Url-parse Project Url-parse — known CVE vulnerabilities

Every CVE whose affected-product data names Url-parse Project Url-parse, ordered by CVSS severity, with EPSS exploit prediction and CISA KEV status.

CVEs (8)

• CVE-2018-3774 — CVSS 10.0 (critical): Incorrect parsing in url-parse <1.4.3 returns wrong hostname which leads to multiple vulnerabilities such as SSRF, Open Redirect, Bypass…
• CVE-2022-0691 — CVSS 9.8 (critical): Authorization Bypass Through User-Controlled Key in NPM url-parse prior to 1.5.9.
• CVE-2022-0686 — CVSS 9.1 (critical): Authorization Bypass Through User-Controlled Key in NPM url-parse prior to 1.5.8.
• CVE-2021-27515 — CVSS 5.3 (medium): url-parse before 1.5.0 mishandles certain uses of backslash such as http:\/ and interprets the URI as a relative path.
• CVE-2021-3664 — CVSS 5.3 (medium): url-parse is vulnerable to URL Redirection to Untrusted Site
• CVE-2022-0512 — CVSS 5.3 (medium): Authorization Bypass Through User-Controlled Key in NPM url-parse prior to 1.5.6.
• CVE-2022-0639 — CVSS 5.3 (medium): Authorization Bypass Through User-Controlled Key in NPM url-parse prior to 1.5.7.
• CVE-2020-8124 — CVSS 5.3 (medium): Insufficient validation and sanitization of user input exists in url-parse npm package version 1.4.4 and earlier may allow attacker to…