GHSA-J9FQ-VWQV-2FM2 Server-Side Request Forgery (SSRF) in GitHub repository ionicabizau/parse-url

Server-Side Request Forgery SSRF in GitHub repository ionicabizau/parse-url prior to 8.1.0...

parse-url 安全漏洞

parse-url is an advanced url parser with git url support by the individual developer Ionică Bizău. A security vulnerability exists in parse-url prior to version 8.1.0, which stems from the fact that parse-url incorrectly parses the https url that follows it, identifying its protocol as ssh, and...

CVE-2022-3224: Misinterpretation of Input

Misinterpretation of Input in GitHub repository ionicabizau/parse-url prior to 8.1.0...

CVE-2022-2900

Server-Side Request Forgery SSRF in GitHub repository ionicabizau/parse-url prior to 8.1.0...

CVE-2022-2900

Server-Side Request Forgery SSRF in GitHub repository ionicabizau/parse-url prior to 8.1.0...

Server side request forgery (ssrf)

Server-Side Request Forgery SSRF in GitHub repository ionicabizau/parse-url prior to 8.1.0...

CVE-2022-2900

CVE-2022-2900 affects the npm package parse-url (GitHub: ionicabizau/parse-url) up to version 8.0.x; it is a Server-Side Request Forgery (SSRF) vulnerability that could allow a remote attacker to induce the server to perform requests on its behalf. The NVD/CVSS data assign a 9.1 CRITICAL base sco...

CVE-2022-2900 Server-Side Request Forgery (SSRF) in ionicabizau/parse-url

Server-Side Request Forgery SSRF in GitHub repository ionicabizau/parse-url prior to 8.1.0...

parse-url 代码问题漏洞

parse-url is an advanced url parser with git url support by the individual developer Ionică Bizău. A security vulnerability exists in parse-url versions prior to 8.1.0. An attacker exploited the vulnerability to perform a server-side request forgery attack...

CVE-2022-2900: Server-Side Request Forgery (SSRF)

Server-Side Request Forgery SSRF in GitHub repository ionicabizau/parse-url prior to 8.1.0...

parse-url cross-site scripting vulnerability

parse-url is an advanced url parser with git url support. A cross-site scripting vulnerability exists in parse-url versions prior to 7.0.0, which stems from the ability to run malicious JS code using ASCII characters starting with and all special escape characters starting with Unicode, which can...

Regular Expression Denial of Service (ReDoS)

Description I would like to report a Regular Expression Denial of Service ReDoS vulnerability in parse-url. It allows cause a denial of service when calling function parse-url. The ReDoS vulnerability is mainly due to the regex /git@|https?://\w.@+/|:,\w,-,,/+.git0,1/0,1/ and can be...

CVE-2022-0722

A flaw was found in the parse-url package. Affected versions of this package are vulnerable to information exposure due to an improper validation issue...

Cross Site Scripting via Improper Input Validation (parser differential)

Description I find that parse-url parses the following URL incorrectly and identifies protocol as ssh: javascript://n.com:-4294967297/?ab=--2509999973799371216494http://user:passser:[email protected]:-4294967297/?a /parseurlfuzz$ node -e 'const parseUrl = require"parse-url";...

CVE-2022-2217

A cross-site-scripting XSS flaw was found in the parse-url package of npm. This issue could allow an attacker to use escape characters to run malicious JavaScript code on a webpage that was generated by the affected package. The highest impact is to integrity and confidentiality...

File Protocol Spoofing

Description parse-url misinterpreting the file:// protocol when trying to match git urls. The following payload is certainly valid file protocol but is interpreted as ssh protocol. file:///etc/passwd?http://a:1:1 Proof of Concept // PoC.js const fs = require'fs'; var parseURL = require"parse-url"...

Cross-site Scripting (XSS)

parse-url is vulnerable to regular expression denial of service. The vulnerability exists due to a lack of input validation which allows an attacker to inject and execute malicious script via URL parameter...

Cross site scripting in parse-url

Cross-site Scripting XSS - Generic in GitHub repository ionicabizau/parse-url prior to 6.0.1...

Server-Side Request Forgery in parse-url

Server-Side Request Forgery SSRF in GitHub repository ionicabizau/parse-url prior to 7.0.0...

@candlelabs/sdk (>=1.0.1, <=1.0.2), candlelabssdk (1.0.0) potentially affected by CVE-2022-2217 via parse-url (6.0.0)

parse-url NPM version 6.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on parse-url and may be impacted: - @candlelabs/sdk =1.0.1, =1.0.2 - candlelabssdk 1.0.0 Source cves: CVE-2022-2217 Source advisory: OSV:GHSA-Q6WQ-5P59-983W...