CVE-2018-3774

creationtimestamp| type| source ---|---|--- 2023-04-26 02:57:28+00:00| published-proof-of-concept| https://t.me/criticalbug/692...

@afshin/custom404-extension (>=0.1.1, <=0.1.3), @apache-royale/cli (>=0.1.0, <=0.2.2) +443 more potentially affected by CVE-2018-3774 via url-parse (>=1.0.2, <=1.4.1)

url-parse NPM version =1.0.2, =0.1.1, =0.1.0, =0.0.1, =0.1.0, =0.1.1, =0.1.1-beta.0, =0.1.0, =0.1.0, =0.1.0, =1.1.1, =2.0.0, =2.0.0, =4.1.0 - @datalayer/jupyterlab-hub-extension 0.8.1 and more Source cves: CVE-2018-3774 Source advisory: OSV:GHSA-PV4C-P2J5-38J4...

CVE-2018-3774

Incorrect parsing in url-parse 1.4.3 returns wrong hostname which leads to multiple vulnerabilities such as SSRF, Open Redirect, Bypass Authentication Protocol...

CVE-2018-3774

CVE-2018-3774 affects the url-parse library prior to 1.4.3 and stems from incorrect hostname parsing. This can enable SSRF, open redirect, and potential bypass of authentication in affected workflows that rely on url-parse for URL handling. Exploitation scenarios include misparsing hosts in URLs ...