Weaknesses of type CWE-601

1,187 results

Redirecionamento aberto para site não confiável

É quando uma aplicação redireciona o usuário para uma URL fornecida por ele (ou por um atacante) sem validação prévia. O navegador segue o redirecionamento automaticamente, levando a vítima para um site malicioso que pode clonar a interface legítima para roubar credenciais ou distribuir malware, com aparência de vir de um domínio confiável.

Example

Um link do tipo `https://banco.com/redirect?url=https://banco-falso.com` recebe a URL de destino como parâmetro e redireciona direto sem checagem. Atacante envia `https://banco.com/redirect?url=https://phishing.com` em email, e a vítima clica pensando estar acessando o banco.

How to mitigate

Valide sempre a URL de destino contra uma lista branca de domínios permitidos ou use URLs relativas. Se aceitar redirecionamentos dinâmicos, verifique que o host pertence ao seu domínio ou a uma lista explícita de parceiros confiáveis.

CVE-2025-2824HIGHIBM Operational Decision Manager HTTP open redirectEPSS 0.3%CVE-2026-46806HIGHVulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). The supported version that EPSS 0.3%CVE-2024-44776MEDIUMAn Open Redirect vulnerability in the page parameter of vTiger CRM v7.4.0 allows attackers to redirect users to a malicious site via a craftEPSS 0.3%CVE-2024-54728MEDIUMIncorrect access control in BYD QIN PLUS DM-i Dilink OS 3.0_13.1.7.2204050.1 allows unauthorized attackers to access system logcat logs.EPSS 0.3%CVE-2022-44718LOWAn issue was discovered in NetScout nGeniusONE 6.3.2 build 904. Open Redirection can occur (issue 2 of 2). After successful login, an attackEPSS 0.3%CVE-2025-59426MEDIUMlobe-chat has an Open RedirectEPSS 0.3%CVE-2025-39404MEDIUMWordPress Sassy Social Share plugin <= 3.3.73 - Open Redirection vulnerabilityEPSS 0.3%CVE-2026-29067HIGHZITADEL: Account Takeover Due to Improper Instance Validation in V2 LoginEPSS 0.3%CVE-2024-38037MEDIUMBUG-000167983 - Unvalidated redirect in Portal for ArcGISEPSS 0.3%CVE-2026-22560MEDIUMAn open redirect vulnerability in Rocket.Chat versions prior to 8.4.0 allows users to be redirected to arbitrary URLs by manipulating parameEPSS 0.3%CVE-2025-21401MEDIUMMicrosoft Edge (Chromium-based) Security Feature Bypass VulnerabilityEPSS 0.3%CVE-2025-6238HIGHAI Engine 2.8.4 - Insecure OAuth ImplementationEPSS 0.3%CVE-2024-8148MEDIUMBUG-000168624 - Unvalidated redirect in Portal for ArcGIS. (11.2, 11.1, 10.9.1. and 10.8.1)EPSS 0.3%CVE-2024-56964MEDIUMAn issue in Che Hao Duo Used Automobile Agency (Beijing) Co., Ltd Guazi Used Car iOS 10.15.1 allows attackers to access sensitive user inforEPSS 0.3%CVE-2024-56957MEDIUMAn issue in Kingsoft Office Software Corporation Limited WPS Office iOS 12.20.0 allows attackers to access sensitive user information via suEPSS 0.3%CVE-2024-56965MEDIUMAn issue in Shanghai Shizhi Information Technology Co., Ltd Shihuo iOS 8.16.0 allows attackers to access sensitive user information via suppEPSS 0.3%CVE-2025-34504MEDIUMKodExplorer 4.52 Open Redirect Vulnerability via User Login EndpointEPSS 0.3%CVE-2024-56951MEDIUMAn issue in Hangzhou Bobo Technology Co Ltd UU Game Booster iOS 10.6.13 allows attackers to access sensitive user information via supplying EPSS 0.3%CVE-2024-56948MEDIUMAn issue in KuGou Technology CO. LTD KuGou Music iOS v20.0.0 allows attackers to access sensitive user information via supplying a crafted lEPSS 0.3%CVE-2024-56955MEDIUMAn issue in Tencent Technology (Shenzhen) Company Limited QQMail iOS 6.6.4 allows attackers to access sensitive user information via supplyiEPSS 0.3%