#cwe-601

共收录 381 条相关情报。

← 返回所有主题
漏洞预警2026-10-12 发布INFO

OAuth1 callback validation vulnerability in Apache Allura. This issue affects Apache Allura: through 1.21.0. Users are recommended to upgrade to version 1.22.0, which fixe...

CVE-2026-92116

OAuth1 callback validation vulnerability in Apache Allura. This issue affects Apache Allura: through 1.21.0. Users

历史摘要 · 未重新核验 · NVD

漏洞预警2026-10-12 发布INFO

HoloViz Panel from 1.2.2 before 1.9.0 contains an open redirect vulnerability in panel/auth.py that allows remote attackers to redirect users by supplying an unvalidated next qu...

CVE-2024-58389

HoloViz Panel from 1.2.2 before 1.9.0 contains an open redirect vulnerability in panel/auth.py that allows remote attack

历史摘要 · 未重新核验 · NVD

漏洞预警2026-10-09 发布INFO

Tina is a headless content management system. Prior to tinacms 3.14.0 and @tinacms/app 2.5.14, the /~/* admin preview route in packages/tinacms/src/admin/index.tsx can turn an a...

CVE-2026-108261

Tina is a headless content management system. Prior to tinacms 3.14.0 and @tinacms/app 2.5.14, the /~/* admin preview ro

历史摘要 · 未重新核验 · NVD

安全公告2026-10-09 发布INFO

TinaCMS admin preview iframe loads an attacker-controlled origin from the URL fragment

CVE-2026-108261

### Summary The TinaCMS admin builds its preview `` from the `/~/*` hash-router splat without checking that the value s

历史摘要 · 未重新核验 · GitHub Advisory

漏洞预警2026-10-09 发布INFO

Apache CXF’s OIDC relying-party component could redirect users to an attacker-controlled URL after successful authentication. The issue occurs because attacker-controlled state ...

CVE-2026-79650

Apache CXF’s OIDC relying-party component could redirect users to an attacker-controlled URL after successful authentica

历史摘要 · 未重新核验 · NVD

漏洞预警2026-10-08 发布INFO

AdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS framework. Prior to 8.2.3 and 9.3.0, AdonisJS HTTP Server inserts route parameter values into URLs w...

CVE-2026-107718

AdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS framework. Prior to 8.2.3 and 9.3.0, Adonis

历史摘要 · 未重新核验 · NVD

安全公告2026-10-08 发布INFO

AdonisJS: Unencoded route parameters can produce open redirects

CVE-2026-107718

Route parameters are inserted into generated URLs without URI encoding. When an application passes untrusted input to a

历史摘要 · 未重新核验 · GitHub Advisory

安全公告2026-10-08 发布INFO

AdonisJS: Unencoded route parameters can produce open redirects

CVE-2026-107718

AdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS framework. Prior to 8.2.3 and 9.3.0, Adonis

历史摘要 · 未重新核验 · OSV.dev

漏洞预警2026-10-06 发布INFO

Insufficient validation in the Single Sign-On (SSO) login flow could allow a remote, unauthenticated attacker to craft a URL that, when clicked by a user, causes the identity pr...

CVE-2026-101152

Insufficient validation in the Single Sign-On (SSO) login flow could allow a remote, unauthenticated attacker to craft a

历史摘要 · 未重新核验 · NVD

漏洞预警2026-10-06 发布INFO

Insufficient validation of request in login flow could allow a remote, unauthenticated attacker to craft a URL that, when clicked by a user, redirects the user's browser to an a...

CVE-2026-101151

Insufficient validation of request in login flow could allow a remote, unauthenticated attacker to craft a URL that, whe

历史摘要 · 未重新核验 · NVD

漏洞预警2026-10-06 发布INFO

Open redirect in AppManifest in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page....

CVE-2026-106322

Open redirect in AppManifest in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social enginee

历史摘要 · 未重新核验 · NVD

漏洞预警2026-10-06 发布INFO

Payload is a free and open source headless content management system. In versions from 3.40.0 before 3.88.0 and canary versions before 4.0.0-canary.27, an attacker can craft a r...

CVE-2026-105846

Payload is a free and open source headless content management system. In versions from 3.40.0 before 3.88.0 and canary v

历史摘要 · 未重新核验 · NVD

安全公告2026-10-06 发布INFO

Payload: Untrusted redirect URL parameter exploit

CVE-2026-105846

### Impact Under certain conditions, an attacker can craft a redirect link that sends a guest user to an untrusted desti

历史摘要 · 未重新核验 · GitHub Advisory

漏洞预警2026-10-06 发布INFO

An open redirect vulnerability exists in the PingGateway Fragment Filter feature. This issue affects PingGateway versions 7.1.0 and later, 2023.2.0 through 2024.11.1, and 2025.3...

CVE-2026-80327

An open redirect vulnerability exists in the PingGateway Fragment Filter feature. This issue affects PingGateway version

历史摘要 · 未重新核验 · NVD

漏洞预警2026-10-05 发布INFO

Joomla Extension - svenbluege.de - Cross-site scripting and open redirect on the share mini page in Event Gallery extension < 6.6.0 - The page a shared image link opens (the sha...

CVE-2026-102778

Joomla Extension - svenbluege.de - Cross-site scripting and open redirect on the share mini page in Event Gallery extens

历史摘要 · 未重新核验 · NVD

安全公告2026-10-04 发布INFO

LaraDashboard before 1.4.8 contains an open redirect vulnerability that allows remote attackers...

CVE-2026-105128

LaraDashboard before 1.4.8 contains an open redirect vulnerability that allows remote attackers to redirect users by sup

历史摘要 · 未重新核验 · GitHub Advisory

漏洞预警2026-10-04 发布MEDIUM

LaraDashboard before 1.4.8 contains an open redirect vulnerability that allows remote attackers to redirect users by supplying an unvalidated redirect_url parameter to EmailTemp...

CVE-2026-105128

CVE-2026-105128 是 LaraDashboard 1.4.8 之前版本中存在的一个开放重定向(Open Redirect)漏洞。该项目的邮件模板管理功能由 EmailTemplateController 实现,其中 build

历史摘要 · 未重新核验 · NVD

漏洞预警2026-10-02 发布INFO

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Mehul Gohil Aculect AI Companion aculect-ai-companion allows Phishing.This issue affects Aculect AI Companio...

CVE-2026-39600

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Mehul Gohil Aculect AI Companion aculect-ai-compani

历史摘要 · 未重新核验 · NVD

漏洞预警2026-10-02 发布INFO

The Giveaways and Contests by RafflePress WordPress plugin before 1.12.27 does not properly validate a giveaway's parent page URL before saving it and later redirecting visitor...

CVE-2026-97318

The Giveaways and Contests by RafflePress WordPress plugin before 1.12.27 does not properly validate a giveaway's paren

历史摘要 · 未重新核验 · NVD

漏洞预警2026-10-01 发布INFO

OpenRun is an open-source, self-hosted GitOps platform for deploying web apps and internal tools to Docker or Kubernetes. Prior to version 0.17.7, the restrictions on redirect U...

CVE-2026-55252

OpenRun is an open-source, self-hosted GitOps platform for deploying web apps and internal tools to Docker or Kubernetes

历史摘要 · 未重新核验 · NVD