EA Origin Template Injection Remote Code Execution

Exploit Title: EA Origin 10.5.36 Template Injection Remote Code Execution Date: 04/19/2019 Exploit Author: Dominik Penner @zer0pwn Vendor Homepage: https://www.origin.com Software Link: https://www.origin.com/can/en-us/store/download Version: 10.5.36 and below Tested on: Windows 10 CVE :...

CVE-2019-11354

The client in Electronic Arts EA Origin 10.5.36 on Windows allows template injection in the title parameter of the Origin2 URI handler. This can be used to escape the underlying AngularJS sandbox and achieve remote code execution via an origin2://game/launch URL for QtApplication QDesktopServices...

Remote code execution

The client in Electronic Arts EA Origin 10.5.36 on Windows allows template injection in the title parameter of the Origin2 URI handler. This can be used to escape the underlying AngularJS sandbox and achieve remote code execution via an origin2://game/launch URL for QtApplication QDesktopServices...

CVE-2019-11354

The client in Electronic Arts EA Origin 10.5.36 on Windows allows template injection in the title parameter of the Origin2 URI handler. This can be used to escape the underlying AngularJS sandbox and achieve remote code execution via an origin2://game/launch URL for QtApplication QDesktopServices...

PT-2019-12254

Name of the Vulnerable Software and Affected Versions EA Origin version 10.5.36 Description The issue concerns template injection in the title parameter of the Origin2 URI handler, allowing an attacker to escape the AngularJS sandbox. This can lead to remote code execution via an...

Cross-site Scripting (XSS)

python-django-horizon is vulnerable to cross-site scripting XSS. A DOM-based, cross-site scripting vulnerability was found in the OpenStack dashboard, where user input was not filtered correctly. An authenticated dashboard user could exploit the flaw by injecting an AngularJS template into a...

AngularJS < 1.6.1 Cross-Site Scripting

According to its self-reported version number, AngularJS is prior to 1.6.1. Therefore, it may be affected by a JSONP callback vulnerability than can lead to Cross-Site Scripting XSS. Note that the scanner has not tested for these issues but has instead relied only on the application's self-report...

AngularJS 1.5.0 < 1.5.9 Content Security Policy Bypass

According to its self-reported version number, AngularJS is at least 1.5.0 prior to 1.5.9. Therefore, it may be affected by a Content Security Policy bypass vulnerability. Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version...

AngularJS < 1.6.7 Cross-Site Scripting

According to its self-reported version number, AngularJS is prior to 1.6.7. Therefore, it may be affected by a Cross-Site Scripting XSS vulnerability via ideographic space chararcters in URIs. Note that the scanner has not tested for these issues but has instead relied only on the application's...

AngularJS 1.3.0 < 1.5.0-rc.2 Cross-Site Scripting

According to its self-reported version number, AngularJS is at least 1.3.0 and prior to 1.5.0-rc.2. Therefore, it may be affected by a Cross-Site Scripting XSS vulnerability due to usemap attribute not blacklisted. Note that the scanner has not tested for these issues but has instead relied only ...

AngularJS < 1.6.9 Cross-Site Scripting

According to its self-reported version number, AngularJS is prior to 1.6.9. Therefore, it may be affected by a Cross-Site Scripting XSS vulnerability through SVG files if enableSvg is set. Note that the scanner has not tested for these issues but has instead relied only on the application's...

AngularJS < 1.6.5 Cross-Site Scripting

According to its self-reported version number, AngularJS is prior to 1.6.5. Therefore, it may be affected by a Cross-Site Scripting XSS vulnerability. Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number. No source dat...

AngularJS < 1.4.10 Cross-Site Scripting

According to its self-reported version number, AngularJS is prior to 1.4.10. Therefore, it may be affected by a Cross-Site Scripting XSS vulnerability involving assignment on constructor properties. Note that the scanner has not tested for these issues but has instead relied only on the...

VOOKI - Web Application Vulnerability Scanner

Vooki is a free web application vulnerability scanner. Vooki is a user-friendly tool that you can easily scan any web application and find the vulnerabilities. Vooki includes Web Application Scanner, Rest API Scanner, and reporting section. Vooki – Web Application Scanner can help you to find the...

Cross site scripting

ag-grid is an advanced data grid that is library agnostic. ag-grid is vulnerable to Cross-site Scripting XSS via Angular Expressions, if AngularJS is used in combination with ag-grid...

CVE-2017-16009

ag-grid is an advanced data grid that is library agnostic. ag-grid is vulnerable to Cross-site Scripting XSS via Angular Expressions, if AngularJS is used in combination with ag-grid...

CVE-2017-16009

ag-grid is an advanced data grid that is library agnostic. ag-grid is vulnerable to Cross-site Scripting XSS via Angular Expressions, if AngularJS is used in combination with ag-grid...

CVE-2017-16009

ag-grid is an advanced data grid that is library agnostic. ag-grid is vulnerable to Cross-site Scripting XSS via Angular Expressions, if AngularJS is used in combination with ag-grid...

CVE-2017-16009

The CVE-2017-16009 entry affects ag-grid when used with AngularJS, where Angular Expressions can be exploited to trigger Cross-site Scripting (XSS). The vulnerability arises from how AngularJS interacts with ag-grid, enabling injected expressions to run in the context of the page. Several connect...

PT-2018-6038 · Ag Grid +1 · Ag-Grid +1

Name of the Vulnerable Software and Affected Versions: ag-grid affected versions not specified Description: The issue concerns Cross-site Scripting XSS via Angular Expressions when ag-grid is used in combination with AngularJS. Recommendations: Avoid using ag-grid in combination with AngularJS...