Vulnerabilities

TI-2022-01130 CVE-2022-1243 · GHSA-3vjf-82ff-p4r3

CRHTLF can lead to invalid protocol extraction potentially leading to XSS in medialize/uri.js

LOW 28

CRHTLF can lead to invalid protocol extraction potentially leading to XSS in GitHub repository medialize/uri.js prior to 1.19.11.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00673 Published 2022-04-05 Fixed in 1.19.11 CWE-20

TI-2022-01120 CVE-2022-1233 · GHSA-g694-m8vq-gv9h

LOW 29

URL Confusion When Scheme Not Supplied in GitHub repository medialize/uri.js prior to 1.19.11.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00799 Published 2022-04-04 Fixed in 1.19.11 CWE-115

TI-2022-00774 CVE-2022-0868 · GHSA-8h2f-7jc4-7m3m

LOW 28

Open Redirect in GitHub repository medialize/uri.js prior to 1.19.10.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00719 Published 2022-03-06 Fixed in 1.19.10 CWE-601

TI-2022-08538 CVE-2022-24723 · GHSA-gmv4-r438-p67f

MEDIUM 63

URI.js is a Javascript URL mutation library.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.01941 Published 2022-03-03 Partial fix · 1.19.9 CWE-20

TI-2022-00530 CVE-2022-0613 · GHSA-gcv8-gh4r-25x6

LOW 32

Authorization Bypass Through User-Controlled Key in NPM urijs prior to 1.19.8.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.01537 Published 2022-02-16 Partial fix · 1.19.8 CWE-639

TI-2021-02592 CVE-2021-3647 · GHSA-89gv-h8wf-cg8r

LOW 29

URI.js is vulnerable to URL Redirection to Untrusted Site

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.0091 Published 2021-07-16 Fixed in 1.19.7 CWE-601

TI-2021-08996 CVE-2021-27516 · GHSA-p6j9-7xhc-rhwp

LOW 38

URI.js (aka urijs) before 1.19.6 mishandles certain uses of backslash such as http:\/ and interprets the URI as a relative path.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.02483 Published 2021-02-21 Fixed in 1.19.6 CWE-20

TI-2020-16112 CVE-2020-26291 · GHSA-3329-pjwv-fjpg

LOW 32

URI.js is a javascript URL mutation library (npm package urijs).

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.0171 Published 2020-12-30 Fixed in 1.19.4 CWE-20