Vendors / unshiftio Records 8 All Threatist records
Exploited (KEV) 0 None in CISA KEV
CVSS critical 3
CVSS high 0
Exploited now unshiftio records in CISA KEV No unshiftio vulnerabilities are listed in CISA KEV.
Components Products in the NVD configurations · select one to filter the records Priority MEDIUM 49
Incorrect parsing in url-parse <1.4.3 returns wrong hostname which leads to multiple vulnerabilities such as SSRF, Open Redirect, Bypass Authentication Protocol.
CVSS 3.0 CRITICAL 10.0· Network · No auth · No interaction · EPSS 0.03805 · Published 2018-08-12 · Fixed in 1.4.3 CWE-425
Priority MEDIUM 46
Authorization Bypass Through User-Controlled Key in NPM url-parse prior to 1.5.9.
CVSS 3.1 CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.0222 · Published 2022-02-21 · Partial fix · 1.5.9 CWE-639
Priority MEDIUM 43
Authorization Bypass Through User-Controlled Key in NPM url-parse prior to 1.5.8.
CVSS 3.1 CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.01827 · Published 2022-02-20 · Partial fix · 1.5.8 CWE-639
Priority LOW 28
Authorization Bypass Through User-Controlled Key in NPM url-parse prior to 1.5.6.
CVSS 3.1 MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.01782 · Published 2022-02-14 · Partial fix · 1.5.6 CWE-639
Priority LOW 28
url-parse before 1.5.0 mishandles certain uses of backslash such as http:\/ and interprets the URI as a relative path.
CVSS 3.1 MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.01964 · Published 2021-02-21 · Partial fix · 1.5.0 CWE-23
Priority LOW 28
url-parse is vulnerable to URL Redirection to Untrusted Site
CVSS 3.1 MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.02116 · Published 2021-07-26 · Partial fix · 1.5.2 CWE-601
Priority LOW 27
Authorization Bypass Through User-Controlled Key in NPM url-parse prior to 1.5.7.
CVSS 3.1 MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.01535 · Published 2022-02-17 · Partial fix · 1.5.7 CWE-639
Priority LOW 27
Insufficient validation and sanitization of user input exists in url-parse npm package version 1.4.4 and earlier may allow attacker to bypass security checks.
CVSS 3.1 MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.01652 · Published 2020-02-04 · Partial fix · 1.4.5 CWE-20
Open these records in search → All records by CVSS severity
3 0 5 0 0
THREATIST.IORead the docs