Weaknesses of type CWE-601

1,279 results

Redirecionamento aberto para site não confiável

É quando uma aplicação redireciona o usuário para uma URL fornecida por ele (ou por um atacante) sem validação prévia. O navegador segue o redirecionamento automaticamente, levando a vítima para um site malicioso que pode clonar a interface legítima para roubar credenciais ou distribuir malware, com aparência de vir de um domínio confiável.

Example

Um link do tipo `https://banco.com/redirect?url=https://banco-falso.com` recebe a URL de destino como parâmetro e redireciona direto sem checagem. Atacante envia `https://banco.com/redirect?url=https://phishing.com` em email, e a vítima clica pensando estar acessando o banco.

How to mitigate

Valide sempre a URL de destino contra uma lista branca de domínios permitidos ou use URLs relativas. Se aceitar redirecionamentos dinâmicos, verifique que o host pertence ao seu domínio ou a uma lista explícita de parceiros confiáveis.

CVE-2024-56972MEDIUMAn issue in Midea Group Co., Ltd Midea Home iOS 9.3.12 allows attackers to access sensitive user information via supplying a crafted link.EPSS 0.3%CVE-2024-56953MEDIUMAn issue in Baidu (China) Co Ltd Baidu Input Method (iOS version) v12.6.13 allows attackers to access user information via supplying a craftEPSS 0.3%CVE-2026-23818HIGHOpen Redirect Vulnerability in HPE Aruba Networking Private 5G Core On-PremEPSS 0.3%CVE-2024-56952MEDIUMAn issue in Beijing Baidu Netcom Science & Technology Co Ltd Baidu Lite app (iOS version) 6.40.0 allows attackers to access user informationEPSS 0.3%CVE-2026-92141MEDIUMJenkins Keycloak Authentication Plugin 2.4.1 and earlier does not restrict the redirect URL after login, allowing attackers to perform phishEPSS 0.3%CVE-2026-61078HIGHVulnerability in the PeopleSoft Enterprise CC Common Application Objects product of Oracle PeopleSoft (component: Common Application ObjectsEPSS 0.3%CVE-2024-56963MEDIUMAn issue in Beijing Sogou Technology Development Co., Ltd Sogou Input iOS 12.2.0 allows attackers to access sensitive user information via sEPSS 0.3%CVE-2024-56964MEDIUMAn issue in Che Hao Duo Used Automobile Agency (Beijing) Co., Ltd Guazi Used Car iOS 10.15.1 allows attackers to access sensitive user inforEPSS 0.3%CVE-2024-49706MEDIUMXSS in iKSORISEPSS 0.3%CVE-2024-56947MEDIUMAn issue in Xiamen Meitu Technology Co., Ltd. BeautyCam iOS v12.3.60 allows attackers to access sensitive user information via supplying a cEPSS 0.3%CVE-2025-28896MEDIUMWordPress AS English Admin plugin <= 1.0.0 - Open Redirection vulnerabilityEPSS 0.3%CVE-2026-115537MEDIUMgedelumbung HospitalManagement URL Validation routing_pages.php simpan redirectEPSS 0.3%CVE-2023-31229MEDIUMWordPress WP Directory Kit Plugin <= 1.1.9 is vulnerable to Open RedirectionEPSS 0.3%CVE-2026-118180HIGHMatrix homeserver could redirect the chat session to a local file or network shareEPSS 0.3%CVE-2024-44776MEDIUMAn Open Redirect vulnerability in the page parameter of vTiger CRM v7.4.0 allows attackers to redirect users to a malicious site via a craftEPSS 0.3%CVE-2026-46806HIGHVulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). The supported version that EPSS 0.3%CVE-2026-115196MEDIUMAn Open Redirect vulnerability exists in the public form submission endpoint (/form/submit) of Mautic. After a form is submitted, the applicEPSS 0.3%CVE-2022-44718LOWAn issue was discovered in NetScout nGeniusONE 6.3.2 build 904. Open Redirection can occur (issue 2 of 2). After successful login, an attackEPSS 0.3%CVE-2026-86823MEDIUMNewsletter < 9.3.7 - Unauthenticated Open Redirect and Subscriber Token Disclosure via ncu ParameterEPSS 0.3%CVE-2025-30953MEDIUMWordPress WP Gravity Forms Salesforce plugin <= 1.4.7 - Open Redirection VulnerabilityEPSS 0.3%