Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 8

Export CSV
CVE-2022-24723

Improper Input Validation in URI.js

URI.js is a Javascript URL mutation library. Before version 1.19.9, whitespace characters are not removed from the beginning of the protocol, so URLs are not parsed properly. This issue has been patched in version 1.19.9. Removing leading whitespace from values before passing them to URI.parse can be used as a workaround.

CVSS 3.1 · 5.3 Medium EPSS 1.9% KEV · Not listed
Vendors
Redhat Uri.js Project
Products
Acm Jboss Fuse Uri.js
CVE-2022-1243

CRHTLF can lead to invalid protocol extraction potentially leading to XSS in medialize/uri.js

CRHTLF can lead to invalid protocol extraction potentially leading to XSS in GitHub repository medialize/uri.js prior to 1.19.11.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Uri.js Project
Products
Uri.js
CVE-2022-1233

URL Confusion When Scheme Not Supplied in medialize/uri.js

URL Confusion When Scheme Not Supplied in GitHub repository medialize/uri.js prior to 1.19.11.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Uri.js Project
Products
Uri.js
CVE-2022-0868

Open Redirect in medialize/uri.js

Open Redirect in GitHub repository medialize/uri.js prior to 1.19.10.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Uri.js Project
Products
Uri.js
CVE-2021-3647

Open Redirect in medialize/URI.js

URI.js is vulnerable to URL Redirection to Untrusted Site

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Uri.js Project
Products
Uri.js
CVE-2021-27516

nodejs-urijs: mishandling certain uses of backslash may lead to confidentiality compromise

URI.js (aka urijs) before 1.19.6 mishandles certain uses of backslash such as http:\/ and interprets the URI as a relative path.

CVSS 3.1 · 7.5 High EPSS 2.5% KEV · Not listed
Vendors
Redhat Uri.js Project
Products
Quay Uri.js
CVE-2020-26291

Hostname spoofing in URI.js

URI.js is a javascript URL mutation library (npm package urijs). In URI.js before version 1.19.4, the hostname can be spoofed by using a backslash (`\`) character followed by an at (`@`) character. If the hostname is used in security decisions, the decision may be incorrect. Depending on library usage and attacker intent, impacts may include allow/block list bypasses, SSRF attacks, open redirects, or other undesired behavior. For example the URL `https://expected-example.com\@observed-example.com` will incorrectly return `observed-example.com` if using an affected version. Patched versions correctly return `expected-example.com`. Patched versions match the behavior of other parsers which implement the WHATWG URL specification, including web browsers and Node's built-in URL class. Version 1.19.4 is patched against all known payload variants. Version 1.19.3 has a partial patch but is still vulnerable to a payload variant.]

CVSS 3.1 · 6.5 Medium EPSS 1.7% KEV · Not listed
Vendors
Redhat Uri.js Project
Products
Quay Uri.js