url-parse project vulnerabilities

Products

• url-parse 8

Latest url-parse project CVEs

Newest publication first

1. CVE-2022-0691 Authorization Bypass Through User-Controlled Key in unshiftio/url-parse

   Published 2022-02-21

   Critical·CVSS 9.8 EPSS 2.2%

   Authorization Bypass Through User-Controlled Key in NPM url-parse prior to 1.5.9.

2. CVE-2022-0686 Authorization Bypass Through User-Controlled Key in unshiftio/url-parse

   Published 2022-02-20

   Critical·CVSS 9.1 EPSS 1.8%

   Authorization Bypass Through User-Controlled Key in NPM url-parse prior to 1.5.8.

3. CVE-2022-0639 Authorization Bypass Through User-Controlled Key in unshiftio/url-parse

   Published 2022-02-17

   Medium·CVSS 5.3 EPSS 1.5%

   Authorization Bypass Through User-Controlled Key in NPM url-parse prior to 1.5.7.

4. CVE-2022-0512 Authorization Bypass Through User-Controlled Key in unshiftio/url-parse

   Published 2022-02-14

   Medium·CVSS 5.3 EPSS 1.8%

   Authorization Bypass Through User-Controlled Key in NPM url-parse prior to 1.5.6.

5. CVE-2021-3664 Open Redirect in unshiftio/url-parse

   Published 2021-07-26

   Medium·CVSS 5.3 EPSS 2.1%

   url-parse is vulnerable to URL Redirection to Untrusted Site

6. CVE-2021-27515 Path traversal in url-parse

   Published 2021-02-21

   Medium·CVSS 5.3 EPSS 2.0%

   url-parse before 1.5.0 mishandles certain uses of backslash such as http:/ and interprets the URI as a relative path.

7. CVE-2020-8124 Improper Validation and Sanitization in url-parse

   Published 2020-02-04

   Medium·CVSS 5.3 EPSS 1.7%

   Insufficient validation and sanitization of user input exists in url-parse npm package version 1.4.4 and earlier may allow attacker to bypass security checks.

8. CVE-2018-3774 Open Redirect in url-parse

   Published 2018-08-12

   Critical·CVSS 10.0 EPSS 3.8%

   Incorrect parsing in url-parse <1.4.3 returns wrong hostname which leads to multiple vulnerabilities such as SSRF, Open Redirect, Bypass Authentication Protocol.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.