Weaknesses of type CWE-601

1,277 results

Redirecionamento aberto para site não confiável

É quando uma aplicação redireciona o usuário para uma URL fornecida por ele (ou por um atacante) sem validação prévia. O navegador segue o redirecionamento automaticamente, levando a vítima para um site malicioso que pode clonar a interface legítima para roubar credenciais ou distribuir malware, com aparência de vir de um domínio confiável.

Example

Um link do tipo `https://banco.com/redirect?url=https://banco-falso.com` recebe a URL de destino como parâmetro e redireciona direto sem checagem. Atacante envia `https://banco.com/redirect?url=https://phishing.com` em email, e a vítima clica pensando estar acessando o banco.

How to mitigate

Valide sempre a URL de destino contra uma lista branca de domínios permitidos ou use URLs relativas. Se aceitar redirecionamentos dinâmicos, verifique que o host pertence ao seu domínio ou a uma lista explícita de parceiros confiáveis.

CVE-2026-23818HIGHOpen Redirect Vulnerability in HPE Aruba Networking Private 5G Core On-PremEPSS 0.3%CVE-2024-25676MEDIUMAn issue was discovered in ViewerJS 0.5.8. A script from the component loads content via URL TAGs without properly sanitizing it. This leadsEPSS 0.3%CVE-2026-92141MEDIUMJenkins Keycloak Authentication Plugin 2.4.1 and earlier does not restrict the redirect URL after login, allowing attackers to perform phishEPSS 0.3%CVE-2024-56971MEDIUMAn issue in Zhiyuan Yuedu (Guangzhou) Literature Information Technology Co., Ltd Shuqi Novel iOS 5.3.8 allows attackers to access sensitive EPSS 0.3%CVE-2024-56966MEDIUMAn issue in Shanghai Xuan Ting Entertainment Information & Technology Co., Ltd Qidian Reader iOS 5.9.384 allows attackers to access sensitivEPSS 0.3%CVE-2018-25245HIGH7 Tik 1.0.1.0 Denial of Service via SearchEPSS 0.3%CVE-2024-56953MEDIUMAn issue in Baidu (China) Co Ltd Baidu Input Method (iOS version) v12.6.13 allows attackers to access user information via supplying a craftEPSS 0.3%CVE-2024-56967MEDIUMAn issue in Cloud Whale Interactive Technology LLC. PolyBuzz iOS 2.0.20 allows attackers to access sensitive user information via supplying EPSS 0.3%CVE-2024-56968MEDIUMAn issue in Shenzhen Intellirocks Tech Co. Ltd Govee Home iOS 6.5.01 allows attackers to access sensitive user information via supplying a cEPSS 0.3%CVE-2024-56964MEDIUMAn issue in Che Hao Duo Used Automobile Agency (Beijing) Co., Ltd Guazi Used Car iOS 10.15.1 allows attackers to access sensitive user inforEPSS 0.3%CVE-2024-56949MEDIUMAn issue in Guangzhou Polar Future Culture Technology Co., Ltd University Search iOS 2.27.0 allows attackers to access sensitive user informEPSS 0.3%CVE-2024-56962MEDIUMAn issue in Tencent Technology (Shanghai) Co., Ltd WeSing iOS v9.3.39 allows attackers to access sensitive user information via supplying a EPSS 0.3%CVE-2024-49706MEDIUMXSS in iKSORISEPSS 0.3%CVE-2024-56959MEDIUMAn issue in Mashang Consumer Finance Co., Ltd Anyihua iOS 3.6.2 allows attackers to access sensitive user information via supplying a crafteEPSS 0.3%CVE-2024-56957MEDIUMAn issue in Kingsoft Office Software Corporation Limited WPS Office iOS 12.20.0 allows attackers to access sensitive user information via suEPSS 0.3%CVE-2026-60945HIGHVulnerability in the Oracle Learning Management product of Oracle E-Business Suite (component: Internal Operations). Supported versions thaEPSS 0.3%CVE-2024-56960MEDIUMAn issue in Tianjin Xiaowu Information technology Co., Ltd BeiKe Holdings iOS 1.3.50 allows attackers to access sensitive user information vEPSS 0.3%CVE-2024-56955MEDIUMAn issue in Tencent Technology (Shenzhen) Company Limited QQMail iOS 6.6.4 allows attackers to access sensitive user information via supplyiEPSS 0.3%CVE-2026-61078HIGHVulnerability in the PeopleSoft Enterprise CC Common Application Objects product of Oracle PeopleSoft (component: Common Application ObjectsEPSS 0.3%CVE-2024-56952MEDIUMAn issue in Beijing Baidu Netcom Science & Technology Co Ltd Baidu Lite app (iOS version) 6.40.0 allows attackers to access user informationEPSS 0.3%