CVE-2015-5354

MediumCVSS 5.8/10Last modified Jun 17, 2026

Description

Open redirect vulnerability in Novius OS 5.0.1 (Elche) allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the redirect parameter to admin/nos/login.

Metrics

CVSS 2.0 5.8/10AV:N/AC:M/Au:N/C:P/I:P/A:N

Weakness enumeration

CWE-601

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://hyp3rlinx.altervista.org/advisories/AS-NOVIUSOS0629.txtThird Party Advisory
http://packetstormsecurity.com/files/132478/Novius-OS-5.0.1-elche-XSS-LFI-Open-Redirect.htmlExploit, Third Party Advisory, VDB Entry
http://www.securityfocus.com/archive/1/535876/100/0/threadedThird Party Advisory, VDB Entry
https://www.exploit-db.com/exploits/37439/Third Party Advisory, VDB Entry
http://hyp3rlinx.altervista.org/advisories/AS-NOVIUSOS0629.txtThird Party Advisory
http://packetstormsecurity.com/files/132478/Novius-OS-5.0.1-elche-XSS-LFI-Open-Redirect.htmlExploit, Third Party Advisory, VDB Entry
http://www.securityfocus.com/archive/1/535876/100/0/threadedThird Party Advisory, VDB Entry
https://www.exploit-db.com/exploits/37439/Third Party Advisory, VDB Entry

Timeline

Published: Jul 1, 2015
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2015

CVE-2015-53554.3Multiple cross-site scripting (XSS) vulnerabilities in GetSimple CMS before 3.3.6 allow remote attackers to inject arbitrary web script or H CVE-2015-53564.3Cross-site scripting (XSS) vulnerability in admin/filebrowser.php in GetSimple CMS before 3.3.6 allows remote attackers to inject arbitrary CVE-2015-53575.0The Juniper EX4600, QFX3500, QFX3600, and QFX5100 switches with Junos 13.2X51-D15 through 13.2X51-D25, 13.2X51 before 13.2X51-D30, and 14.1X CVE-2015-53587.1Juniper Junos OS 12.1X44 before 12.1X44-D50, 12.1X46 before 12.1X46-D35, 12.1X47 before 12.1X47-D25, 12.3 before 12.3R9, 12.3X48 before 12.3 CVE-2015-53597.1Juniper Junos OS 12.1X44 before 12.1X44-D50, 12.1X46 before 12.1X46-D35, 12.1X47 before 12.1X47-D25, 12.3 before 12.3R9, 12.3X48 before 12.3 CVE-2015-53605.0IPv6 sendd in Juniper Junos 12.1X44 before 12.1X44-D51, 12.1X46 before 12.1X46-D36, 12.1X46 before 12.1X46-D40, 12.1X47 before 12.1X47-D25, CVE-2015-53616.5Background For regular, unencrypted FTP traffic, the FTP ALG can inspect the unencrypted control channel and open related sessions for the F CVE-2015-53629.3The BFD daemon in Juniper Junos OS 12.1X44 before 12.1X44-D50, 12.1X46 before 12.1X46-D35, 12.1X47 before 12.1X47-D25, 12.3 before 12.3R10, CVE-2015-53635.0The SRX Network Security Daemon (nsd) in Juniper SRX Series services gateways with Junos 12.1X44 before 12.1X44-D50, 12.1X46 before 12.1X46-CVE-2015-53647.8The (1) udp_recvmsg and (2) udpv6_recvmsg functions in the Linux kernel before 4.0.6 do not properly consider yielding a processor, which al CVE-2015-53653.5Cross-site scripting (XSS) vulnerability in Zurmo CRM 3.0.2 allows remote authenticated users to inject arbitrary web script or HTML via the CVE-2015-53665.0The (1) udp_recvmsg and (2) udpv6_recvmsg functions in the Linux kernel before 4.0.6 provide inappropriate -EAGAIN return values, which allo