Url-parse_project Url-parse
8 CVEs affecting Url-parse_project Url-parse. Latest disclosed: 2022-02-21. Critical: 3, High: 0.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2018-3774 | Critical | 10.0 | 2018-08-12 | Incorrect parsing in url-parse <1.4.3 returns wrong hostname which leads to multiple vulnerabilities such as SSRF, Open Redirect, Bypass Authentication Protoco… |
CVE-2022-0691 | Critical | 9.8 | 2022-02-21 | Authorization Bypass Through User-Controlled Key in NPM url-parse prior to 1.5.9. |
CVE-2022-0686 | Critical | 9.1 | 2022-02-20 | Authorization Bypass Through User-Controlled Key in NPM url-parse prior to 1.5.8. |
CVE-2022-0639 | Medium | 5.3 | 2022-02-17 | Authorization Bypass Through User-Controlled Key in NPM url-parse prior to 1.5.7. |
CVE-2022-0512 | Medium | 5.3 | 2022-02-14 | Authorization Bypass Through User-Controlled Key in NPM url-parse prior to 1.5.6. |
CVE-2021-3664 | Medium | 5.3 | 2021-07-26 | url-parse is vulnerable to URL Redirection to Untrusted Site |
CVE-2021-27515 | Medium | 5.3 | 2021-02-22 | url-parse before 1.5.0 mishandles certain uses of backslash such as http:\/ and interprets the URI as a relative path. |
CVE-2020-8124 | Medium | 5.3 | 2020-02-04 | Insufficient validation and sanitization of user input exists in url-parse npm package version 1.4.4 and earlier may allow attacker to bypass security checks. |