CVE-2022-0613

CVE-2022-0613 affects the urijs (URI.js) npm package prior to 1.19.8. The issue is described as an Authorization Bypass Through User-Controlled Key, with related sources noting that the URI.js library could bypass host validation and enable open Redirect/SSRF scenarios. The vulnerability is assoc...

CVE-2022-0613

Authorization Bypass Through User-Controlled Key in NPM urijs prior to 1.19.8...

@accordproject/cicero-cli (>=0.3.4, <=0.22.3-20220223023655), @accordproject/cicero-common (>=0.3.4, <=0.3.12) +479 more potentially affected by CVE-2022-0613 via urijs (>=1.16.1, <=1.19.7)

urijs NPM version =1.16.1, =0.3.4, =0.3.4, =0.3.4, =0.3.4, =0.4.5-20180705184508, =0.11.2-20190326183124, =0.10.2-20190213145246, =0.22.2-20210714131804, =0.0.5-20190507210024, =0.71.8-20190915045234, =0.80.2-20190926121100, =0.80.4-20191003231621, =0.61.2-20190916200303, =0.90.1-20200514190616,...

CVE-2022-0613: Authorization Bypass Through User-Controlled Key

Authorization Bypass Through User-Controlled Key in NPM urijs prior to 1.19.8...

Urijs security vulnerabilities

urijs is a Javascript URL mutation library. A security vulnerability exists in urijs prior to 1.19.8, which stems from a user control key bypassing authorization...

Important: Red Hat Security Advisory: Red Hat Quay v3.6.0 security, bug fix and enhancement update

An update is now available for Red Hat Quay 3. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in the...

URIjs Vulnerable to Hostname spoofing via backslashes in URL

Impact If using affected versions to determine a URL's hostname, the hostname can be spoofed by using a combination of backslash \ and slash / characters as part of the scheme delimiter, e.g. scheme:///\hostname. If the hostname is used in security decisions, the decision may be incorrect...

GHSA-89GV-H8WF-CG8R URIjs Vulnerable to Hostname spoofing via backslashes in URL

Impact If using affected versions to determine a URL's hostname, the hostname can be spoofed by using a combination of backslash \ and slash / characters as part of the scheme delimiter, e.g. scheme:///\hostname. If the hostname is used in security decisions, the decision may be incorrect...

@accordproject/cicero-cli (>=0.3.4, <=0.22.3-20211027130006), @accordproject/cicero-common (>=0.3.4, <=0.3.12) +473 more potentially affected by CVE-2021-3647 via urijs (>=1.16.1, <=1.19.6)

urijs NPM version =1.16.1, =0.3.4, =0.3.4, =0.3.4, =0.3.4, =0.4.5-20180705184508, =0.11.2-20190326183124, =0.10.2-20190213145246, =0.22.2-20210714131804, =0.0.5-20190507210024, =0.71.8-20190915045234, =0.80.2-20190926121100, =0.80.4-20191003231621, =0.61.2-20190916200303, =0.90.1-20200514190616,...

@accordproject/cicero-cli (>=0.3.4, <=0.22.3-20211027130006), @accordproject/cicero-common (>=0.3.4, <=0.3.12) +473 more potentially affected by CVE-2021-3647 via urijs (>=1.16.1, <=1.19.6)

urijs NPM version =1.16.1, =0.3.4, =0.3.4, =0.3.4, =0.3.4, =0.4.5-20180705184508, =0.11.2-20190326183124, =0.10.2-20190213145246, =0.22.2-20210714131804, =0.0.5-20190507210024, =0.71.8-20190915045234, =0.80.2-20190926121100, =0.80.4-20191003231621, =0.61.2-20190916200303, =0.90.1-20200514190616,...

@accordproject/cicero-cli (>=0.3.4, <=0.22.3-20211027130006), @accordproject/cicero-common (>=0.3.4, <=0.3.12) +473 more potentially affected by CVE-2021-3647 via urijs (>=1.16.1, <=1.19.6)

urijs NPM version =1.16.1, =0.3.4, =0.3.4, =0.3.4, =0.3.4, =0.4.5-20180705184508, =0.11.2-20190326183124, =0.10.2-20190213145246, =0.22.2-20210714131804, =0.0.5-20190507210024, =0.71.8-20190915045234, =0.80.2-20190926121100, =0.80.4-20191003231621, =0.61.2-20190916200303, =0.90.1-20200514190616,...

Security Bulletin: A security vulnerability in Node.js urijs module affects IBM Cloud Pak for Multicloud Management Infrastructure management.

Summary A security vulnerability in Node.js urijs module affects IBM Cloud Pak for Multicloud Management Infrastructure management. Vulnerability Details CVEID: CVE-2020-26291 DESCRIPTION: Node.js urijs module could allow a remote attacker to conduct spoofing attacks, caused by improper input...

CVE-2021-27516

A flaw was found in nodejs-urijs where URI.js urijs mishandles certain uses of the backslash such as http:/ and interprets the URI as a relative path. The highest threat from this vulnerability is to confidentiality...

Hostname spoofing via backslashes in URL

Overview Impact urijs before version 1.19.6 is affected by hostname spoofing issue. If using urijs to determine a URL's hostname, the hostname can be spoofed by using a backslash \ character as part of the scheme delimiter, e.g. scheme:/\hostname. If the hostname is used in security decisions, th...

@accordproject/cicero-cli (>=0.3.4, <=0.21.27-20210409091004), @accordproject/cicero-common (>=0.3.4, <=0.3.12) +455 more potentially affected by CVE-2021-27516 via urijs (>=1.16.1, <=1.19.5)

urijs NPM version =1.16.1, =0.3.4, =0.3.4, =0.3.4, =0.3.4, =0.4.5-20180705184508, =0.11.2-20190326183124, =0.10.2-20190213145246, =0.0.5-20190507210024, =0.71.8-20190915045234, =0.80.2-20190926121100, =0.80.4-20191003231621, =0.61.2-20190916200303, =0.90.1-20200514190616, =0.6.0-alpha.0,...

URIjs Hostname spoofing via backslashes in URL

Impact If using affected versions to determine a URL's hostname, the hostname can be spoofed by using a backslash \ character as part of the scheme delimiter, e.g. scheme:/\hostname. If the hostname is used in security decisions, the decision may be incorrect. Depending on library usage and...

@accordproject/cicero-cli (>=0.3.4, <=0.21.27-20210409091004), @accordproject/cicero-common (>=0.3.4, <=0.3.12) +455 more potentially affected by CVE-2021-27516 via urijs (>=1.16.1, <=1.19.5)

urijs NPM version =1.16.1, =0.3.4, =0.3.4, =0.3.4, =0.3.4, =0.4.5-20180705184508, =0.11.2-20190326183124, =0.10.2-20190213145246, =0.0.5-20190507210024, =0.71.8-20190915045234, =0.80.2-20190926121100, =0.80.4-20191003231621, =0.61.2-20190916200303, =0.90.1-20200514190616, =0.6.0-alpha.0,...

GHSA-P6J9-7XHC-RHWP URIjs Hostname spoofing via backslashes in URL

Impact If using affected versions to determine a URL's hostname, the hostname can be spoofed by using a backslash \ character as part of the scheme delimiter, e.g. scheme:/\hostname. If the hostname is used in security decisions, the decision may be incorrect. Depending on library usage and...

CVE-2021-27516

CVE-2021-27516 affects the URI.js (urijs) library prior to v1.19.6. The issue stems from how the library handles backslashes in the URL delimiter (e.g., https:/...), which can cause hostname spoofing and misinterpretation of the target hostname, potentially enabling SSRF, open redirects, or relat...

@accordproject/cicero-cli (>=0.3.4, <=0.21.27-20210409091004), @accordproject/cicero-common (>=0.3.4, <=0.3.12) +455 more potentially affected by CVE-2021-27516 via urijs (>=1.16.1, <=1.19.5)

urijs NPM version =1.16.1, =0.3.4, =0.3.4, =0.3.4, =0.3.4, =0.4.5-20180705184508, =0.11.2-20190326183124, =0.10.2-20190213145246, =0.0.5-20190507210024, =0.71.8-20190915045234, =0.80.2-20190926121100, =0.80.4-20191003231621, =0.61.2-20190916200303, =0.90.1-20200514190616, =0.6.0-alpha.0,...