Weaknesses of type CWE-601

1,296 results

Redirecionamento aberto para site não confiável

É quando uma aplicação redireciona o usuário para uma URL fornecida por ele (ou por um atacante) sem validação prévia. O navegador segue o redirecionamento automaticamente, levando a vítima para um site malicioso que pode clonar a interface legítima para roubar credenciais ou distribuir malware, com aparência de vir de um domínio confiável.

Example

Um link do tipo `https://banco.com/redirect?url=https://banco-falso.com` recebe a URL de destino como parâmetro e redireciona direto sem checagem. Atacante envia `https://banco.com/redirect?url=https://phishing.com` em email, e a vítima clica pensando estar acessando o banco.

How to mitigate

Valide sempre a URL de destino contra uma lista branca de domínios permitidos ou use URLs relativas. Se aceitar redirecionamentos dinâmicos, verifique que o host pertence ao seu domínio ou a uma lista explícita de parceiros confiáveis.

CVE-2024-12561MEDIUMAffiliate Sales in Google Analytics and other tools <= 2.0.0 - Open RedirectEPSS 0.4%CVE-2022-1230LOWThis vulnerability allows local attackers to execute arbitrary code on affected installations of Samsung Galaxy S21 prior to 4.5.40.5 phonesEPSS 0.4%CVE-2023-39371HIGH StarTrinity Softswitch version 2023-02-16 – Open Redirect (CWE-601)EPSS 0.4%CVE-2026-7364LOWSecurity vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify AccessEPSS 0.4%CVE-2023-1279LOWURL Redirection to Untrusted Site in GitLabEPSS 0.4%CVE-2023-23860MEDIUMSAP NetWeaver AS for ABAP and ABAP Platform - versions 740, 750, 751, 752, 753, 754, 755, 756, 757, 789, 790, allows an unauthenticated attaEPSS 0.4%CVE-2024-25609MEDIUMHtmlUtil.escapeRedirect in Liferay Portal 7.2.0 through 7.4.3.12, and older unsupported versions, and Liferay DXP 7.4 before update 9, 7.3 sEPSS 0.4%CVE-2026-46796HIGHVulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites). Supported versions that are aEPSS 0.4%CVE-2023-28786LOWWordPress Solid Security Plugin <= 8.1.4 is vulnerable to Open RedirectionEPSS 0.4%CVE-2024-8412MEDIUMLinuxOSsk Shakal-NG views.py redirectEPSS 0.4%CVE-2026-48589NONEApache Shiro: Jakarta EE open redirect via untrusted Referer in post-login redirect flowEPSS 0.4%CVE-2026-12863MEDIUMOpen redirectEPSS 0.4%CVE-2025-59426MEDIUMlobe-chat has an Open RedirectEPSS 0.4%CVE-2026-27738MEDIUMAngular SSR has an Open Redirect via X-Forwarded-PrefixEPSS 0.4%CVE-2025-27143MEDIUMBeter Auth has an Open Redirect via Scheme-Less Callback ParameterEPSS 0.4%CVE-2023-23853MEDIUMAn unauthenticated attacker in AP NetWeaver Application Server for ABAP and ABAP Platform - versions 700, 702, 731, 740, 750, 751, 752, 753,EPSS 0.3%CVE-2026-48784MEDIUMSymfony: UrlGenerator Dot-Segment Encoding Skips Every Other Chained `../` or `./` → Generated URL Collapses Off-Route Under RFC 3986 NormalizationEPSS 0.3%CVE-2023-22418MEDIUMBIG-IP APM virtual server vulnerabilityEPSS 0.3%CVE-2026-45065LOWSymfony: UrlGenerator Route-Requirement Bypass via Unanchored Regex Alternation → Off-Site //host URL InjectionEPSS 0.3%CVE-2023-20884MEDIUMVMware Workspace ONE Access and VMware Identity Manager contain an insecure redirect vulnerability. An unauthenticated malicious actor may bEPSS 0.3%