Denial of Service and Content Injection in i18n-node-angular

Versions of i18n-node-angular prior to 1.4.0 are affected by denial of service and cross-site scripting vulnerabilities. The vulnerabilities exist in a REST endpoint that was created for development purposes, but was not disabled in production in affected versions. Recommendation Update to versio...

@angular-materials/ngx-admin (>=1.0.0, <=1.0.1), @deja-js/component (>=3.0.0-beta.25, <=4.0.5) +18 more potentially affected by CVE-2018-17960 via ckeditor (>=4.5.11, <=4.10.1)

ckeditor NPM version =4.5.11, =1.0.0, =3.0.0-beta.25, =0.5.0, =0.5.0, =0.0.0-beta.1, =1.0.0, =1.15.5, =0.0.0, =1.0.1, =1.2.1 and more Source cves: CVE-2018-17960 Source advisory: OSV:GHSA-G68X-VVQQ-PVW3...

Cross-Site Scripting (XSS)

angular-gettext is vulnerable to cross-site scripting. interpolationContext is passed to getString or getPlural functions in dist/angular-gettext.js and src/directive.js, which allows attackers to inject arbitrary Javascript code into a victim's browser when the attribute...

Directory Traversal

angular-http-server is vulnerable to directory traversal attacks. A malicious can send a curl request such as curl --path-as-is 'http://127.0.0.1:6060//etc/passwd' to gain access to sensitive files on the server. This vulnerability is related to CVE-2018-3713...

Sensitive Information Leakage

IdentityServer3 is vulnerable to sensitive information leakage. The leakage of identityserver responses is possible because there is a flaw in Angular expression on the authorize response page...

Cross-site Scripting (XSS)

angular-redactor is vulnerable to cross-site scripting XSS attacks. The vulnerability exists due to the lack of sanitization of user input that is used in an eval call...

Cross site scripting

Imperavi Redactor 3 in Angular Redactor 1.1.6, when HTML content mode is used, allows stored XSS, as demonstrated by an onerror attribute of an IMG element, a related issue to CVE-2018-7035...

CVE-2018-13339

Imperavi Redactor 3 in Angular Redactor 1.1.6, when HTML content mode is used, allows stored XSS, as demonstrated by an onerror attribute of an IMG element, a related issue to CVE-2018-7035...

CVE-2018-13339

Imperavi Redactor 3 in Angular Redactor 1.1.6, when HTML content mode is used, allows stored XSS, as demonstrated by an onerror attribute of an IMG element, a related issue to CVE-2018-7035...

CVE-2018-13339

Imperavi Redactor 3 in Angular Redactor 1.1.6, when HTML content mode is used, allows stored XSS, as demonstrated by an onerror attribute of an IMG element, a related issue to CVE-2018-7035...

CVE-2018-13339

Imperavi Redactor 3 in Angular Redactor 1.1.6, when HTML content mode is used, allows stored XSS, as demonstrated by an onerror attribute of an IMG element, a related issue to CVE-2018-7035...

CVE-2018-13339

CVE-2018-13339 affects Imperavi Redactor 3 in Angular Redactor 1.1.6 when HTML content mode is used, enabling a stored XSS as demonstrated by an onerror attribute in an IMG element; related to CVE-2018-7035. Several adjacent advisories (OSV/GHSA variants) describe the same XSS class and the root ...

CVE-2018-13339: Improper Neutralization of Input During Web Page Generation

Imperavi Redactor 3 in Angular Redactor 1.1.6, when HTML content mode is used, allows stored XSS, as demonstrated by an onerror attribute of an IMG element, a related issue to CVE-2018-7035...

PT-2018-11763

Name of the Vulnerable Software and Affected Versions Angular Redactor version 1.1.6 Description The issue allows for stored XSS attacks when HTML content mode is used in Imperavi Redactor 3. This can be demonstrated through the use of an onerror attribute of an IMG element. Recommendations For...

ShopNx - Arbitrary File Upload

ShopNx - Arbitrary File Upload Exploit Title: ShopNx - Angular5 Single Page Shopping Cart Application 1 - Arbitrary File Upload Date: 2018-07-03 Exploit Author: L0RD Email: [email protected] Vendor Homepage: http://codenx.com/ Version: 1 CVE: CVE-2018-12519 Tested on: Win 10...

angular-http-server path traversal vulnerability

angular-http-server is an HTTP server for deploying single page applications. A path traversal vulnerability exists in angular-http-server, which stems from the program's lack of checksums on possibleFilename. An attacker can exploit this vulnerability to read the contents of an arbitrary file wi...

Authorization Bypass

angular-jwt is vulnerable to authorization bypasses. The library's whitelist entries are treated as regular expressions meaning that the . separator will match any character. This allows a malicious user to set up a domain name to bypass the whitelist filter e.g. if the entry is example.entry.io,...

ShopNx 1 Arbitrary File Upload Vulnerability

ShopNx 1 an Angular 5 single page application. ShopNx 1 suffers from an arbitrary file upload vulnerability that allows an attacker to upload a malicious html file or other file containing a JavaScript payload to steal user credentials...

CVE-2018-11537

Auth0 angular-jwt before 0.1.10 treats whiteListedDomains entries as regular expressions, which allows remote attackers with knowledge of the jwtInterceptorProvider.whiteListedDomains setting to bypass the domain whitelist filter via a crafted domain...

Design/Logic Flaw

Auth0 angular-jwt before 0.1.10 treats whiteListedDomains entries as regular expressions, which allows remote attackers with knowledge of the jwtInterceptorProvider.whiteListedDomains setting to bypass the domain whitelist filter via a crafted domain...