CVE-2021-21277

angular-expressions is "angular's nicest part extracted as a standalone module for the browser and node". In angular-expressions before version 1.1.2 there is a vulnerability which allows Remote Code Execution if you call "expressions.compileuserControlledInput" where "userControlledInput" is tex...

Remote code execution

angular-expressions is "angular's nicest part extracted as a standalone module for the browser and node". In angular-expressions before version 1.1.2 there is a vulnerability which allows Remote Code Execution if you call "expressions.compileuserControlledInput" where "userControlledInput" is tex...

CVE-2021-21277

angular-expressions is "angular's nicest part extracted as a standalone module for the browser and node". In angular-expressions before version 1.1.2 there is a vulnerability which allows Remote Code Execution if you call "expressions.compileuserControlledInput" where "userControlledInput" is tex...

CVE-2021-21277

The CVE-2021-21277 issue affects angular-expressions prior to 1.1.2. Affected component: the expressions.compile(userControlledInput) path, where user input can bypass security via a complex payload (notably using the .constructor.constructor technique). In the browser, this could run arbitrary b...

CVE-2021-21277 Angular Expressions - Remote Code Execution

angular-expressions is "angular's nicest part extracted as a standalone module for the browser and node". In angular-expressions before version 1.1.2 there is a vulnerability which allows Remote Code Execution if you call "expressions.compileuserControlledInput" where "userControlledInput" is tex...

GHSA-J6PX-JWVV-VPWQ Angular Expressions - Remote Code Execution

Impact The vulnerability, reported by GoSecure Inc, allows Remote Code Execution, if you call expressions.compileuserControlledInput where userControlledInput is text that comes from user input. This time, the security of the package could be bypassed by using a more complex payload, using a...

opendocx-node (>=0.2.2-alpha, <=2.0.3), yatte (>=1.4.0-beta.12, <=3.0.0-alpha.1) potentially affected by CVE-2021-21277 via angular-expressions (1.0.0)

angular-expressions NPM version 1.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on angular-expressions and may be impacted: - opendocx-node =0.2.2-alpha, =1.4.0-beta.12, =3.0.0-alpha.1 Source cves: CVE-2021-21277 Source advisory: GHSA-J6PX-JWVV-VPWQ...

Angular Expressions - Remote Code Execution

Impact The vulnerability, reported by GoSecure Inc, allows Remote Code Execution, if you call expressions.compileuserControlledInput where userControlledInput is text that comes from user input. This time, the security of the package could be bypassed by using a more complex payload, using a...

opendocx-node (>=0.2.2-alpha, <=2.0.3), yatte (>=1.4.0-beta.12, <=3.0.0-alpha.1) potentially affected by CVE-2021-21277 via angular-expressions (1.0.0)

angular-expressions NPM version 1.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on angular-expressions and may be impacted: - opendocx-node =0.2.2-alpha, =1.4.0-beta.12, =3.0.0-alpha.1 Source cves: CVE-2021-21277 Source advisory:...

CVE-2021-21277: Improper Neutralization of Special Elements in Output Used by a Downstream Component

angular-expressions is "angular's nicest part extracted as a standalone module for the browser and node". In angular-expressions before version 1.1.2 there is a vulnerability which allows Remote Code Execution if you call "expressions.compileuserControlledInput" where "userControlledInput" is tex...

PT-2021-14383

Name of the Vulnerable Software and Affected Versions: angular-expressions versions prior to 1.1.2 Description: The issue allows Remote Code Execution if expressions.compileuserControlledInput is called where userControlledInput is text that comes from user input. The security of the package coul...

Peerigon angular-expressions code injection vulnerability

Peerigon angular-expressions is a Javascript-based codebase that can be used to extract browser nodes from Peerigon, Germany. A code injection vulnerability exists in angular-expressions 1.1.2, which allows remote code execution and can be exploited by an attacker to run any browser script...

Scullyio Scully 注入漏洞

Scullyio Scully is a Typescript-based software for building Angular applications organized by Scullyio.Scully pre-renders every page in the application as plain HTML and CSS.To do this, Scully uses guessjs to find all the routes in the project. Scully then accesses each route, renders the view an...

nodejs-angular: XSS due to regex-based HTML replacement

A XSS flaw was found in nodejs-angular. The regex-based input HTML replacement may turn sanitized code into unsanitized one. Wrapping "" elements in "" ones changes parsing behavior, leading to possibly unsanitizing code...

37fis (>=1.0.0, <=1.0.2), 3loc (>=0.2.0, <=0.4.0) +1852 more potentially affected by CVE-2020-7788 via ini (>=1.0.0, <=1.3.5)

ini NPM version =1.0.0, =1.0.0, =0.2.0, =0.13.31, =0.0.17, =1.0.0, =1.0.0, =6.1.3, =1.0.99, =0.0.1-beta.2, =0.0.1-beta.2, =0.0.1-beta.2, =6.2.9, =1.0.3, =0.2.333, =0.2.346 and more Source cves: CVE-2020-7788 Source advisory: SNYK:JS-INI-1048974...

imagemagick:encoder_heic_fuzzer: Use-of-uninitialized-value in void intra_prediction_angular<unsigned char>

Detailed Report: https://oss-fuzz.com/testcase?key=6200254067900416 Project: imagemagick Fuzzing Engine: libFuzzer Fuzz Target: encoderheicfuzzer Job Type: libfuzzermsanimagemagick Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: void intrapredictionangular vo...

Malicious Package in angular-location-update

Version 0.0.3 of angular-location-update contained malicious code. The code when executed in the browser would enumerate password, cvc and cardnumber fields from forms and send the extracted values to https://js-metrics.com/minjs.php?pl= Recommendation Remove the package from your environment and...

GHSA-53JX-4WWH-GCQJ Malicious Package in angular-location-update

Version 0.0.3 of angular-location-update contained malicious code. The code when executed in the browser would enumerate password, cvc and cardnumber fields from forms and send the extracted values to https://js-metrics.com/minjs.php?pl= Recommendation Remove the package from your environment and...

Malicious Package in angluar-cli

Version 0.0.3 of angluar-cli contains malicious code as a postinstall script. The package is malware designed to take advantage of users making a mistake when typing the name of a module to install. When installed the package attempts to remove files and stop processes related to McAfee antivirus...

PT-2020-21169

Name of the Vulnerable Software and Affected Versions angular-cli version 0.0.3 Description The issue concerns malicious code in a postinstall script. This malware is designed to exploit typing mistakes when installing modules, targeting macOS users. Upon installation, it attempts to remove files...