CVE-2022-0613

A flaw was found in urijs due to the fix of CVE-2021-3647 not considering case-sensitive protocol schemes in the URL. This issue allows attackers to bypass the patch...

@accordproject/cicero-cli (>=0.3.4, <=0.22.3-20220223023655), @accordproject/cicero-common (>=0.3.4, <=0.3.12) +479 more potentially affected by CVE-2022-0613 via urijs (>=1.16.1, <=1.19.7)

urijs NPM version =1.16.1, =0.3.4, =0.3.4, =0.3.4, =0.3.4, =0.4.5-20180705184508, =0.11.2-20190326183124, =0.10.2-20190213145246, =0.22.2-20210714131804, =0.0.5-20190507210024, =0.71.8-20190915045234, =0.80.2-20190926121100, =0.80.4-20191003231621, =0.61.2-20190916200303, =0.90.1-20200514190616,...

GHSA-GCV8-GH4R-25X6 Authorization Bypass Through User-Controlled Key in urijs

Attacker can use case-insensitive protocol schemes like HTTP, htTP, HTtp etc. in order to bypass the patch for CVE-2021-3647...

Authorization Bypass Through User-Controlled Key in urijs

Attacker can use case-insensitive protocol schemes like HTTP, htTP, HTtp etc. in order to bypass the patch for CVE-2021-3647...

CVE-2022-0613

Authorization Bypass Through User-Controlled Key in NPM urijs prior to 1.19.8...

CVE-2022-0613

Authorization Bypass Through User-Controlled Key in NPM urijs prior to 1.19.8...

CVE-2022-0613

Authorization Bypass Through User-Controlled Key in NPM urijs prior to 1.19.8...

Authorization

Authorization Bypass Through User-Controlled Key in NPM urijs prior to 1.19.8...

UBUNTU-CVE-2022-0613

Authorization Bypass Through User-Controlled Key in NPM urijs prior to 1.19.8...

CVE-2022-0613 Authorization Bypass Through User-Controlled Key in medialize/uri.js

Authorization Bypass Through User-Controlled Key in NPM urijs prior to 1.19.8...

CVE-2022-0613

CVE-2022-0613 affects the urijs (URI.js) npm package prior to 1.19.8. The issue is described as an Authorization Bypass Through User-Controlled Key, with related sources noting that the URI.js library could bypass host validation and enable open Redirect/SSRF scenarios. The vulnerability is assoc...

urijs 安全漏洞

urijs is a Javascript URL mutation library. A security vulnerability exists in urijs prior to 1.19.8, which stems from a user control key bypassing authorization...

Important: Red Hat Security Advisory: Red Hat Quay v3.6.0 security, bug fix and enhancement update

An update is now available for Red Hat Quay 3. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in the...

URIjs Vulnerable to Hostname spoofing via backslashes in URL

Impact If using affected versions to determine a URL's hostname, the hostname can be spoofed by using a combination of backslash \ and slash / characters as part of the scheme delimiter, e.g. scheme:///\hostname. If the hostname is used in security decisions, the decision may be incorrect...

@accordproject/cicero-cli (>=0.3.4, <=0.22.3-20211027130006), @accordproject/cicero-common (>=0.3.4, <=0.3.12) +473 more potentially affected by CVE-2021-3647 via urijs (>=1.16.1, <=1.19.6)

urijs NPM version =1.16.1, =0.3.4, =0.3.4, =0.3.4, =0.3.4, =0.4.5-20180705184508, =0.11.2-20190326183124, =0.10.2-20190213145246, =0.22.2-20210714131804, =0.0.5-20190507210024, =0.71.8-20190915045234, =0.80.2-20190926121100, =0.80.4-20191003231621, =0.61.2-20190916200303, =0.90.1-20200514190616,...

GHSA-89GV-H8WF-CG8R URIjs Vulnerable to Hostname spoofing via backslashes in URL

Impact If using affected versions to determine a URL's hostname, the hostname can be spoofed by using a combination of backslash \ and slash / characters as part of the scheme delimiter, e.g. scheme:///\hostname. If the hostname is used in security decisions, the decision may be incorrect...

Security Bulletin: A security vulnerability in Node.js urijs module affects IBM Cloud Pak for Multicloud Management Infrastructure management.

Summary A security vulnerability in Node.js urijs module affects IBM Cloud Pak for Multicloud Management Infrastructure management. Vulnerability Details CVEID: CVE-2020-26291 DESCRIPTION: Node.js urijs module could allow a remote attacker to conduct spoofing attacks, caused by improper input...

CVE-2021-27516

A flaw was found in nodejs-urijs where URI.js urijs mishandles certain uses of the backslash such as http:/ and interprets the URI as a relative path. The highest threat from this vulnerability is to confidentiality...

Hostname spoofing via backslashes in URL

Overview Impact urijs before version 1.19.6 is affected by hostname spoofing issue. If using urijs to determine a URL's hostname, the hostname can be spoofed by using a backslash \ character as part of the scheme delimiter, e.g. scheme:/\hostname. If the hostname is used in security decisions, th...

URIjs Hostname spoofing via backslashes in URL

Impact If using affected versions to determine a URL's hostname, the hostname can be spoofed by using a backslash \ character as part of the scheme delimiter, e.g. scheme:/\hostname. If the hostname is used in security decisions, the decision may be incorrect. Depending on library usage and...