fixed in
- 8.2
- What to do
- Update SEO Redirection Plugin – 301 Redirect Manager to 8.2 or newer.
Nov 15, 2021This vulnerability could allow an attacker to send malicious Javascript code resulting in hijacking of the user’s cookie/session tokens, redirecting the user toCVE-2021-42703 · Other software · Advantech · reported by ics-cert@hq.dhs.govMedium 5.4
This vulnerability could allow an attacker to send malicious Javascript code resulting in hijacking of the user’s cookie/session tokens, redirecting the user to a malicious webpage, and performing unintended browser action.
- Product
- HMI Designer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordus-cert.cisa.govus-cert.cisa.gov
Nov 9, 2021A potential security vulnerability has been identified for certain HP printers and MFPs that would allow redirection page Cross-Site Scripting in a client’s broCVE-2019-18914 · Other software · HP · reported by hp-security-alert@hp.comMedium 6.1
A potential security vulnerability has been identified for certain HP printers and MFPs that would allow redirection page Cross-Site Scripting in a client’s browser by clicking on a third-party malicious link.
- Product
- Futuresmart 3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hp.comsupport.hp.com
Nov 8, 2021WP SEO Redirect 301: Does not have CSRF in placeCVE-2021-24832 · WordPress plugins & themes · reported by WPScanMedium 4.3
The WP SEO Redirect 301 WordPress plugin before 2.3.2 does not have CSRF in place when deleting redirects, which could allow attackers to make a logged in admin delete them via a CSRF attack
- Product
- WP SEO Redirect 301
- Fixed in
- 2.3.2
- What to do
- Update WP SEO Redirect 301 to 2.3.2 or newer.
Nov 8, 2021Redirect 404 Error Page to Homepage or Custom Page with Logs: Does not check for CSRFCVE-2021-24767 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Redirect 404 Error Page to Homepage or Custom Page with Logs WordPress plugin before 1.7.9 does not check for CSRF when deleting logs, which could allow attacker to make a logged in admin delete them via a CSRF attack
- Product
- Redirect 404 Error Page to Homepage or Custom Page with Logs
- Fixed in
- 1.7.9
- What to do
- Update Redirect 404 Error Page to Homepage or Custom Page with Logs to 1.7.9 or newer.
Nov 8, 2021404 to 301 – Redirect, Log and Notify 404 Errors: Does not have CSRF check in placeCVE-2021-24766 · WordPress plugins & themes · reported by WPScanMedium 6.5
The 404 to 301 – Redirect, Log and Notify 404 Errors WordPress plugin before 3.0.9 does not have CSRF check in place when cleaning the logs, which could allow attacker to make a logged in admin delete all of them via a CSRF attack
- Product
- 404 to 301 – Redirect, Log and Notify 404 Errors
- Fixed in
- 3.0.9
- What to do
- Update 404 to 301 – Redirect, Log and Notify 404 Errors to 3.0.9 or newer.
Nov 4, 2021Intent redirection vulnerability in Group Sharing prior to 10.8.03.2 allows attacker to access contact information.CVE-2021-25504 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 4
Intent redirection vulnerability in Group Sharing prior to 10.8.03.2 allows attacker to access contact information.
- Product
- Group Sharing
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.comsecurity.samsungmobile.com
Nov 4, 2021A vulnerability in the web-based management interface of Cisco Webex Video Mesh could allow an unauthenticated, remote attacker to redirect a user to a maliciouCVE-2021-1500 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 5.4
A vulnerability in the web-based management interface of Cisco Webex Video Mesh could allow an unauthenticated, remote attacker to redirect a user to a malicious web page. This vulnerability is due to improper input validation of the URL parameters in an HTTP request. An attacker could exploit this vulnerability by persuading a user to click a crafted link. A successful exploit could allow the attacker to redirect a user to a malicious website. Attackers may use this type of vulnerability, known as an open redirect attack, as part of a phishing attack to persuade users to unknowingly visit malicious sites.
- Product
- Cisco Webex Video Mesh
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtools.cisco.comtools.cisco.com
Nov 1, 2021An open redirect vulnerability exists in Replicated Classic versions prior to 2.53.1 that could lead to spoofing.CVE-2021-43058 · Other software · Replicated · reported by security@replicated.comMedium 6.1
An open redirect vulnerability exists in Replicated Classic versions prior to 2.53.1 that could lead to spoofing. To exploit this vulnerability, an attacker could send a link that has a specially crafted URL and convince the user to click the link, redirecting the user to an untrusted site.
- Product
- Replicated Classic
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordreplicated.comreplicated.com
Oct 19, 2021firefly-iii is vulnerable to URL Redirection to Untrusted SiteCVE-2021-3851 · Other software · firefly-iii · reported by security@huntr.devMedium 5.4
firefly-iii is vulnerable to URL Redirection to Untrusted Site
- Product
- firefly-iii/firefly-iii
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 18, 2021A possible open redirect vulnerability in the Host Authorization middleware in Action Pack >= 6.0.0 that could allow attackers to redirect users to a malicious CVE-2021-22942 · Other software · Rubyonrails · reported by support@hackerone.comMedium 6.1
A possible open redirect vulnerability in the Host Authorization middleware in Action Pack >= 6.0.0 that could allow attackers to redirect users to a malicious website.
- Product
- Rails
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comsecurity.netapp.com
Oct 14, 2021A redirect vulnerability in the `fastify-static` module version >= 4.2.4 and < 4.4.1 allows remote attackers to redirect Mozilla Firefox users to arbitrary websCVE-2021-22964 · Other software · Fastify · reported by support@hackerone.comHigh 8.8
A redirect vulnerability in the `fastify-static` module version >= 4.2.4 and < 4.4.1 allows remote attackers to redirect Mozilla Firefox users to arbitrary websites via a double slash `//` followed by a domain: `http://localhost:3000//a//youtube.com/%2e%2e%2f%2e%2e`.A DOS vulnerability is possible if the URL contains invalid characters `curl --path-as-is "http://localhost:3000//^/.."`The issue shows up on all the `fastify-static` applications that set `redirect: true` option. By default, it is `false`.
- Product
- Fastify-static
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhackerone.comhackerone.com
Oct 14, 2021A redirect vulnerability in the fastify-static module version < 4.2.4 allows remote attackers to redirect users to arbitrary websites via a double slash // follCVE-2021-22963 · Other software · Fastify · reported by support@hackerone.comMedium 6.1
A redirect vulnerability in the fastify-static module version < 4.2.4 allows remote attackers to redirect users to arbitrary websites via a double slash // followed by a domain: http://localhost:3000//google.com/%2e%2e.The issue shows up on all the fastify-static applications that set redirect: true option. By default, it is false.
- Product
- Fastify-static
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhackerone.comhackerone.com
Oct 13, 2021VMware vRealize Orchestrator ((8.x prior to 8.6) contains an open redirect vulnerability due to improper path handling.CVE-2021-22036 · Other software · VMware · reported by security@vmware.comMedium 6.5
VMware vRealize Orchestrator ((8.x prior to 8.6) contains an open redirect vulnerability due to improper path handling. A malicious actor may be able to redirect victim to an attacker controlled domain due to improper path handling in vRealize Orchestrator leading to sensitive information disclosure.
- Product
- Vrealize Automation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2021Open redirect vulnerability in Cybozu Remote Service 3.0.0 to 3.1.9 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attackCVE-2021-20806 · Other software · Cybozu, Inc. · reported by vultures@jpcert.or.jpMedium 6.1
Open redirect vulnerability in Cybozu Remote Service 3.0.0 to 3.1.9 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.
- Product
- Cybozu Remote Service
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjvn.jpkb.cybozu.support
Oct 12, 2021A Host Header Redirection vulnerability in SonicOS potentially allows a remote attacker to redirect firewall management users to arbitrary web domains.CVE-2021-20031 · Network & remote access · SonicWall · reported by PSIRT@sonicwall.comMedium 6.1
A Host Header Redirection vulnerability in SonicOS potentially allows a remote attacker to redirect firewall management users to arbitrary web domains.
- Product
- SonicOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.compsirt.global.sonicwall.com
Oct 6, 2021A vulnerability in the web-based management interface of Cisco Orbital could allow an unauthenticated, remote attacker to redirect users to a malicious webpage.CVE-2021-34772 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 4.7
A vulnerability in the web-based management interface of Cisco Orbital could allow an unauthenticated, remote attacker to redirect users to a malicious webpage. This vulnerability is due to improper validation of URL paths in the web-based management interface. An attacker could exploit this vulnerability by persuading a user to click a crafted URL. A successful exploit could allow the attacker to redirect a user to a malicious website. This vulnerability, known as an open redirect attack, is used in phishing attacks to persuade users to visit malicious sites.
- Product
- Cisco Orbital
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtools.cisco.comtools.cisco.com
Oct 6, 2021Intent redirection vulnerability in SamsungAccountSDKSigninActivity of Galaxy Store prior to version 4.5.32.4 allows attacker to access content provider of GalaCVE-2021-25499 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comHigh 7.1
Intent redirection vulnerability in SamsungAccountSDKSigninActivity of Galaxy Store prior to version 4.5.32.4 allows attacker to access content provider of Galaxy Store.
- Product
- Galaxy Store
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.comsecurity.samsungmobile.com
Sep 30, 2021NETSCOUT Systems nGeniusONE version 6.3.0 build 1196 allows URL redirection in redirector.CVE-2021-35205 · Other software · Netscout · reported by MITREMedium 5.4
NETSCOUT Systems nGeniusONE version 6.3.0 build 1196 allows URL redirection in redirector.
- Product
- Ngeniusone
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnetscout.comnetscout.com
Sep 29, 2021PlaceOS Authentication Service before 1.29.10.0 allows app/controllers/auth/sessions_controller.rb open redirect.CVE-2021-41826 · Other software · Place · reported by MITREMedium 6.1
PlaceOS Authentication Service before 1.29.10.0 allows app/controllers/auth/sessions_controller.rb open redirect.
- Product
- Placeos Authentication
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Sep 20, 2021Edit domain functionality in the WP Domain Redirect: Has an `editid` parameterCVE-2021-24401 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Edit domain functionality in the WP Domain Redirect WordPress plugin through 1.0 has an `editid` parameter which is not sanitised, escaped or validated before inserting to a SQL statement, leading to SQL injection.
- Product
- Edit domain functionality in the WP Domain Redirect
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Edit domain functionality in the WP Domain Redirect to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodevigilant.comwpscan.com
Sep 15, 2021Under certain conditions, SAP BusinessObjects Business Intelligence Platform (SAPUI5), versions - 420, 430, can allow an unauthenticated attacker to redirect usCVE-2021-33697 · Network & remote access · SAP SE · reported by cna@sap.comMedium 6.1
Under certain conditions, SAP BusinessObjects Business Intelligence Platform (SAPUI5), versions - 420, 430, can allow an unauthenticated attacker to redirect users to a malicious site due to Reverse Tabnabbing vulnerabilities.
- Product
- SAP BusinessObjects Business Intelligence Platform (SAPUI5)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlaunchpad.support.sap.comwiki.scn.sap.com
Sep 15, 2021Windows Redirected Drive Buffering SubSystem Driver Information Disclosure VulnerabilityCVE-2021-38636 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.5
Windows Redirected Drive Buffering SubSystem Driver Information Disclosure Vulnerability
- Product
- Windows 10 Version 1507
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
Sep 15, 2021Windows Redirected Drive Buffering SubSystem Driver Information Disclosure VulnerabilityCVE-2021-38635 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.5
Windows Redirected Drive Buffering SubSystem Driver Information Disclosure Vulnerability
- Product
- Windows 10 Version 1507
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
Sep 15, 2021Windows Redirected Drive Buffering System Elevation of Privilege VulnerabilityCVE-2021-36973 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Windows Redirected Drive Buffering System Elevation of Privilege Vulnerability
- Product
- Windows 10 Version 1507
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
Sep 15, 2021Windows Redirected Drive Buffering SubSystem Driver Information Disclosure VulnerabilityCVE-2021-36969 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.5
Windows Redirected Drive Buffering SubSystem Driver Information Disclosure Vulnerability
- Product
- Windows 10 Version 1507
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
Sep 14, 2021On version 14.1.x before 14.1.4.4 and all versions of 13.1.x, an open redirect vulnerability exists on virtual servers enabled with a BIG-IP APM access policy.CVE-2021-23052 · Network & remote access · F5 · reported by f5sirt@f5.comMedium 6.1
On version 14.1.x before 14.1.4.4 and all versions of 13.1.x, an open redirect vulnerability exists on virtual servers enabled with a BIG-IP APM access policy. This vulnerability allows an unauthenticated malicious user to build an open redirect URI. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
- Product
- Big-ip Access Policy Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.f5.comsupport.f5.com
Sep 13, 2021Open Redirection vulnerability in NetIQ Access Manager prior to 5.0.1 and 4.5.4CVE-2021-22526 · Other software · Micro Focus · reported by security@opentext.comMedium 4.9
Open Redirection vulnerability in NetIQ Access Manager prior to 5.0.1 and 4.5.4
- Product
- NetIQ Access Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.microfocus.commicrofocus.com
Sep 7, 2021EyouCMS 1.5.4 is vulnerable to Open Redirect.CVE-2021-39501 · Other software · Eyoucms · reported by MITREMedium 6.1
EyouCMS 1.5.4 is vulnerable to Open Redirect. An attacker can redirect a user to a malicious url via the Logout function.
- Product
- Eyoucms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 7, 2021Open Redirect vulnerability in Micro Focus Network Automation, affecting Network Automation versions 10.4x, 10.5x, 2018.05, 2018.11, 2019.05, 2020.02, 2020.08, CVE-2021-38123 · Other software · Microfocus · reported by security@opentext.comMedium 6.1
Open Redirect vulnerability in Micro Focus Network Automation, affecting Network Automation versions 10.4x, 10.5x, 2018.05, 2018.11, 2019.05, 2020.02, 2020.08, 2020.11, 2021.05. The vulnerability could allow redirect users to malicious websites after authentication.
- Product
- Network Automation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordportal.microfocus.comportal.microfocus.com
Sep 6, 2021A security issue was discovered in Kubernetes where a user may be able to redirect pod traffic to private networks on a Node.CVE-2021-25737 · Other software · Kubernetes · reported by jordan@liggitt.netLow 2.7
A security issue was discovered in Kubernetes where a user may be able to redirect pod traffic to private networks on a Node. Kubernetes already prevents creation of Endpoint IPs in the localhost or link-local range, but the same validation was not performed on EndpointSlice IPs.
- Product
- Kubernetes
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comgroups.google.com
Aug 30, 2021The Nested Pages WordPress plugin <= 3.1.15 was vulnerable to an Open Redirect via the `page` POST parameter in the `npBulkActions`, `npBulkEdit`, `npListingSorCVE-2021-38343 · WordPress plugins & themes · reported by WordfenceMedium 4.7
The Nested Pages WordPress plugin <= 3.1.15 was vulnerable to an Open Redirect via the `page` POST parameter in the `npBulkActions`, `npBulkEdit`, `npListingSort`, and `npCategoryFilter` `admin_post` actions.
- Product
- Nested Pages
- Affected
- up to 3.1.15
- What to do
- Affects up to 3.1.15. Update Nested Pages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordfence.comwordfence.com
Aug 24, 2021Affected versions of Atlassian Jira Server and Data Center allow remote attackers to redirect users to a malicious URL via a reverse tabnapping vulnerability inCVE-2021-39112 · Websites & servers · Atlassian · reported by security@atlassian.comMedium 4.8
Affected versions of Atlassian Jira Server and Data Center allow remote attackers to redirect users to a malicious URL via a reverse tabnapping vulnerability in the Project Shortcuts feature. The affected versions are before version 8.5.15, from version 8.6.0 before 8.13.7, from version 8.14.0 before 8.17.1, and from version 8.18.0 before 8.18.1.
- Product
- Jira Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjira.atlassian.comjira.atlassian.com
Aug 16, 2021Custom Login Redirect: Does not have CSRF check in placeCVE-2021-24536 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Custom Login Redirect WordPress plugin through 1.0.0 does not have CSRF check in place when saving its settings, and do not sanitise or escape user input before outputting them back in the page, leading to a Stored Cross-Site Scripting issue
- Product
- Custom Login Redirect
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Custom Login Redirect to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 13, 2021An open redirect vulnerability exists in Nagios XI before version 5.8.5 that could lead to spoofing.CVE-2021-37352 · Other software · Nagios · reported by MITREMedium 6.1
An open redirect vulnerability exists in Nagios XI before version 5.8.5 that could lead to spoofing. To exploit the vulnerability, an attacker could send a link that has a specially crafted URL and convince the user to click the link.
- Product
- Nagios XI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2021UAA server versions prior to 75.4.0 are vulnerable to an open redirect vulnerability.CVE-2021-22098 · Other software · Cloudfoundry · reported by security@vmware.comMedium 6.1
UAA server versions prior to 75.4.0 are vulnerable to an open redirect vulnerability. A malicious user can exploit the open redirect vulnerability by social engineering leading to take over of victims’ accounts in certain cases along with redirection of UAA users to a malicious sites.
- Product
- Cf-deployment
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcloudfoundry.orgcloudfoundry.org
Aug 10, 2021SAP NetWeaver Knowledge Management allows remote attackers to redirect users to arbitrary websites and conduct phishing attacks via a URL stored in a component.CVE-2021-33707 · Network & remote access · SAP SE · reported by cna@sap.comMedium 6.1
SAP NetWeaver Knowledge Management allows remote attackers to redirect users to arbitrary websites and conduct phishing attacks via a URL stored in a component. This could enable the attacker to compromise the user's confidentiality and integrity.
- Product
- SAP NetWeaver (Knowledge Management)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Aug 5, 2021A flaw was found in the USB redirector device emulation of QEMU in versions prior to 6.1.0-rc2.CVE-2021-3682 · Other software · Qemu · reported by Red HatHigh 8.5
A flaw was found in the USB redirector device emulation of QEMU in versions prior to 6.1.0-rc2. It occurs when dropping packets during a bulk transfer from a SPICE client due to the packet queue being full. A malicious SPICE client could use this flaw to make QEMU call free() with faked heap chunk metadata, resulting in a crash of QEMU or potential code execution with the privileges of the QEMU process on the host.
- Product
- Qemu
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.redhat.comlists.debian.org
Aug 3, 2021Open redirect vulnerability in the Notifications module in Liferay Portal 7.0.0 through 7.3.1, and Liferay DXP 7.0 before fix pack 94, 7.1 before fix pack 19 anCVE-2021-33331 · Other software · Liferay · reported by MITREMedium 6.1
Open redirect vulnerability in the Notifications module in Liferay Portal 7.0.0 through 7.3.1, and Liferay DXP 7.0 before fix pack 94, 7.1 before fix pack 19 and 7.2 before fix pack 8, allows remote attackers to redirect users to arbitrary external URLs via the 'redirect' parameter.
- Product
- Digital Experience Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordissues.liferay.comportal.liferay.dev
Aug 3, 2021Dell EMC iDRAC9 versions prior to 4.40.40.00 contain an open redirect vulnerability.CVE-2021-21579 · Other software · Dell · reported by security_alert@emc.comMedium 6.1
Dell EMC iDRAC9 versions prior to 4.40.40.00 contain an open redirect vulnerability. A remote unauthenticated attacker may exploit this vulnerability to redirect users to arbitrary web URLs by tricking the victim users to click on maliciously crafted links.
- Product
- Integrated Dell Remote Access Controller (iDRAC)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 3, 2021Dell EMC iDRAC9 versions prior to 4.40.40.00 contain an open redirect vulnerability.CVE-2021-21578 · Other software · Dell · reported by security_alert@emc.comMedium 6.1
Dell EMC iDRAC9 versions prior to 4.40.40.00 contain an open redirect vulnerability. A remote unauthenticated attacker may exploit this vulnerability to redirect users to arbitrary web URLs by tricking the victim users to click on maliciously crafted links.
- Product
- Integrated Dell Remote Access Controller (iDRAC)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 2, 2021User Registration & User Profile – Profile Builder: Does not sanitise or escape its 'Modify default Redirect Delay timer' settingCVE-2021-24448 · WordPress plugins & themes · reported by WPScanMedium 4.8
The User Registration & User Profile – Profile Builder WordPress plugin before 3.4.8 does not sanitise or escape its 'Modify default Redirect Delay timer' setting, allowing high privilege users to use JavaScript code in it, even when the unfiltered_html capability is disallowed, leading to an authenticated Stored Cross-Site Scripting issue
- Product
- User Registration & User Profile – Profile Builder
- Fixed in
- 3.4.8
- What to do
- Update User Registration & User Profile – Profile Builder to 3.4.8 or newer.
Jul 30, 2021Open redirect vulnerability in GroupSession (GroupSession Free edition from ver2.2.0 to the version prior to ver5.1.0, GroupSession byCloud from ver3.0.3 to theCVE-2021-20789 · Other software · Japan Total System Co.,Ltd. · reported by vultures@jpcert.or.jpMedium 6.1
Open redirect vulnerability in GroupSession (GroupSession Free edition from ver2.2.0 to the version prior to ver5.1.0, GroupSession byCloud from ver3.0.3 to the version prior to ver5.1.0, and GroupSession ZION from ver3.0.3 to the version prior to ver5.1.0) allows a remote attacker to redirect a user to an arbitrary web site and conduct a phishing attack via a specially crafted URL.
- Product
- GroupSession
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 29, 2021Dell EMC Avamar Server contains an open redirect vulnerability.CVE-2020-5329 · Other software · Dell · reported by security_alert@emc.comMedium 6.1
Dell EMC Avamar Server contains an open redirect vulnerability. A remote unauthenticated attacker may exploit this vulnerability to redirect application users to arbitrary web URLs by tricking the victim users to click on maliciously crafted links.
- Product
- Avamar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.