Skip to main content
Components
Vulnerabilities
Pricing
MCP
API
Docs
Sign up
Login
Find vulnerabilities. Fix fast with AI.
Search components by package, version, or CVE to get started.
org.webjars.bower/urijs 1.19.1 | Vulnerabi… | Sonatype Guide
Get full component data and automated fixes with Sonatype Guide.
Sign up for free
maven
org.webjars.bower
urijs
1.19.1
urijs 1.19.1
Latest
org.webjars.bower
Published
Feb 23, 2018
•
Policy
compliance
maven Registry
Developer Trust Score
Recommended Version:
x.y.z
Latest version with 0 known vulnerabilities that meets your policy.
Compare Versions
Overview
Overview
Versions
11
Versions
11
Vulnerabilities
8
Vulnerabilities
8
Dependencies
0
Dependencies
0
Reset filters
Severity
Critical
(0)
High
(0)
Medium
(6)
Low
(0)
CVSS Score
0.0
10.0
EPSS Score
0.0
1.0
Malware
KEV Status
Published
Filter
Sort: Published (Newest first)
6.1
sonatype-2022-2019
urijs - Improper Input Validation [CVE-2022-1243]
affected
Severity
Medium
Published
Apr 5, 2022
6.1
CVE-2022-1233
URL Confusion When Scheme Not Supplied in GitHub repository medialize/uri.js prior to 1.19.11.
affected
Severity
Medium
Published
Apr 4, 2022
6.1
CVE-2022-0868
Open Redirect in GitHub repository medialize/uri.js prior to 1.19.10.
affected
Severity
Medium
Published
Mar 7, 2022
5.3
CVE-2022-24723
URI.js is a Javascript URL mutation library. Before version 1.19.9, whitespace characters are not removed from the beginning of the protocol, so URLs are not parsed properly. This issue has been patched in version 1.19.9. Removing leading whitespace from values before passing them to URI.parse can be used as a workaround.
affected
Severity
Medium
Published
Mar 4, 2022
6.1
CVE-2021-3647
URI.js is vulnerable to URL Redirection to Untrusted Site
affected
Severity
Medium
Published
Jul 19, 2021
6.5
CVE-2020-26291
URI.js is a javascript URL mutation library (npm package urijs). In URI.js before version 1.19.4, the hostname can be spoofed by using a backslash (`\`) character followed by an at (`@`) character. If the hostname is used in security decisions, the decision may be incorrect. Depending on library usage and attacker intent, impacts may include allow/block list bypasses, SSRF attacks, open redirects, or other undesired behavior. For example the URL `https://expected-example.com\@observed-example.com` will incorrectly return `observed-example.com` if using an affected version. Patched versions correctly return `expected-example.com`. Patched versions match the behavior of other parsers which implement the WHATWG URL specification, including web browsers and Node's built-in URL class. Version 1.19.4 is patched against all known payload variants. Version 1.19.3 has a partial patch but is still vulnerable to a payload variant.]
affected
Severity
Medium
Published
Jan 1, 2021
