Incomplete Filtering of Special Elements

Overview org.webjars.npm:angular-sanitize is an AngularJS module for sanitizing HTML Affected versions of this package are vulnerable to Incomplete Filtering of Special Elements through the ngSanitize module. An attacker can manipulate image sources and perform content spoofing by injecting...

net.aequologica.neo:geppaequo-tags (>=0.5.3, <=0.6.0), net.aequologica.neo:geppaequo-web (>=0.5.3, <=0.6.0) +4 more potentially affected by CVE-2025-2336 via org.webjars.npm:angular-sanitize (>=1.5.0-beta.0, <=1.8.3)

org.webjars.npm:angular-sanitize MAVEN version =1.5.0-beta.0, =0.5.3, =0.5.3, =0.6.0 - org.webjars.npm:angular-auto-complete 1.7.4 - org.webjars.npm:angular-material-calendar 0.2.14 - org.webjars.npm:angular-schema-form 0.8.13 - org.webjars.npm:github-com-showdownjs-ng-showdown 1.1.0 Source cves:...

org.webjars:angular-markdown-directive (0.3.0) potentially affected by CVE-2025-2336 via org.webjars:angular-sanitize (1.2.16)

org.webjars:angular-sanitize MAVEN version 1.2.16 is affected by a known vulnerability. The following packages have a transitive dependency on org.webjars:angular-sanitize and may be impacted: - org.webjars:angular-markdown-directive 0.3.0 Source cves: CVE-2025-2336 Source advisory:...

40au-isteven-angular-multiselect (4.0.0), @0negativ/hawtio-integration (>=4.13.7-rc4, <=4.13.7-rc5) +501 more potentially affected by CVE-2025-2336 via angular-sanitize (>=1.3.11, <=1.8.3)

angular-sanitize NPM version =1.3.11, =4.13.7-rc4, =0.0.1, =0.0.1, =0.1.0, =2.0.0, =0.3.2, =0.2.7, =1.0.0, =1.0.0, =0.2.1, =0.0.1, =1.0.0, =3.0.2, =4.16.5 and more Source cves: CVE-2025-2336 Source advisory: OSV:GHSA-4P4W-6HG8-63WX...

40au-isteven-angular-multiselect (4.0.0), @0negativ/hawtio-integration (>=4.13.7-rc4, <=4.13.7-rc5) +501 more potentially affected by CVE-2025-2336 via angular-sanitize (>=1.3.11, <=1.8.3)

angular-sanitize NPM version =1.3.11, =4.13.7-rc4, =0.0.1, =0.0.1, =0.1.0, =2.0.0, =0.3.2, =0.2.7, =1.0.0, =1.0.0, =0.2.1, =0.0.1, =1.0.0, =3.0.2, =4.16.5 and more Source cves: CVE-2025-2336 Source advisory: GHSA-4P4W-6HG8-63WX...

Malware in frontegg-angular-sanity-check

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious code in frontegg-angular-sanity-check (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 85f18cbdaf7836cc4a267525da5ee029eb20efcf6f1ef0e2208a62448a14ef8f Any computer that has this package installed or running should be considered...

Malware in angular-tealium

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

MAL-2025-4550 Malicious code in angular-tealium (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a0c32462ecdeacbbbfee96fd4f6e31ce41d373f68b0ebb3ec17667e26a9ee66d Any computer that has this package installed or running should be considered...

Malicious code in angular-tealium (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a0c32462ecdeacbbbfee96fd4f6e31ce41d373f68b0ebb3ec17667e26a9ee66d Any computer that has this package installed or running should be considered...

CVE-2024-22200

vantage6-UI is the User Interface for vantage6. The docker image used to run the UI leaks the nginx version. To mitigate the vulnerability, users can run the UI as an angular application. This vulnerability was patched in 4.2.0...

CVE-2024-54152

Angular Expressions provides expressions for the Angular.JS web framework as a standalone module. Prior to version 1.4.3, an attacker can write a malicious expression that escapes the sandbox to execute arbitrary code on the system. With a more complex undisclosed payload, one can get full access...

CVE-2024-33665

angular-translate through 2.19.1 allows XSS via a crafted key that is used by the translate directive. NOTE: the vendor indicates that there is no documentation indicating that a key is supposed to be safe against XSS attacks...

CVE-2024-42640

angular-base64-upload prior to v0.1.21 is vulnerable to unauthenticated remote code execution via demo/server.php. Exploiting this vulnerability allows an attacker to upload arbitrary content to the server, which can subsequently be accessed through demo/uploads. This leads to the execution of...

CVE-2024-50577

In JetBrains YouTrack before 2024.3.47707 stored XSS was possible via Angular template injection in Hub settings...

CVE-2023-26270

IBM Security Guardium Data Encryption IBM Guardium Cloud Key Manager GCKM 1.10.3 could allow a remote attacker to execute arbitrary code on the system, caused by an angular template injection flaw. By sending specially crafted request, an attacker could exploit this vulnerability to execute...

CVE-2023-34840

angular-ui-notification v0.1.0, v0.2.0, and v0.3.6 was discovered to contain a cross-site scripting XSS vulnerability...

CVE-2021-21277

angular-expressions is "angular's nicest part extracted as a standalone module for the browser and node". In angular-expressions before version 1.1.2 there is a vulnerability which allows Remote Code Execution if you call "expressions.compileuserControlledInput" where "userControlledInput" is tex...

CVE-2019-17127

A Stored Client Side Template Injection CSTI with Angular was discovered in the SolarWinds Orion Platform 2019.2 HF1 in many application forms. An attacker can inject an Angular expression and escape the Angular sandbox to achieve stored XSS. This can lead to privilege escalation...

CVE-2019-17125

A Reflected Client Side Template Injection CSTI with Angular was discovered in the SolarWinds Orion Platform 2019.2 HF1 in many forms. An attacker can inject an Angular expression and escape the Angular sandbox to achieve stored XSS...