url-parse project records
8 published records for vendor url-parse project.
Researcher profile
- Entered KEV
- 0 · 0%
- Weaponized
- 0 · 0%
- Pre-auth RCE
- 0
- With a fix record
- 100%
- Median publish → KEV
- No record has entered KEV
Recurring classes
- CWE-639 Authorization Bypass Through User-Controlled Key4
- CWE-20 Improper Input Validation1
- CWE-425 Direct Request ('Forced Browsing')1
- CWE-601 URL Redirection to Untrusted Site ('Open Redirect')1
The weakness classes this vendor ships most often: where to look.
CWEAll records
8 records| Action | CVE | Vulnerability | Severity | KEV | EPSS | Published |
|---|---|---|---|---|---|---|
41Plan | CVE-2018-3774No exploit | Incorrect parsing in url-parse <1.4.3 returns wrong hostname which leads to multiple vulnerabilities such as SSRF, Open Redirect, Bypass Auturl-parse project · url-parse · CWE-425 | Critical10.0 | — | 3.8% | Aug 12, 2018 |
40Plan | CVE-2022-0691No exploit | Authorization Bypass Through User-Controlled Key in unshiftio/url-parseurl-parse project · url-parse · CWE-639 | Critical9.8 | — | 2.2% | Feb 21, 2022 |
37Monitor | CVE-2022-0686No exploit | Authorization Bypass Through User-Controlled Key in unshiftio/url-parseurl-parse project · url-parse · CWE-639 | Critical9.1 | — | 1.8% | Feb 20, 2022 |
22Monitor | CVE-2021-3664No exploit | Open Redirect in unshiftio/url-parseurl-parse project · url-parse · CWE-601 | Medium5.3 | — | 2.1% | Jul 26, 2021 |
22Monitor | CVE-2021-27515No exploit | url-parse before 1.5.0 mishandles certain uses of backslash such as http:\/ and interprets the URI as a relative path.url-parse project · url-parse | Medium5.3 | — | 2.0% | Feb 21, 2021 |
22Monitor | CVE-2022-0512No exploit | Authorization Bypass Through User-Controlled Key in unshiftio/url-parseurl-parse project · url-parse · CWE-639 | Medium5.3 | — | 1.8% | Feb 14, 2022 |
21Monitor | CVE-2020-8124No exploit | Insufficient validation and sanitization of user input exists in url-parse npm package version 1.4.4 and earlier may allow attacker to bypasurl-parse project · url-parse · CWE-20 | Medium5.3 | — | 1.7% | Feb 4, 2020 |
21Monitor | CVE-2022-0639No exploit | Authorization Bypass Through User-Controlled Key in unshiftio/url-parseurl-parse project · url-parse · CWE-639 | Medium5.3 | — | 1.5% | Feb 17, 2022 |
- CVE-2018-377441Plan
Incorrect parsing in url-parse <1.4.3 returns wrong hostname which leads to multiple vulnerabilities such as SSRF, Open Redirect, Bypass Aut
CriticalCVSS 10.0No exploitEPSS 4%url-parse project · url-parseAug 12, 2018
- CVE-2022-069140Plan
Authorization Bypass Through User-Controlled Key in unshiftio/url-parse
CriticalCVSS 9.8No exploitEPSS 2%url-parse project · url-parseFeb 21, 2022
- CVE-2022-068637Monitor
Authorization Bypass Through User-Controlled Key in unshiftio/url-parse
CriticalCVSS 9.1No exploitEPSS 2%url-parse project · url-parseFeb 20, 2022
- CVE-2021-366422Monitor
Open Redirect in unshiftio/url-parse
MediumCVSS 5.3No exploitEPSS 2%url-parse project · url-parseJul 26, 2021
- CVE-2021-2751522Monitor
url-parse before 1.5.0 mishandles certain uses of backslash such as http:\/ and interprets the URI as a relative path.
MediumCVSS 5.3No exploitEPSS 2%url-parse project · url-parseFeb 21, 2021
- CVE-2022-051222Monitor
Authorization Bypass Through User-Controlled Key in unshiftio/url-parse
MediumCVSS 5.3No exploitEPSS 2%url-parse project · url-parseFeb 14, 2022
- CVE-2020-812421Monitor
Insufficient validation and sanitization of user input exists in url-parse npm package version 1.4.4 and earlier may allow attacker to bypas
MediumCVSS 5.3No exploitEPSS 2%url-parse project · url-parseFeb 4, 2020
- CVE-2022-063921Monitor
Authorization Bypass Through User-Controlled Key in unshiftio/url-parse
MediumCVSS 5.3No exploitEPSS 2%url-parse project · url-parseFeb 17, 2022