nodejs-angular: XSS due to regex-based HTML replacement

A XSS flaw was found in nodejs-angular. The regex-based input HTML replacement may turn sanitized code into unsanitized one. Wrapping "" elements in "" ones changes parsing behavior, leading to possibly unsanitizing code...

37fis (>=1.0.0, <=1.0.2), 3loc (>=0.2.0, <=0.4.0) +1852 more potentially affected by CVE-2020-7788 via ini (>=1.0.0, <=1.3.5)

ini NPM version =1.0.0, =1.0.0, =0.2.0, =0.13.31, =0.0.17, =1.0.0, =1.0.0, =6.1.3, =1.0.99, =0.0.1-beta.2, =0.0.1-beta.2, =0.0.1-beta.2, =6.2.9, =1.0.3, =0.2.333, =0.2.346 and more Source cves: CVE-2020-7788 Source advisory: SNYK:JS-INI-1048974...

imagemagick:encoder_heic_fuzzer: Use-of-uninitialized-value in void intra_prediction_angular<unsigned char>

Detailed Report: https://oss-fuzz.com/testcase?key=6200254067900416 Project: imagemagick Fuzzing Engine: libFuzzer Fuzz Target: encoderheicfuzzer Job Type: libfuzzermsanimagemagick Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: void intrapredictionangular vo...

Malicious Package in angular-location-update

Version 0.0.3 of angular-location-update contained malicious code. The code when executed in the browser would enumerate password, cvc and cardnumber fields from forms and send the extracted values to https://js-metrics.com/minjs.php?pl= Recommendation Remove the package from your environment and...

GHSA-53JX-4WWH-GCQJ Malicious Package in angular-location-update

Version 0.0.3 of angular-location-update contained malicious code. The code when executed in the browser would enumerate password, cvc and cardnumber fields from forms and send the extracted values to https://js-metrics.com/minjs.php?pl= Recommendation Remove the package from your environment and...

Malicious Package in angluar-cli

Version 0.0.3 of angluar-cli contains malicious code as a postinstall script. The package is malware designed to take advantage of users making a mistake when typing the name of a module to install. When installed the package attempts to remove files and stop processes related to McAfee antivirus...

PT-2020-21169

Name of the Vulnerable Software and Affected Versions angular-cli version 0.0.3 Description The issue concerns malicious code in a postinstall script. This malware is designed to exploit typing mistakes when installing modules, targeting macOS users. Upon installation, it attempts to remove files...

PT-2020-21042

Name of the Vulnerable Software and Affected Versions angular-location-update version 0.0.3 Description The issue concerns malicious code in version 0.0.3 of angular-location-update. When executed in a browser, this code enumerates password, cvc, and cardnumber fields from forms and sends the...

@dev-engage/engage-ionic (>=0.6.0, <=0.6.6), @ionic/angular (>=4.1.0-dev.201902122208.39fbc32, <=4.1.2) +2 more potentially affected by unknown CVE via @ionic/core (>=4.1.0, <=4.1.2-dev.201903141948.7d01207)

@ionic/core NPM version =4.1.0, =0.6.0, =4.1.0-dev.201902122208.39fbc32, =4.1.2 - @ionic/pwa-elements 1.0.2 - dos-wc-library 0.6.1 Source cves: unknown CVE Source advisory: OSV:GHSA-R3XC-47QG-H929...

@ionic/angular (>=4.3.0-dev.201904161617.4474974, <=4.3.0), dos-wc-library (>=0.7.7, <=0.7.21) potentially affected by unknown CVE via @ionic/core (4.3.0-dev.201904171418.07e739a)

@ionic/core NPM version 4.3.0-dev.201904171418.07e739a is affected by a known vulnerability. The following packages have a transitive dependency on @ionic/core and may be impacted: - @ionic/angular =4.3.0-dev.201904161617.4474974, =0.7.7, =0.7.21 Source cves: unknown CVE Source advisory:...

Malicious Package in angular-material-sidenav-rnd

Version 0.1.1 of angular-material-sidenav-rnd contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to https://js-metrics.com/minjs.php?pl= Recommendation If version 0.1.1 of this module is found...

GHSA-QMXF-FXQ7-W59F Malicious Package in angular-material-sidenav-rnd

Version 0.1.1 of angular-material-sidenav-rnd contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to https://js-metrics.com/minjs.php?pl= Recommendation If version 0.1.1 of this module is found...

GHSA-W8HG-MXVH-9H57 Malicious Package in angular-bmap

Version 0.0.9 of angular-bmap contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to https://js-metrics.com/minjs.php?pl= Recommendation If version 0.0.9 of this module is found installed you wil...

Malicious Package in angular-bmap

Version 0.0.9 of angular-bmap contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to https://js-metrics.com/minjs.php?pl= Recommendation If version 0.0.9 of this module is found installed you wil...

alchemymvc (0.0.1), alinkage (0.1.2) +216 more potentially affected by CVE-2012-6708 via jquery (>=1.5.1, <=1.8.3)

jquery NPM version =1.5.1, =0.1.0, =0.3.3, =0.0.2, =2.0.0, =2.0.1 - arale-tip 2.0.0 - artusi-auth 0.1.0-1 - artusi-drawer 0.1.0-1 - artusi-elevator 0.1.0-1 - artusi-filesystem-drawer 0.1.0-1 - artusi-hob 0.1.0-1 - artusi-kitchen 0.1.0-1 - artusi-kitchen-assistant 0.1.0-1 and more Source cves:...

XSS via Angular Expression in ag-grid

Affected versions of ag-grid are vulnerable to Cross-site Scripting XSS via Angular Expressions, if used in combination with AngularJS. Recommendation Avoid using ag-grid in combination with AngularJS until a fix is available...

angular-chart (0.2.3), bit-c3 (>=0.0.1, <=0.1.3) +4 more potentially affected by CVE-2016-1000240 via c3 (>=0.3.0, <=0.4.10)

c3 NPM version =0.3.0, =0.0.1, =3.1.0, =3.3.1 Source cves: CVE-2016-1000240 Source advisory: OSV:GHSA-GVG7-PP82-CFF3...

PT-2020-21546

Name of the Vulnerable Software and Affected Versions angular-bmap version 0.0.9 Description The issue concerns malicious code in version 0.0.9 of the angular-bmap module. When executed in a browser, this code enumerates sensitive fields such as password, cvc, and cardnumber from forms and sends...

PT-2020-21465

Name of the Vulnerable Software and Affected Versions angular-material-sidenav-rnd version 0.1.1 Description The issue concerns malicious code in version 0.1.1 of the angular-material-sidenav-rnd module. When executed in a browser, this code enumerates sensitive fields such as password, cvc, and...

Cross-site Scripting (XSS)

@progress/kendo-angular-editor is vulnerable to cross-site scripting XSS. The vulnerability exists as the value of the Editor content element passed through event handlers gets executed without sanitization...