angular Prototype Pollution vulnerability

Versions of angular prior to 1.7.9 are vulnerable to prototype pollution. The deprecated API function merge does not restrict the modification of an Object's prototype in the , which may allow an attacker to add or modify an existing property that will exist on all objects. Recommendation Upgrade...

@amitport/useful (>=0.5.0, <=0.5.2), @arivazhagan/demo-project (1.0.1) +968 more potentially affected by CVE-2019-10768 via angular (>=1.0.8, <=1.7.8)

angular NPM version =1.0.8, =0.5.0, =0.0.8, =2.3.0, =1.5.8, =2.8.3-2, =0.1.0, =1.0.0, =0.0.7, =0.0.1, =0.2.24, =0.0.1, =0.0.1, =0.0.5, =0.1.7 and more Source cves: CVE-2019-10768 Source advisory: OSV:GHSA-89MQ-4X47-5V83...

@amitport/useful (>=0.5.0, <=0.5.2), @arivazhagan/demo-project (1.0.1) +969 more potentially affected by CVE-2019-10768 via angular (>=0.0.1, <=1.7.8)

angular NPM version =0.0.1, =0.5.0, =0.0.8, =2.3.0, =1.5.8, =2.8.3-2, =0.1.0, =1.0.0, =0.0.7, =0.0.1, =0.2.24, =0.0.1, =0.0.1, =0.0.5, =0.1.7 and more Source cves: CVE-2019-10768 Source advisory: MEND:CVE-2019-10768...

@nuskin/ns-agelocme-core (>=0.1.0, <=3.35.0), @nuskin/ns-agelocme-mobile (>=0.1.0, <=3.14.2) +28 more potentially affected by CVE-2019-10768 via angular-touch (>=1.4.5, <=1.5.11)

angular-touch NPM version =1.4.5, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.14.2, =0.0.1, =0.0.2 and more Source cves: CVE-2019-10768 Source advisory: MEND:CVE-2019-10768...

@amitport/useful (>=0.5.0, <=0.5.2), @covisint/cui-idm-b2x (>=1.2.4, <=1.3.0) +58 more potentially affected by CVE-2019-10768 via angular-messages (>=1.3.20, <=1.5.11)

angular-messages NPM version =1.3.20, =0.5.0, =1.2.4, =0.2.0, =0.1.0, =0.1.0, =0.0.5-SNAPSHOT.11, =0.0.1, =1.0.0, =0.0.6-01badfa5-e3a7-42b4-b57b-a742eb65fee6, =0.10.4, =1.3.0, =0.0.8, =0.0.10, =1.1.9, =0.0.1, =0.0.2 and more Source cves: CVE-2019-10768 Source advisory: MEND:CVE-2019-10768...

@cobrowser/cb_services (>=0.2.7, <=1.1.17), @covisint/cui-i18n (>=1.0.0, <=1.0.45) +75 more potentially affected by CVE-2019-10768 via angular-cookies (>=1.2.27, <=1.5.11)

angular-cookies NPM version =1.2.27, =0.2.7, =1.0.0, =1.0.1, =1.2.6, =1.0.0, =1.0.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =3.14.2 and more Source cves: CVE-2019-10768 Source advisory: MEND:CVE-2019-10768...

@covisint/cui-i18n (>=1.0.0, <=1.0.45), @covisint/cui-idm-b2x (>=1.0.1, <=1.3.0) +10 more potentially affected by CVE-2019-10768 via angular-i18n (>=1.2.32, <=1.5.11)

angular-i18n NPM version =1.2.32, =1.0.0, =1.0.1, =8.0.0, =0.0.1, =2.8.46, =2.8.16, =0.0.5, =1.0.0, =1.2.0, =1.24.0 Source cves: CVE-2019-10768 Source advisory: MEND:CVE-2019-10768...

@cobrowser/cb_services (>=0.2.7, <=1.1.17), @covisint/cui-i18n (>=1.0.0, <=1.0.45) +153 more potentially affected by CVE-2019-10768 via angular-sanitize (>=1.2.27, <=1.5.11)

angular-sanitize NPM version =1.2.27, =0.2.7, =1.0.0, =1.0.1, =1.0.0, =3.0.2, =3.0.11, =3.0.1, =3.0.7, =3.2.17, =3.0.62, =3.0.0, =3.0.1, =3.0.6, =1.0.0, =1.4.3 and more Source cves: CVE-2019-10768 Source advisory: MEND:CVE-2019-10768...

@bb-cli/bb-test-plugin-ngmock (1.5.8), @dbx/apx-lib (>=1.2.6, <=2.1.7) +80 more potentially affected by CVE-2019-10768 via angular-mocks (>=1.2.32, <=1.5.11)

angular-mocks NPM version =1.2.32, =1.2.6, =0.1.0, =1.0.4, =26.0.1, =1.0.4, =1.1.24, =1.0.3, =1.0.12, =1.0.7, =0.1.0, =0.1.0, =0.1.0, =3.14.2 and more Source cves: CVE-2019-10768 Source advisory: MEND:CVE-2019-10768...

@amitport/useful (>=0.5.0, <=0.5.2), @bloomreach/hippo-theme (2.2.3) +46 more potentially affected by CVE-2019-10768 via angular-aria (>=1.4.5, <=1.5.11)

angular-aria NPM version =1.4.5, =0.5.0, =1.0.0, =1.0.0, =1.2.1, =2.4.0, =0.10.4, =4.0.0, =0.2.4, =0.0.4, =0.0.10, =0.0.1, =1.1.9, =2.1.9, =2.1.13 and more Source cves: CVE-2019-10768 Source advisory: MEND:CVE-2019-10768...

@amitport/useful (>=0.5.0, <=0.5.2), @nuskin/ns-agelocme-core (>=0.1.0, <=3.35.0) +84 more potentially affected by CVE-2019-10768 via angular-route (>=1.2.17-build.163.1, <=1.5.11)

angular-route NPM version =1.2.17-build.163.1, =0.5.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =3.1.53 - @ohos-ports/nuskin-ns-agelocme-mobile 3.14.2-beta.0 - @ohos-ports/nuskin-ns-checkout-mobile 3.14.2-beta.0 - @openmrs/openmrs-contrib-uicommons...

hslayers-ng (>=0.4.1, <=0.5.4) potentially affected by CVE-2019-10768 via angular-loader (1.4.14)

angular-loader NPM version 1.4.14 is affected by a known vulnerability. The following packages have a transitive dependency on angular-loader and may be impacted: - hslayers-ng =0.4.1, =0.5.4 Source cves: CVE-2019-10768 Source advisory: MEND:CVE-2019-10768...

@cobrowser/cb_services (>=0.2.7, <=1.1.17), @covisint/cui-i18n (>=1.0.0, <=1.0.45) +93 more potentially affected by CVE-2019-10768 via angular-resource (>=1.3.15, <=1.5.11)

angular-resource NPM version =1.3.15, =0.2.7, =1.0.0, =1.0.1, =1.0.2, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =3.34.67 and more Source cves: CVE-2019-10768 Source advisory: MEND:CVE-2019-10768...

@amitport/useful (>=0.5.0, <=0.5.2), @bloomreach/hippo-theme (2.2.3) +148 more potentially affected by CVE-2019-10768 via angular-animate (>=1.2.32, <=1.5.11)

angular-animate NPM version =1.2.32, =0.5.0, =1.2.1, =1.0.0, =1.0.0, =3.2.13, =3.0.11, =3.0.1, =3.0.7, =3.2.17, =3.0.62, =3.0.0, =3.0.1, =3.3.1 and more Source cves: CVE-2019-10768 Source advisory: MEND:CVE-2019-10768...

PT-2020-9608

Name of the Vulnerable Software and Affected Versions angular versions prior to 1.5.0-beta.0 angular versions prior to 1.5.0-beta.1 Description The issue allows attackers to execute arbitrary JavaScript in a victim's browser if the xlink:href attribute value is user-controlled, due to the package...

@amitport/useful (>=0.5.0, <=0.5.2), @arivazhagan/demo-project (1.0.1) +837 more potentially affected by CVE-2019-10768 via angular (>=1.4.0, <=1.7.8)

angular NPM version =1.4.0, =0.5.0, =0.0.8, =2.3.0, =1.5.8, =2.8.3-2, =0.1.0, =1.0.0, =0.0.7, =0.0.1, =0.2.24, =0.0.1, =0.0.1, =0.0.5, =0.1.7 and more Source cves: CVE-2019-10768 Source advisory: SNYK:JS-ANGULAR-534884...

Prototype Pollution

Overview Affected versions of this package are vulnerable to Prototype Pollution. The function merge could be tricked into adding or modifying properties of Object.prototype using a proto payload. PoC by Snyk angular.merge, JSON.parse'"proto": "xxx": "polluted"'; console.log.xxx; Details Prototyp...

Prototype Pollution

Overview angular is a package that lets you write client-side web applications as if you had a smarter browser. It also lets you use HTML as your template language and lets you extend HTML’s syntax to express your application’s components clearly and succinctly. Affected versions of this package...

Cross-Site Scripting (XSS)

angular is vulnerable to cross-site scripting XSS. There is no $sce protection against linkhref, which would allow a remote attacker to inject arbitrary Javascript into a victim's browser via RESOURCEURL...

CVE-2019-14863

A cross-site scripting XSS flaw was found in Angular. This flaw occurs due to improper sanitation of xlink:href attributes, which allows the web application to deliver data to users, along with other trusted content, without proper validation...