debian/node-url-parse vulnerabilities

Latest debian/node-url-parse CVEs

Newest publication first

1. CVE-2022-0691 Authorization Bypass Through User-Controlled Key in unshiftio/url-parse

   Published 2022-02-21

   Medium·CVSS 6.5

   Authorization Bypass Through User-Controlled Key in NPM url-parse prior to 1.5.9.

2. CVE-2022-0686 Authorization Bypass Through User-Controlled Key in unshiftio/url-parse

   Published 2022-02-20

   Medium·CVSS 6.5

   Authorization Bypass Through User-Controlled Key in NPM url-parse prior to 1.5.8.

3. CVE-2022-0639 Authorization Bypass Through User-Controlled Key in unshiftio/url-parse

   Published 2022-02-17

   Medium·CVSS 6.5

   Authorization Bypass Through User-Controlled Key in NPM url-parse prior to 1.5.7.

4. CVE-2022-0512 Authorization Bypass Through User-Controlled Key in unshiftio/url-parse

   Published 2022-02-14

   High·CVSS 8.8

   Authorization Bypass Through User-Controlled Key in NPM url-parse prior to 1.5.6.

5. CVE-2021-3664 Open redirect in url-parse

   Published 2021-07-26

   Medium·CVSS 6.1

   Overview Affected versions of npm url-parse are vulnerable to URL Redirection to Untrusted Site. Impact Depending on library usage and attacker intent, impacts may include allow/block list bypasses, SSRF attacks, open redirects, or other undesired behavior.

6. CVE-2021-27515 Path traversal in url-parse

   Published 2021-02-22

   Medium·CVSS 5.3

   url-parse before 1.5.0 mishandles certain uses of backslash such as http:/ and interprets the URI as a relative path.

7. CVE-2020-8124 Improper Validation and Sanitization in url-parse

   Published 2020-02-04

   Medium·CVSS 5.3

   Insufficient validation and sanitization of user input exists in url-parse npm package version 1.4.4 and earlier may allow attacker to bypass security checks.

8. CVE-2018-3774 Open Redirect in url-parse

   Published 2018-08-12

   Critical·CVSS 10.0

   Incorrect parsing in url-parse <1.4.3 returns wrong hostname which leads to multiple vulnerabilities such as SSRF, Open Redirect, Bypass Authentication Protocol.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.