Total
1137 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2020-18985 | 1 Synacor | 1 Zimbra Collaboration Suite | 2024-11-21 | 5.8 MEDIUM | 6.1 MEDIUM |
| An issue in /domain/service/.ewell-known/caldav of Zimbra Collaboration 8.8.12 allows attackers to redirect users to any arbitrary website of their choosing. | |||||
| CVE-2020-18660 | 1 Get-simple | 1 Getsimplecms | 2024-11-21 | 5.8 MEDIUM | 6.1 MEDIUM |
| GetSimpleCMS <=3.3.15 has an open redirect in admin/changedata.php via the redirect function to the url parameter. | |||||
| CVE-2020-18268 | 1 Zblogcn | 1 Z-blogphp | 2024-11-21 | 5.8 MEDIUM | 6.1 MEDIUM |
| Open Redirect in Z-BlogPHP v1.5.2 and earlier allows remote attackers to obtain sensitive information via the "redirect" parameter in the component "zb_system/cmd.php." | |||||
| CVE-2020-17484 | 1 Uffizio | 1 Gps Tracker | 2024-11-21 | N/A | 6.1 MEDIUM |
| An Open Redirection vulnerability exists in Uffizio's GPS Tracker all versions allows an attacker to construct a URL within the application that causes a redirection to an arbitrary external domain. | |||||
| CVE-2020-15677 | 3 Debian, Mozilla, Opensuse | 5 Debian Linux, Firefox, Firefox Esr and 2 more | 2024-11-21 | 5.8 MEDIUM | 6.1 MEDIUM |
| By exploiting an Open Redirect vulnerability on a website, an attacker could have spoofed the site displayed in the download file dialog to show the original site (the one suffering from the open redirect) rather than the site the file was actually downloaded from. This vulnerability affects Firefox < 81, Thunderbird < 78.3, and Firefox ESR < 78.3. | |||||
| CVE-2020-15300 | 1 Salesagility | 1 Suitecrm | 2024-11-21 | 5.8 MEDIUM | 6.1 MEDIUM |
| SuiteCRM through 7.11.13 has an Open Redirect in the Documents module via a crafted SVG document. | |||||
| CVE-2020-15242 | 1 Vercel | 1 Next.js | 2024-11-21 | 5.8 MEDIUM | 4.7 MEDIUM |
| Next.js versions >=9.5.0 and <9.5.4 are vulnerable to an Open Redirect. Specially encoded paths could be used with the trailing slash redirect to allow an open redirect to occur to an external site. In general, this redirect does not directly harm users although can allow for phishing attacks by redirecting to an attackers domain from a trusted domain. The issue is fixed in version 9.5.4. | |||||
| CVE-2020-15241 | 1 Typo3 | 2 Fluid Engine, Typo3 | 2024-11-21 | 4.3 MEDIUM | 4.7 MEDIUM |
| TYPO3 Fluid Engine (package `typo3fluid/fluid`) before versions 2.0.5, 2.1.4, 2.2.1, 2.3.5, 2.4.1, 2.5.5 or 2.6.1 is vulnerable to cross-site scripting when making use of the ternary conditional operator in templates like `{showFullName ? fullName : defaultValue}`. Updated versions of this package are bundled in following TYPO3 (`typo3/cms-core`) versions as well: TYPO3 v8.7.25 (using `typo3fluid/fluid` v2.5.4) and TYPO3 v9.5.6 (using `typo3fluid/fluid` v2.6.1). | |||||
| CVE-2020-15234 | 1 Ory | 1 Fosite | 2024-11-21 | 4.9 MEDIUM | 6.1 MEDIUM |
| ORY Fosite is a security first OAuth2 & OpenID Connect framework for Go. In Fosite before version 0.34.1, the OAuth 2.0 Client's registered redirect URLs and the redirect URL provided at the OAuth2 Authorization Endpoint where compared using strings.ToLower while they should have been compared with a simple string match. This allows an attacker to register a client with allowed redirect URL https://example.com/callback. Then perform an OAuth2 flow and requesting redirect URL https://example.com/CALLBACK. Instead of an error (invalid redirect URL), the browser is redirected to https://example.com/CALLBACK with a potentially successful OAuth2 response, depending on the state of the overall OAuth2 flow (the user might still deny the request for example). This vulnerability has been patched in ORY Fosite v0.34.1. | |||||
| CVE-2020-15233 | 1 Ory | 1 Fosite | 2024-11-21 | 4.9 MEDIUM | 6.1 MEDIUM |
| ORY Fosite is a security first OAuth2 & OpenID Connect framework for Go. In Fosite from version 0.30.2 and before version 0.34.1, there is an issue in which an an attacker can override the registered redirect URL by performing an OAuth flow and requesting a redirect URL that is to the loopback adapter. Attackers can provide both custom URL query parameters to their loopback redirect URL, as well as actually overriding the host of the registered redirect URL. These attacks are only applicable in scenarios where the attacker has access over the loopback interface. This vulnerability has been patched in ORY Fosite v0.34.1. | |||||
| CVE-2020-15129 | 1 Traefik | 1 Traefik | 2024-11-21 | 4.0 MEDIUM | 6.1 MEDIUM |
| In Traefik before versions 1.7.26, 2.2.8, and 2.3.0-rc3, there exists a potential open redirect vulnerability in Traefik's handling of the "X-Forwarded-Prefix" header. The Traefik API dashboard component doesn't validate that the value of the header "X-Forwarded-Prefix" is a site relative path and will redirect to any header provided URI. Successful exploitation of an open redirect can be used to entice victims to disclose sensitive information. Active Exploitation of this issue is unlikely as it would require active header injection, however the Traefik team addressed this issue nonetheless to prevent abuse in e.g. cache poisoning scenarios. | |||||
| CVE-2020-14454 | 1 Mattermost | 1 Mattermost Desktop | 2024-11-21 | 5.8 MEDIUM | 6.1 MEDIUM |
| An issue was discovered in Mattermost Desktop App before 4.4.0. Attackers can open web pages in the desktop application because server redirection is mishandled, aka MMSA-2020-0008. | |||||
| CVE-2020-14446 | 1 Wso2 | 2 Identity Server, Identity Server As Key Manager | 2024-11-21 | 5.8 MEDIUM | 6.1 MEDIUM |
| An issue was discovered in WSO2 Identity Server through 5.10.0 and WSO2 IS as Key Manager through 5.10.0. An open redirect exists. | |||||
| CVE-2020-14118 | 1 Mi | 1 Mi App Store | 2024-11-21 | 5.8 MEDIUM | 6.1 MEDIUM |
| An intent redirection vulnerability in the Mi App Store product. This vulnerability is caused by the Mi App Store does not verify the validity of the incoming data, can cause the app store to automatically download and install apps. | |||||
| CVE-2020-13662 | 1 Drupal | 1 Drupal | 2024-11-21 | 5.8 MEDIUM | 6.1 MEDIUM |
| Open Redirect vulnerability in Drupal Core allows a user to be tricked into visiting a specially crafted link which would redirect them to an arbitrary external URL. This issue affects: Drupal Drupal Core 7 version 7.70 and prior versions. | |||||
| CVE-2020-13565 | 2 Open-emr, Phpgacl Project | 2 Openemr, Phpgacl | 2024-11-21 | 5.8 MEDIUM | 6.1 MEDIUM |
| An open redirect vulnerability exists in the return_page redirection functionality of phpGACL 3.3.7, OpenEMR 5.0.2 and OpenEMR development version 6.0.0 (commit babec93f600ff1394f91ccd512bcad85832eb6ce). A specially crafted HTTP request can redirect users to an arbitrary URL. An attacker can provide a crafted URL to trigger this vulnerability. | |||||
| CVE-2020-13486 | 1 Verbb | 1 Knock Knock | 2024-11-21 | 5.8 MEDIUM | 6.1 MEDIUM |
| The Knock Knock plugin before 1.2.8 for Craft CMS allows malicious redirection. | |||||
| CVE-2020-13121 | 1 Rcos | 1 Submitty | 2024-11-21 | 5.8 MEDIUM | 6.1 MEDIUM |
| Submitty through 20.04.01 has an open redirect via authentication/login?old= during an invalid login attempt. | |||||
| CVE-2020-12699 | 1 Dkd | 1 Direct Mail | 2024-11-21 | 5.8 MEDIUM | 6.1 MEDIUM |
| The direct_mail extension through 5.2.3 for TYPO3 has an Open Redirect via jumpUrl. | |||||
| CVE-2020-12666 | 2 Fedoraproject, Go-macaron | 2 Fedora, Macaron | 2024-11-21 | 5.8 MEDIUM | 6.1 MEDIUM |
| macaron before 1.3.7 has an open redirect in the static handler, as demonstrated by the http://127.0.0.1:4000//example.com/ URL. | |||||