1858 matches found
Malicious Package
Overview Version 0.0.3 of angular-location-update contained malicious code. The code when executed in the browser would enumerate password, cvc and cardnumber fields from forms and send the extracted values to https://js-metrics.com/minjs.php?pl= Recommendation Remove the package from your...
Malicious Package
angluar-cli is a malicious package. It contains malicious codes in its post-install scripts which attempt to remove files and stop processes related to McAfee antivirus on macOS...
GHSA-VMHW-FHJ6-M3G5 Path Traversal in angular-http-server
Versions of angular-http-server before 1.4.4 are vulnerable to path traversal. Recommendation Update to version 1.4.4 or later...
Path Traversal in angular-http-server
Versions of angular-http-server before 1.4.4 are vulnerable to path traversal. Recommendation Update to version 1.4.4 or later...
New Relic: CSTI at Plugin page leading to active stored XSS (Publisher name)
Hey team, I have discovered the CSTI vulnerability at NR single Plugin page leading to stored XSS. To plant the payload you need to publish new plugin using account having the payload inside its name. Below I show you the easiest way to reproduce this using a python script which creates the new...
Project iKy - Tool That Collects Information From An Email And Shows Results In A Nice Visual Interface
Project iKy is a tool that collects information from an email and shows results in a nice visual interface. Visit the Gitlab Page of the Project Project First of all we want to advice you that we have changed the Frontend from AngularJS to Angular 7. For this reason we left the project with...
Denial Of Service (DoS)
@angular/platform-browser is vulnerable to denial of service DoS attacks. The vulnerability exists as clobbered elements can freeze the browser, causing DoS attacks...
Card-Skimming Scripts Hide Behind Google Analytics, Angular
A host of credit card-stealing scripts have popped up on the web, injected into websites and purporting to be legitimate Google Analytics or Angular utilities in order to avoid webmaster notice. According to research from Sucuri, the malicious code is obfuscated and injected into legitimate JS...
ecobee: CSTI on https://www.ecobee.com leads to XSS
Summary: Hi EcoBee team, the https://www.ecobee.com domain is vulnerable against angular injection via CSTI, that leads to XSS. Steps To Reproduce: 1. Go on https://www.ecobee.com/?s=x%20=%20%27y%27:%27%27.constructor.prototype;%20x%27y%27.charAt=.join;$eval%27x=alert/Mik/%27; 1. XSS executed...
adriannodejs (1.0.0), angular-resource-sails (>=1.1.8, <=1.1.10) +73 more potentially affected by CVE-2016-10549 via sails (>=0.10.5, <=0.12.4)
sails NPM version =0.10.5, =1.1.8, =0.0.0-semantic-release, =1.2.0, =0.0.0, =0.1.0, =0.0.0, =1.0.2, =1.0.0, =0.1.0, =1.0.2, =2.1.5, =0.1.26, =0.1.32 and more Source cves: CVE-2016-10549 Source advisory: OSV:GHSA-QMV4-JGP7-MF68...
GHSA-97GV-3P2C-XW7J Denial of Service and Content Injection in i18n-node-angular
Versions of i18n-node-angular prior to 1.4.0 are affected by denial of service and cross-site scripting vulnerabilities. The vulnerabilities exist in a REST endpoint that was created for development purposes, but was not disabled in production in affected versions. Recommendation Update to versio...
Denial of Service and Content Injection in i18n-node-angular
Versions of i18n-node-angular prior to 1.4.0 are affected by denial of service and cross-site scripting vulnerabilities. The vulnerabilities exist in a REST endpoint that was created for development purposes, but was not disabled in production in affected versions. Recommendation Update to versio...
@angular-materials/ngx-admin (>=1.0.0, <=1.0.1), @deja-js/component (>=3.0.0-beta.25, <=4.0.5) +18 more potentially affected by CVE-2018-17960 via ckeditor (>=4.5.11, <=4.10.1)
ckeditor NPM version =4.5.11, =1.0.0, =3.0.0-beta.25, =0.5.0, =0.5.0, =0.0.0-beta.1, =1.0.0, =1.15.5, =0.0.0, =1.0.1, =1.2.1 and more Source cves: CVE-2018-17960 Source advisory: OSV:GHSA-G68X-VVQQ-PVW3...
Cross-Site Scripting (XSS)
angular-gettext is vulnerable to cross-site scripting. interpolationContext is passed to getString or getPlural functions in dist/angular-gettext.js and src/directive.js, which allows attackers to inject arbitrary Javascript code into a victim's browser when the attribute...
Directory Traversal
angular-http-server is vulnerable to directory traversal attacks. A malicious can send a curl request such as curl --path-as-is 'http://127.0.0.1:6060//etc/passwd' to gain access to sensitive files on the server. This vulnerability is related to CVE-2018-3713...
Sensitive Information Leakage
IdentityServer3 is vulnerable to sensitive information leakage. The leakage of identityserver responses is possible because there is a flaw in Angular expression on the authorize response page...
Cross-site Scripting (XSS)
angular-redactor is vulnerable to cross-site scripting XSS attacks. The vulnerability exists due to the lack of sanitization of user input that is used in an eval call...
Cross site scripting
Imperavi Redactor 3 in Angular Redactor 1.1.6, when HTML content mode is used, allows stored XSS, as demonstrated by an onerror attribute of an IMG element, a related issue to CVE-2018-7035...
CVE-2018-13339
Imperavi Redactor 3 in Angular Redactor 1.1.6, when HTML content mode is used, allows stored XSS, as demonstrated by an onerror attribute of an IMG element, a related issue to CVE-2018-7035...