Url-parse Project - vulnerabilities (CVEs)

8 CVEs in 2 products, 0 in the last 30 days, newest from 2022-02-21.

Products

• Url-parse - 7 CVEs
• Url Project - 0 CVEs

Newest CVEs of Url-parse Project

• CVE-2022-0691 - CVSS 9.8 (critical), 2022-02-21: Authorization Bypass Through User-Controlled Key in NPM url-parse prior to 1.5.9.
• CVE-2022-0686 - CVSS 9.1 (critical), 2022-02-20: Authorization Bypass Through User-Controlled Key in NPM url-parse prior to 1.5.8.
• CVE-2022-0639 - CVSS 6.5 (medium), 2022-02-17: Authorization Bypass Through User-Controlled Key in NPM url-parse prior to 1.5.7.
• CVE-2022-0512 - CVSS 8.8 (high), 2022-02-14: Authorization Bypass Through User-Controlled Key in NPM url-parse prior to 1.5.6.
• CVE-2021-3664 - CVSS 5.3 (medium), 2021-07-26: url-parse is vulnerable to URL Redirection to Untrusted Site
• CVE-2021-27515 - CVSS 5.3 (medium), 2021-02-22: url-parse before 1.5.0 mishandles certain uses of backslash such as http:\/ and interprets the URI as a relative path.
• CVE-2020-8124 - CVSS 5.3 (medium), 2020-02-04: Insufficient validation and sanitization of user input exists in url-parse npm package version 1.4.4 and earlier may allow attacker to bypass security checks.
• CVE-2018-3774 - CVSS 10 (critical), 2018-08-12: Incorrect parsing in url-parse <1.4.3 returns wrong hostname which leads to multiple vulnerabilities such as SSRF, Open Redirect, Bypass Authentication…