ansulev/circl-vulnerability-scores huggingface dataset:
GHSA-5923-r76v-mprm: Open Redirect Vulnerability in Taguette
SummaryAn Open Redirect vulnerability exists in Taguette that allows attackers to craft malicious URLs that redirect users to arbitrary external websites after authentication. This can be exploited for phishing attacks where victims believe they are interacting with a trusted Taguette instance but are redirected to a malicious site designed to steal credentials or deliver malware.**Severity:** Medium to HighDetailsThe application accepts a user-controlled `next` parameter and uses it directly in HTTP redirects without any validation. The vulnerable code is located in two places:Location 1: Login Handler (`taguette/web/views.py`, lines 140-144)This method is called after successful login (line 132) and when an already-logged-in user visits the login page (line 109).Location 2: Cookies Prompt Handler (`taguette/web/views.py`, lines 79-85)In both cases, if `next_` is provided by the user, it is passed directly to `self.redirect()` without checking whether it points to the same host or is a relative URL.[![pic](https://github.com/user-attachments/assets/ac0afe1f-a8ac-4ac0-88f5-1c2cd092ca46)](url)PoCSimply replace `[your-taguette-instance]` with your Taguette server domain and test these URLs in your browser:Test 1: Cookies Prompt RedirectOpen the URL above in your browserClick "Accept cookies" button**Result:** You are redirected to `https://google.com` (external site)Test 2: Login RedirectOpen the URL above in your browserLog in with valid credentials**Result:** You are redirected to `https://google.com` (external site)Test 3: Already Logged In RedirectFirst, log in to Taguette normallyThen open the URL above**Result:** You are immediately redirected to `https://google.com`**Note:** We use `google.com` as a safe external site for testing. In a real attack, this would be a phishing site.Impact**Who is affected:** All users of any Taguette instance running in multi-user mode**Attack vector:** Social engineering / phishing via crafted URLs**Exploitability:** Trivial - requires only crafting a URL with a malicious `next` parameter**Consequences:**Credential theft through phishingMalware distributionSession hijackingReputation damage to organizations running Taguette instancesThe vulnerability is particularly dangerous because:The login page displayed is completely legitimate, building victim trustUsers have just entered their credentials, making them more likely to enter them again on a fake "session expired" pageThe trusted domain in the URL makes the attack more convincingRecommended FixValidate that the `next` parameter is either a relative URL or points to the same host before redirecting.Example FixAdd a validation function:Then update the vulnerable methods:Apply the same fix to the `CookiesPrompt.post()` method.
CVSS v3.1: 5.4
GHSA-pxpj-pwq4-m64x: VestaCP 0.9.8-26 contains a session token vulnerability in the LoginAs module that allows remote attackers to manipulate authentication tokens. Attackers can exploit insufficient token validation to access user accounts and perform unauthorized login requests without proper administrative permissions.
CVSS v4.0: 8.7
CVSS v3.1: 9.8
CVE-2007-6145: Unspecified vulnerability in Hitachi JP1/File Transmission Server/FTP 01-00 through 08-10-01 allows remote attackers to bypass authentication and "view files" via unspecified vectors.
CVSS v2.0: 5
CVE-2023-6862: A use-after-free was identified in the `nsDNSService::Init`.  This issue appears to manifest rarely during start-up. This vulnerability affects Firefox ESR < 115.6 and Thunderbird < 115.6.
CVSS v3.1: 8.8
GHSA-m499-6c75-m93w: SQL injection vulnerability in the Joomtracker (com_joomtracker) 1.01 module for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a tordetails action to index.php.
GHSA-29wg-wxfh-x4cx: Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-1773, CVE-2014-1783, CVE-2014-1784, CVE-2014-1786, CVE-2014-1795, CVE-2014-2758, CVE-2014-2759, CVE-2014-2765, CVE-2014-2766, and CVE-2014-2775.
CVE-2017-13843: An issue was discovered in certain Apple products. macOS before 10.13.1 is affected. The issue involves the "Kernel" component. It allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.
CVSS v3.0: 7.8
CVSS v2.0: 9.3
CVE-2024-38531: Nix sandbox escape
Nix is a package manager for Linux and other Unix systems that makes package management reliable and reproducible. A build process has access to and can change the permissions of the build directory. After creating a setuid binary in a globally accessible location, a malicious local user can assume the permissions of a Nix daemon worker and hijack all future builds. This issue was patched in version(s) 2.23.1, 2.22.2, 2.21.3, 2.20.7, 2.19.5 and 2.18.4.
CVSS v3.1: 3.6
CVE-2022-20126: In setScanMode of AdapterService.java, there is a possible way to enable Bluetooth discovery mode without user interaction due to a missing permission check. This could lead to local escalation of privilege with User execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12LAndroid ID: A-203431023
CVSS v3.1: 7.3
CVSS v2.0: 6.9
CVE-2025-54754: Cognex In-Sight Explorer and In-Sight Camera Firmware Use of Hard-coded Password
An attacker with adjacent access, without authentication, can exploit 
this vulnerability to retrieve a hard-coded password embedded in 
publicly available software. This password can then be used to decrypt 
sensitive network traffic, affecting the Cognex device.
CVSS v4.0: 8.6
CVSS v3.1: 8
CVE-2006-0714: Directory traversal vulnerability in the installation file (sql/install-0.9.7.php) in Flyspray 0.9.7 allows remote attackers to include arbitrary files via a .. (dot dot) sequence in the adodbpath parameter.
CVSS v2.0: 5
CVE-2006-2312: Argument injection vulnerability in the URI handler in Skype 2.0.*.104 and 2.5.*.0 through 2.5.*.78 for Windows allows remote authorized attackers to download arbitrary files via a URL that contains certain command-line switches.
CVSS v2.0: 2.6
GHSA-5w28-r2fh-vv76: Windows Remote Procedure Call Service (RPCSS) Elevation of Privilege Vulnerability
CVSS v3.1: 8.8
GHSA-vgq7-9r5r-j9v3: Free5GC is vulnerable to DoS through its Npcf_BDTPolicyControl POST API
An issue was discovered in Free5GC v4.0.0 and v4.0.1 allowing an attacker to cause a denial of service via crafted POST request to the Npcf_BDTPolicyControl API.
CVSS v3.1: 6.5
GHSA-2mc8-x568-88x3: The External Media WordPress plugin before 1.0.36 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVSS v3.1: 4.8
GHSA-gx3r-m27w-v3g4: A buffer overflow was addressed with improved bounds checking. This issue is fixed in macOS Catalina 10.15.2, Security Update 2019-002 Mojave, and Security Update 2019-007 High Sierra. An attacker in a privileged position may be able to perform a denial of service attack.
RHSA-2024:9983: Red Hat Security Advisory: RHOSP 17.1.4 (python-webob) security update
webob: WebOb's location header normalization during redirect leads to open redirect
CVSS v3.1: 6.1
GHSA-56qv-9p9c-2q4v: Dell EMC Avamar Client Manager in Dell EMC Avamar Server versions 7.2.0, 7.2.1, 7.3.0, 7.3.1, 7.4.0, 7.4.1, 7.5.0, 7.5.1, 18.1 and Dell EMC Integrated Data Protection Appliance (IDPA) versions 2.0, 2.1 and 2.2 contain an open redirection vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability to redirect application users to arbitrary web URLs by tricking the victim users to click on maliciously crafted links. The vulnerability could be used to conduct phishing attacks that cause users to unknowingly visit malicious sites.
CVSS v3.0: 6.1
CVE-2023-25131: Use of default password vulnerability in CyberPower PowerPanel Business
Use of default password vulnerability in PowerPanel Business Local/Remote for Windows v4.8.6 and earlier, PowerPanel Business Management for Windows v4.8.6 and earlier, PowerPanel Business Local/Remote for Linux 32bit v4.8.6 and earlier, PowerPanel Business Local/Remote for Linux 64bit v4.8.6 and earlier, PowerPanel Business Management for Linux 32bit v4.8.6 and earlier, PowerPanel Business Management for Linux 64bit v4.8.6 and earlier, PowerPanel Business Local/Remote for MacOS v4.8.6 and earlier, and PowerPanel Business Management for MacOS v4.8.6 and earlier allows remote attackers to log in to the server directly to perform administrative functions. Upon installation or upon first login, the application does not ask the user to change the 'admin' password.
CVSS v3.1: 9.4
CVE-2023-24698: Insufficient parameter validation in the Foswiki::Sandbox component of Foswiki v2.1.7 and below allows attackers to perform a directory traversal via supplying a crafted web request.
CVSS v3.1: 7.5
GHSA-c4pc-6x2g-4chr: Improper Privilege Management vulnerability in ZTE GoldenDB allows Privilege Escalation.This issue affects GoldenDB: from 6.1.03 through 6.1.03.05.
CVSS v3.1: 5.3
CVE-2022-37338: WordPress Blossom Recipe Maker plugin <= 1.0.7 - Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilities
Multiple Authenticated (contributor+) Stored Cross-Site Scripting (XSS) vulnerabilities in Blossom Recipe Maker plugin <= 1.0.7 at WordPress.
CVSS v3.1: 4.1
CVE-2023-3064: Mobatime mobile application - Sensitive information disclosure
Anonymous user may get the list of existing users managed by the application, that could ease further attacks (see CVE-2023-3065 and 3066)This issue affects Mobatime mobile application AMXGT100 through 1.3.20.


CVSS v3.1: 7.5
CVE-2021-2210: Vulnerability in the Oracle Trade Management product of Oracle E-Business Suite (component: Quotes). Supported versions that are affected are 12.1.1-12.1.3 and 12.2.3-12.2.10. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Trade Management. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Trade Management, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Trade Management accessible data as well as unauthorized update, insert or delete access to some of Oracle Trade Management accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N).
CVSS v3.1: 8.2
GHSA-qmxh-c3qm-vmrf: Permission control vulnerability in the package management module.Successful exploitation of this vulnerability may affect service confidentiality.
CVSS v3.1: 7.5
GHSA-w479-762h-chxx: An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), Q(10.0), and R(11.0) (Exynos chipsets) software. The Mali GPU driver allows out-of-bounds access and a device reset. The Samsung ID is SVE-2020-19174 (January 2021).
RHSA-2012:1015: Red Hat Security Advisory: Red Hat Enterprise Linux Extended Update Support 6.0 6-Month EOL Notice
This is the 6-Month notification of the End Of Life plans for Red Hat
Enterprise Linux Extended Update Support Add-On (EUS) 6.0.
CVE-2013-5138: IOCatalogue in IOKitUser in Apple iOS before 7 allows attackers to cause a denial of service (NULL pointer dereference and device crash) via a crafted application.
CVSS v2.0: 4.7
CVE-2016-3487: Unspecified vulnerability in the Oracle WebCenter Sites component in Oracle Fusion Middleware 11.1.1.8, and 12.2.1.0 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.
CVSS v3.0: 8.1
CVSS v2.0: 10
GHSA-hhf2-ff79-7j23: Buffer overflow in the web-based management interface on Cisco RV110W devices with firmware through 1.2.1.4, RV130W devices with firmware through 1.0.2.7, and RV215W devices with firmware through 1.3.0.7 allows remote authenticated users to cause a denial of service (device reload) via a crafted HTTP request, aka Bug ID CSCux86669.
CVSS v3.0: 6.5
GHSA-pv7g-p37c-pv2g: IBM Flex System Manager (FSM) 1.3.0 allows remote attackers to bypass intended access restrictions, and create new user accounts or execute tasks, by leveraging an expired password for the system-level account.
GHSA-fqj8-mhv5-gm5f: Dell InsightIQ, version 5.0, contains an improper access control vulnerability. A remote low privileged attacker could potentially exploit this vulnerability, leading to unauthorized access to monitoring data.
CVSS v3.1: 8.3
GHSA-p5gc-957x-gfw9: Go Ethereum LES protocol implementation vulnerable to Denial of Service
The GetBlockHeadersMsg handler in the LES protocol implementation in Go Ethereum (aka geth) before 1.8.11 may lead to an access violation because of an integer signedness error for the array index, which allows attackers to launch a Denial of Service attack by sending a packet with a -1 query.Skip value. The vulnerable remote node would be crashed by such an attack immediately, aka the EPoD (Ethereum Packet of Death) issue.Specific Go Packages Affectedgithub.com/ethereum/go-ethereum/les
CVSS v3.0: 7.5
GHSA-3hcw-6565-rfpx: The GrooveMusic (aka com.mobincube.android.sc_2HKFF) application 2.0.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2005-3916: SQL injection vulnerability in memberlist.php in WSN Forum 1.21 allows remote attackers to execute arbitrary SQL commands via the id parameter in a profile action.
CVSS v2.0: 7.5
GHSA-ph74-8rgx-64c5: Cross-site Scripting in Jenkins JUnit Plugin
Jenkins JUnit Plugin 1166.va_436e268e972 and earlier does not escape test case class names in JavaScript expressions, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control test case class names in the JUnit resources processed by the plugin.
CVSS v3.1: 5.4
CVE-2010-0996: Unrestricted file upload vulnerability in e107 before 0.7.20 allows remote authenticated users to execute arbitrary code by uploading a .php.filetypesphp file.  NOTE: the vendor disputes the significance of this issue, noting that "an odd set of preferences and a missing file" are required.
CVSS v2.0: 6
CVE-2026-47146: Color Control color-temperature assertion abort in EmberZNet v9.0.2
In EmberZNet v9.0.2 and earlier, malformed Color Control messages can lead to asserts that terminate the process. These messages must come from a device that has already joined the network. Only devices supporting the Color Control cluster may be impacted.
CVSS v4.0: 7.1
CVE-2010-2012: SQL injection vulnerability in function.php in MigasCMS 1.1, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the categorie parameter in a catalogo action.  NOTE: some of these details are obtained from third party information.
CVSS v2.0: 6.8
CVE-2026-29097: SuiteCRM Server-Side Request Forgery and Denial of Service via RSS Feed Dashlet
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Versions prior to 7.15.1 and 8.9.3 contain a Server-Side Request Forgery (SSRF) vulnerability combined with a Denial of Service (DoS) condition in the RSS Feed Dashlet component. Versions 7.15.1 and 8.9.3 patch the issue.
CVSS v4.0: 7.1
CVE-2025-11603: code-projects Simple Food Ordering System editproduct.php sql injection
A vulnerability was found in code-projects Simple Food Ordering System 1.0. This vulnerability affects unknown code of the file /editproduct.php. The manipulation of the argument Category results in sql injection. The attack may be launched remotely. The exploit has been made public and could be used.
CVSS v4.0: 5.3
CVSS v3.1: 6.3
CVSS v3.0: 6.3
CVSS v2.0: 6.5
GHSA-6gc5-r24c-783h: Improper resolution of path equivalence in Windows MapUrlToZone allows an unauthorized attacker to bypass a security feature over a network.
CVSS v3.1: 4.3
CVE-2024-48899: Moodle: idor when accessing list of course badges
A vulnerability was found in Moodle. Additional checks are required to ensure users can only fetch the list of course badges for courses that they are intended to have access to.
CVSS v3.1: 4.3
GHSA-2wvp-gfcw-56p6: While rendering the layout background, Error status check is not caught properly and also incorrect status handling is being done leading to unintended SUI behaviour in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wired Infrastructure and Networking in MDM9150, MDM9206, MDM9607, MDM9650, MDM9655, MSM8996AU, QCS404, QCS605, SD 210/SD 212/SD 205, SD 410/12, SD 636, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SD 8CX, SDA660, SDM630, SDM660, SDX24, SXR1130
CVE-2014-6770: The Aerospace Jobs (aka com.app_aerospacejobs.layout) application 1.399 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS v2.0: 5.4
CVE-2024-41714: A vulnerability in the Web Interface component of Mitel MiCollab through 9.8 SP1 (9.8.1.5) and MiVoice Business Solution Virtual Instance (MiVB SVI) through 1.0.0.27 could allow an authenticated attacker to conduct a command injection attack, due to insufficient parameter sanitization. A successful exploit could allow an attacker to execute arbitrary commands with elevated privileges within the context of the system.
CVSS v3.1: 8.8
RHSA-2015:0854: Red Hat Security Advisory: java-1.8.0-oracle security update
jar: directory traversal vulnerability JDK: unspecified vulnerability fixed in 6u95, 7u79 and 8u45 (Deployment) JDK: unspecified vulnerability fixed in 5.0u85, 6u95, 7u79 and 8u45 (2D) OpenJDK: incorrect handling of phantom references (Hotspot, 8071931) ICU: layout engine glyphStorage off-by-one (OpenJDK 2D, 8067699) OpenJDK: incorrect handling of default methods (Hotspot, 8065366) OpenJDK: incorrect permissions check in resource loading (Beans, 8068320) OpenJDK: insufficient hardening of RSA-CRT implementation (JCE, 8071726) OpenJDK: jar directory traversal issues (Tools, 8064601) JDK: unspecified vulnerability fixed in 7u79 and 8u45 (JavaFX) JDK: unspecified vulnerability fixed in 8u45 (Deployment) OpenJDK: certificate options parsing uncaught exception (JSSE, 8068720) JDK: unspecified vulnerability fixed in 5.0u85, 6u95, 7u79 and 8u45 (2D) JDK: unspecified vulnerability fixed in 7u79 and 8u45 (JavaFX)
CVE-2014-3593: Eval injection vulnerability in luci 0.26.0 allows remote authenticated users with certain permissions to execute arbitrary Python code via a crafted cluster configuration.
CVSS v2.0: 6
GHSA-8vfq-rv3q-w9xp: On BIG-IP versions 17.0.x before 17.0.0.2 and 16.1.x before 16.1.3.3, when a HTTP profile with the non-default Enforcement options of Enforce HTTP Compliance and Unknown Methods: Reject are configured on a virtual server, undisclosed requests can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS v3.1: 7.5
PYSEC-2021-891: CWE - CWE-287: Improper Authentication vulnerability in SUSE Linux Enterprise Server 15 SP 3; openSUSE Tumbleweed allows local attackers to execute arbitrary code via salt without the need to specify valid credentials. This issue affects: SUSE Linux Enterprise Server 15 SP 3 salt versions prior to 3002.2-3. openSUSE Tumbleweed salt version 3002.2-2.1 and prior versions. This issue affects: SUSE Linux Enterprise Server 15 SP 3 salt versions prior to 3002.2-3. openSUSE Tumbleweed salt version 3002.2-2.1 and prior versions.
CVSS v3.1: 7.8
CVE-1999-1554: /usr/sbin/Mail on SGI IRIX 3.3 and 3.3.1 does not properly set the group ID to the group ID of the user who started Mail, which allows local users to read the mail of other users.
CVSS v2.0: 2.1
GHSA-4jq2-rqxh-cw4r: Multiple buffer overflows in the esa_write function in /dev/seirenin the Exynos Seiren Audio driver, as used in Samsung S6 Edge, allow local users to cause a denial of service (memory corruption) via a large (1) buffer or (2) size parameter.
CVE-2024-37980: Microsoft SQL Server Elevation of Privilege Vulnerability
Microsoft SQL Server Elevation of Privilege Vulnerability
CVSS v3.1: 8.8
CVE-2017-10606: SRX Series: Cryptographic weakness in SRX300 Series TPM Firmware
Version 4.40 of the TPM (Trusted Platform Module) firmware on Juniper Networks SRX300 Series has a weakness in generating cryptographic keys that may allow an attacker to decrypt sensitive information in SRX300 Series products. The TPM is used in the SRX300 Series to encrypt sensitive configuration data. While other products also ship with a TPM, no other products or platforms are affected by this vulnerability. Customers can confirm the version of TPM firmware via the 'show security tpm status' command. This issue was discovered by an external security researcher. No other Juniper Networks products or platforms are affected by this issue.
CVSS v3.0: 4.4
CVE-2017-1000484: By linking to a specific url in Plone 2.5-5.1rc1 with a parameter, an attacker could send you to his own website. On its own this is not so bad: the attacker could more easily link directly to his own website instead. But in combination with another attack, you could be sent to the Plone login form and login, then get redirected to the specific url, and then get a second redirect to the attacker website. (The specific url can be seen by inspecting the hotfix code, but we don't want to make it too easy for attackers by spelling it out here.)
CVSS v3.0: 6.1
CVSS v2.0: 5.8
GHSA-cf74-m2jq-4hch: PHP Education Manager v1.0 is vulnerable to Cross Site Scripting (XSS) stored Cross-Site Scripting (XSS) vulnerability in the topics management module (topics.php). Attackers can inject malicious JavaScript payloads into the Titlefield during topic creation or updates.
CVSS v3.1: 5.4
GHSA-g37r-x966-x536: Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana Fleet can lead to Excessive Allocation (CAPEC-130) via a specially crafted bulk retrieval request. This requires an attacker to have low-level privileges equivalent to the viewer role, which grants read access to agent policies. The crafted request can cause the application to perform redundant database retrieval operations that immediately consume memory until the server crashes and becomes unavailable to all users.
CVSS v3.1: 6.5
CVE-2018-13513: The mintToken function of a smart contract implementation for Ubiou, an Ethereum token, has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.
CVSS v3.0: 7.5
CVSS v2.0: 5
CVE-2021-43006: AmZetta Amzetta zPortal DVM Tools is affected by Integer Overflow. IOCTL Handler 0x22001B in the Amzetta zPortal DVM Tools <= v3.3.148.148 allow local attackers to execute arbitrary code in kernel mode or cause a denial of service (memory corruption and OS crash) via specially crafted I/O Request Packet.
CVSS v3.1: 8.8
CVSS v2.0: 7.2
CVE-2021-44145: Apache NiFi information disclosure by XXE
In the TransformXML processor of Apache NiFi before 1.15.1 an authenticated user could configure an XSLT file which, if it included malicious external entity calls, may reveal sensitive information.
CVSS v3.1: 6.5
CVSS v2.0: 4
GHSA-ch68-7rvg-72gm: On BIG-IP LTM 15.1.0-15.1.0.5, 14.1.0-14.1.2.7, 13.1.0-13.1.3.4, and 12.1.0-12.1.5.1, the Traffic Management Microkernel (TMM) process may consume excessive resources when processing SSL traffic and client authentication are enabled on the client SSL profile.
PYSEC-2016-25: flask-oidc version 0.1.2 and earlier is vulnerable to an open redirect