CVE-2024-21490

This affects versions of the package angular from 1.3.0; versions of the package angularjs from 1.3.0. A regular expression used to split the value of the ng-srcset directive is vulnerable to super-linear runtime due to backtracking. With large carefully-crafted input, this can result in...

@amitport/useful (>=0.5.0, <=0.5.2), @bloomreach/hippo-theme (2.2.3) +148 more potentially affected by CVE-2024-21490 via angular-animate (>=1.2.32, <=1.5.11)

angular-animate NPM version =1.2.32, =0.5.0, =1.2.1, =1.0.0, =1.0.0, =3.2.13, =3.0.11, =3.0.1, =3.0.7, =3.2.17, =3.0.62, =3.0.0, =3.0.1, =3.3.1 and more Source cves: CVE-2024-21490 Source advisory: MEND:CVE-2024-21490...

@raptorjs/ng-portal (>=1.0.5, <=2.1.3) potentially affected by CVE-2024-21490 via angular-parse-ext (1.8.3)

angular-parse-ext NPM version 1.8.3 is affected by a known vulnerability. The following packages have a transitive dependency on angular-parse-ext and may be impacted: - @raptorjs/ng-portal =1.0.5, =2.1.3 Source cves: CVE-2024-21490 Source advisory: MEND:CVE-2024-21490...

hslayers-ng (>=0.4.1, <=0.5.4) potentially affected by CVE-2024-21490 via angular-loader (1.4.14)

angular-loader NPM version 1.4.14 is affected by a known vulnerability. The following packages have a transitive dependency on angular-loader and may be impacted: - hslayers-ng =0.4.1, =0.5.4 Source cves: CVE-2024-21490 Source advisory: MEND:CVE-2024-21490...

@covisint/cui-i18n (>=1.0.0, <=1.0.45), @covisint/cui-idm-b2x (>=1.0.1, <=1.3.0) +10 more potentially affected by CVE-2024-21490 via angular-i18n (>=1.2.32, <=1.5.11)

angular-i18n NPM version =1.2.32, =1.0.0, =1.0.1, =8.0.0, =0.0.1, =2.8.46, =2.8.16, =0.0.5, =1.0.0, =1.2.0, =1.24.0 Source cves: CVE-2024-21490 Source advisory: MEND:CVE-2024-21490...

10.30.npm-learning (>=1.0.0, <=1.1.0), 2017_node (1.0.0) +2860 more potentially affected by CVE-2024-21490 via angular (>=1.6.0, <=1.8.3)

angular NPM version =1.6.0, =1.0.0, =4.13.7-rc4, =1.103.1, =1.103.1, =1.102.4, =1.102.3, =1.102.3, =1.4.156, =1.0.3, =1.0.0, =1.0.0, =0.5.0, =0.5.2 and more Source cves: CVE-2024-21490 Source advisory: MEND:CVE-2024-21490...

@cobrowser/cb_services (>=0.2.7, <=1.1.17), @covisint/cui-i18n (>=1.0.0, <=1.0.45) +75 more potentially affected by CVE-2024-21490 via angular-cookies (>=1.2.27, <=1.5.11)

angular-cookies NPM version =1.2.27, =0.2.7, =1.0.0, =1.0.1, =1.2.6, =1.0.0, =1.0.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =3.14.2 and more Source cves: CVE-2024-21490 Source advisory: MEND:CVE-2024-21490...

40au-isteven-angular-multiselect (4.0.0), @appirio/demo-scoped-pkg (>=2.4.1, <=2.8.0) +160 more potentially affected by CVE-2024-21490 via angular-mocks (>=1.6.1, <=1.8.3)

angular-mocks NPM version =1.6.1, =2.4.1, =0.2.3, =2.3.0, =1.0.0, =2.8.3-2, =0.0.7, =0.0.1-rc.1, =0.0.1-alpha.0, =1.0.0, =0.2.0, =42.0.0-beta.0, =53.0.1 and more Source cves: CVE-2024-21490 Source advisory: MEND:CVE-2024-21490...

@amitport/useful (>=0.5.0, <=0.5.2), @nuskin/ns-agelocme-core (>=0.1.0, <=3.35.0) +84 more potentially affected by CVE-2024-21490 via angular-route (>=1.2.17-build.163.1, <=1.5.11)

angular-route NPM version =1.2.17-build.163.1, =0.5.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =3.1.53 - @ohos-ports/nuskin-ns-agelocme-mobile 3.14.2-beta.0 - @ohos-ports/nuskin-ns-checkout-mobile 3.14.2-beta.0 - @openmrs/openmrs-contrib-uicommons...

@adplenty-tech/adplenty-components-library (>=1.4.156, <=1.9.100), @alancnet/material-framework (>=1.0.3, <=1.0.18) +229 more potentially affected by CVE-2024-21490 via angular-aria (>=1.6.0, <=1.8.3)

angular-aria NPM version =1.6.0, =1.4.156, =1.0.3, =1.0.0, =1.0.0, =0.13.6, =1.0.1, =1.0.0, =1.0.0, =5.3.0, =1.0.1, =0.0.1, =1.0.5, =0.9.3, =0.1.0, =0.1.0, =0.18.9 and more Source cves: CVE-2024-21490 Source advisory: MEND:CVE-2024-21490...

@nuskin/ns-agelocme-core (>=0.1.0, <=3.35.0), @nuskin/ns-agelocme-mobile (>=0.1.0, <=3.14.2) +28 more potentially affected by CVE-2024-21490 via angular-touch (>=1.4.5, <=1.5.11)

angular-touch NPM version =1.4.5, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.14.2, =0.0.1, =0.0.2 and more Source cves: CVE-2024-21490 Source advisory: MEND:CVE-2024-21490...

CVE-2024-21490

This affects versions of the package angular from 1.3.0; versions of the package angularjs from 1.3.0. A regular expression used to split the value of the ng-srcset directive is vulnerable to super-linear runtime due to backtracking. With large carefully-crafted input, this can result in...

@cobrowser/cb_services (>=0.2.7, <=1.1.17), @covisint/cui-i18n (>=1.0.0, <=1.0.45) +153 more potentially affected by CVE-2024-21490 via angular-sanitize (>=1.2.27, <=1.5.11)

angular-sanitize NPM version =1.2.27, =0.2.7, =1.0.0, =1.0.1, =1.0.0, =3.0.2, =3.0.11, =3.0.1, =3.0.7, =3.2.17, =3.0.62, =3.0.0, =3.0.1, =3.0.6, =1.0.0, =1.4.3 and more Source cves: CVE-2024-21490 Source advisory: MEND:CVE-2024-21490...

CVE-2024-21490

This affects versions of the package angular from 1.3.0; versions of the package angularjs from 1.3.0. A regular expression used to split the value of the ng-srcset directive is vulnerable to super-linear runtime due to backtracking. With large carefully-crafted input, this can result in...

@raptorjs/ng-portal (>=1.0.5, <=2.1.3), @umptor/slidedeck (2.1.1) +6 more potentially affected by CVE-2024-21490 via angular-loader (>=1.7.9, <=1.8.3)

angular-loader NPM version =1.7.9, =1.0.5, =2.0.7, =2.0.0, =2.4.0, =1.1.0, =1.8.2, =1.8.4 Source cves: CVE-2024-21490 Source advisory: MEND:CVE-2024-21490...

@b1cloud/angular-weekly-scheduler (>=0.0.8, <=0.0.13), @covisint/cui-i18n (>=1.0.3, <=1.0.20) +25 more potentially affected by CVE-2024-21490 via angular-i18n (>=1.6.1, <=1.8.3)

angular-i18n NPM version =1.6.1, =0.0.8, =1.0.3, =0.2.1, =1.0.0, =1.0.0, =5.3.0, =3.0.0, =0.5.0, =1.1.0, =1.0.3, =1.1.1 - angular-timepicker 1.0.11 - angular-weekly-scheduler 0.0.6 - easypage-editor 0.1.0 - gassman 1.0.0 and more Source cves: CVE-2024-21490 Source advisory: MEND:CVE-2024-21490...

Angular Security Vulnerabilities

Angular is a development platform. It is used to build mobile and desktop web applications using Typescript / JavaScript and other languages. A security vulnerability exists in Angular version 1.3.0. An attacker has exploited the vulnerability to cause a denial of service...

CVE-2024-21490: Inefficient Regular Expression Complexity

This affects versions of the package angular from 1.3.0; versions of the package angularjs from 1.3.0. A regular expression used to split the value of the ng-srcset directive is vulnerable to super-linear runtime due to backtracking. With large carefully-crafted input, this can result in...

CVE-2024-22200

vantage6-UI is the User Interface for vantage6. The docker image used to run the UI leaks the nginx version. To mitigate the vulnerability, users can run the UI as an angular application. This vulnerability was patched in 4.2.0...

Design/Logic Flaw

vantage6-UI is the User Interface for vantage6. The docker image used to run the UI leaks the nginx version. To mitigate the vulnerability, users can run the UI as an angular application. This vulnerability was patched in 4.2.0...