Open Redirect in ionicabizau/parse-url

✍️ Description parse-url improperly handles the user input such as https:/\ and interprets it as a relative path. Backslashes after the protocol are accepted by browsers and treated as normal slashes, but parse-url reads them as the relative path, which could lead to SSRF, open redirects, or other...

Open Redirect in ionicabizau/parse-url

✍️ Description parse-url mishandles certain uses of backslash such as https:/\ and interprets the URI as a relative path. Browsers accept backslashes after the protocol, and treat it as a normal slash, while parse-url sees it as a relative path. Which will lead to SSRF attacks, open redirects, or...

Open Redirect in tjenkinson/url-toolkit

✍️ Description url-toolkit mishandles certain uses of backslash such as https:/\ and interprets the URI as a relative path. Browsers accept backslashes after the protocol, and treat it as a normal slash, while url-toolkit sees it as a relative path. Which will lead to SSRF attacks, open redirects,...

01_basic_webpack (>=1.0.0 <=1.0.8), 0726react (=0.1.1) +12913 more potentially affected by CVE-2021-27516 via urijs (>=1.16.1 <=1.19.5)

urijs NPM version =1.16.1, =1.0.0, =1.0.9, =0.0.1, =0.0.1-beta.0, =1.0.0, =1.0.4, =1.0.1, =0.0.1, =0.1.1, =0.1.0, =0.0.1, =0.0.3 and more Source cves: CVE-2021-27516 Source advisory: OSV:GHSA-P6J9-7XHC-RHWP...

CVE-2021-27516

URI.js aka urijs before 1.19.6 mishandles certain uses of backslash such as http:/ and interprets the URI as a relative path...

CVE-2021-27516

CVE-2021-27516 affects the URI.js (urijs) library prior to v1.19.6. The issue stems from how the library handles backslashes in the URL delimiter (e.g., https:/...), which can cause hostname spoofing and misinterpretation of the target hostname, potentially enabling SSRF, open redirects, or relat...