@acaisoft/angular-azure-maps (>=0.0.3, <=0.0.11), @afelio/sprb-osiris-uikit (1.0.48) +287 more potentially affected by CVE-2021-4231 via @angular/platform-browser-dynamic (>=5.0.0, <=5.2.10)

@angular/platform-browser-dynamic NPM version =5.0.0, =0.0.3, =2.0.0-032f1237f0e7996aee56611b974f6fa6aa39fa70, =2.0.0-032f1237f0e7996aee56611b974f6fa6aa39fa70, =2.0.0-032f1237f0e7996aee56611b974f6fa6aa39fa70, =2.0.0-032f1237f0e7996aee56611b974f6fa6aa39fa70, =0.0.2, =1.0.0-beta.1, =0.1.6, =3.0.0,...

@amicus/auth (>=1.0.3, <=1.1.5), @amicus/broadcasting (>=1.0.3, <=1.1.5) +149 more potentially affected by CVE-2021-4231 via @angular/platform-server (>=4.0.0, <=4.4.6)

@angular/platform-server NPM version =4.0.0, =1.0.3, =1.0.3, =1.0.3, =1.1.1, =3.0.0-beta.45, =0.2.1, =0.2.1, =0.2.1, =0.2.1, =0.2.0, =0.2.1, =0.2.1, =2.0.2, =0.0.1, =0.0.21 - @kouki-o/angular-custom-tour 0.0.19 and more Source cves: CVE-2021-4231 Source advisory: MEND:CVE-2021-4231...

CVE-2021-4231

A vulnerability was found in Angular up to 11.0.4/11.1.0-next.2. It has been classified as problematic. Affected is the handling of comments. The manipulation leads to cross site scripting. It is possible to launch the attack remotely but it might require an authentication first. Upgrading to...

CVE-2021-4231 Angular Comment cross site scripting

A vulnerability was found in Angular up to 11.0.4/11.1.0-next.2. It has been classified as problematic. Affected is the handling of comments. The manipulation leads to cross site scripting. It is possible to launch the attack remotely but it might require an authentication first. Upgrading to...

CVE-2021-4231 Angular Comment cross site scripting

A vulnerability was found in Angular up to 11.0.4/11.1.0-next.2. It has been classified as problematic. Affected is the handling of comments. The manipulation leads to cross site scripting. It is possible to launch the attack remotely but it might require an authentication first. Upgrading to...

@c8y/apps (>=9.16.1-rc.0, <=9.24.2-rc.0), @mediafly/js-ui (>=26.3.13, <=28.4.3) +3 more potentially affected by CVE-2021-4231 via @angular/upgrade (>=6.0.3, <=6.1.9)

@angular/upgrade NPM version =6.0.3, =9.16.1-rc.0, =26.3.13, =2.0.0, =0.3.19, =0.5.6 - path-framework-urechmat 0.5.4 Source cves: CVE-2021-4231 Source advisory: MEND:CVE-2021-4231...

@bb-cli/schematics (>=0.0.1-alpha.1, <=3.3.1), @flowaccount/nx-serverless (>=0.0.1, <=0.0.2) +24 more potentially affected by CVE-2021-4231 via @angular/compiler-cli (>=8.0.0, <=8.2.12)

@angular/compiler-cli NPM version =8.0.0, =0.0.1-alpha.1, =0.0.1, =1.0.1, =1.2.0, =1.0.1, =1.7.113-beta.0, =1.10.0, =8.4.0-beta.4, =8.4.0-beta.5, =8.4.0-beta.4, =8.5.0-beta.1, =8.4.0-beta.4, =8.4.0-beta.3, =8.8.0-beta.4 and more Source cves: CVE-2021-4231 Source advisory: MEND:CVE-2021-4231...

@beenotung/tslib (>=1.0.0, <=3.4.1), @blackbaud-bobbyearl/skyux-builder (>=1.10.0, <=1.10.1) +199 more potentially affected by CVE-2021-4231 via @angular/compiler-cli (>=4.0.0, <=4.4.6)

@angular/compiler-cli NPM version =4.0.0, =1.0.0, =1.10.0, =1.10.1, =0.2.1, =0.2.1, =0.2.1, =0.2.1, =0.2.0, =0.2.1, =0.2.1, =0.0.1, =0.1.0, =2.4.6-scm.5, =2.4.9 and more Source cves: CVE-2021-4231 Source advisory: MEND:CVE-2021-4231...

@chat21/chat21-ionic (>=1.0.2-1.beta.1, <=2.0.14), @hmcts/ccd-case-ui-toolkit (>=2.4.0, <=7.0.19-case-flags-case-level-flag-table-display) +19 more potentially affected by CVE-2021-4231 via @angular/compiler-cli (>=7.0.0, <=7.2.13)

@angular/compiler-cli NPM version =7.0.0, =1.0.2-1.beta.1, =2.4.0, =1.0.1, =2.2.3-alpha.0, =4.44.6-alpha.10, =1.3.2, =3.0.0, =0.0.1, =1.2.1-beta.777, =0.0.1, =0.0.7, =3.1.0, =0.0.0-sr4, =4.0.0-beta.0, =4.0.1-beta.0 and more Source cves: CVE-2021-4231 Source advisory: MEND:CVE-2021-4231...

CVE-2021-4231: Improper Neutralization of Input During Web Page Generation

A vulnerability was found in Angular up to 11.0.4/11.1.0-next.2. It has been classified as problematic. Affected is the handling of comments. The manipulation leads to cross site scripting. It is possible to launch the attack remotely but it might require an authentication first. Upgrading to...

PT-2022-11586

Name of the Vulnerable Software and Affected Versions Angular versions 11.0.4 through 11.1.0-next.2 Description A vulnerability was found in the handling of comments, which can lead to cross site scripting. The manipulation can be launched remotely, but it might require authentication first...

@angular-devkit/build-angular (>=0.8.8, <=0.900.0-rc.8), @apployees-nx/node (>=0.0.1, <=0.0.21) +159 more potentially affected by CVE-2019-15598 via tree-kill (>=1.0.0, <=1.2.1)

tree-kill NPM version =1.0.0, =0.8.8, =0.0.1, =0.0.1-alpha.1, =1.2.2, =6.0.0-beta.0, =0.0.1, =0.0.1, =2.0.0-beta.22, =2.0.0-beta.1, =1.0.0, =0.0.1, =0.2.0, =7.0.2 and more Source cves: CVE-2019-15598 Source advisory: OSV:GHSA-J7FQ-P9Q7-5WFV...

Security Bulletin: A security vulnerability has been identified in Angular shipped with Tivoli Business Service Manager (CVE-2022-25844)

Summary Angular is shipped with IBM Tivoli Business Service Manager. Information about a security vulnerability affecting Angular has been published in a security bulletin. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affected Products and Versions...

angular-lunarc-blog (>=0.0.1, <=0.0.3), angular-lunarc-core (>=0.0.2, <=0.0.5) +15 more potentially affected by CVE-2018-11537 via angular-jwt (>=0.0.7, <=0.1.9)

angular-jwt NPM version =0.0.7, =0.0.1, =0.0.2, =0.0.1, =4.0.0, =1.0.0, =2.0.0, =4.0.0, =3.0.19, =3.1.0, =7.0.0, =3.0.0, =1.0.0-alpha.6, =0.2.4, =0.0.1, =0.5.0 and more Source cves: CVE-2018-11537 Source advisory: OSV:GHSA-VM2P-F5J4-MJ6G...

Auth0 angular-jwt misinterprets allowlist as regex

Auth0 angular-jwt before 0.1.10 treats whiteListedDomains entries as regular expressions, which allows remote attackers with knowledge of the jwtInterceptorProvider.whiteListedDomains setting to bypass the domain allowlist filter via a crafted domain. For example, if the setting is initialized...

GHSA-VM2P-F5J4-MJ6G Auth0 angular-jwt misinterprets allowlist as regex

Auth0 angular-jwt before 0.1.10 treats whiteListedDomains entries as regular expressions, which allows remote attackers with knowledge of the jwtInterceptorProvider.whiteListedDomains setting to bypass the domain allowlist filter via a crafted domain. For example, if the setting is initialized...

GHSA-88FH-8979-Q2RR Angular Redactor XSS Vulnerability

Imperavi Redactor 3 in Angular Redactor 1.1.6, when HTML content mode is used, allows stored XSS, as demonstrated by an onerror attribute of an IMG element, a related issue to CVE-2018-7035...

Angular Redactor XSS Vulnerability

Imperavi Redactor 3 in Angular Redactor 1.1.6, when HTML content mode is used, allows stored XSS, as demonstrated by an onerror attribute of an IMG element, a related issue to CVE-2018-7035...

Regular Expression Denial Of Service (ReDoS)

angular is vulnerable to regular expression denial of service. An attacker can crash the application by providing a very high value of custom locale rule through the posPre attribute in the parsePattern function of parser.js...

10.30.npm-learning (>=1.0.0, <=1.1.0), 2017_node (1.0.0) +2678 more potentially affected by CVE-2022-25844 via angular (>=1.7.0, <=1.8.3)

angular NPM version =1.7.0, =1.0.0, =4.13.7-rc4, =1.103.1, =1.103.1, =1.102.4, =1.102.3, =1.102.3, =1.4.156, =1.0.3, =1.0.0, =1.0.0, =0.5.0, =0.5.2 and more Source cves: CVE-2022-25844 Source advisory: OSV:GHSA-M2H2-264F-F486...