Cross-Site Scripting in @progress/kendo-angular-editor

Kendo UI for Angular Editor Component npm package @progress/kendo-angular-editor before version 1.2.3 is vulnerable to Cross-Site Scripting. When the Editor content contains potentially malicious scripts in element event handlers, they get executed. Adding the following content to the Editor valu...

GHSA-J7WP-VJJ6-CP5M Cross-Site Scripting in @progress/kendo-angular-editor

Kendo UI for Angular Editor Component npm package @progress/kendo-angular-editor before version 1.2.3 is vulnerable to Cross-Site Scripting. When the Editor content contains potentially malicious scripts in element event handlers, they get executed. Adding the following content to the Editor valu...

Cross-Site Scripting

Overview @progress/kendo-angular-editor before version 1.2.3 is vulnerable to Cross-Site Scripting. When the Editor content contains potentially malicious scripts in element event handlers, they get executed. Adding the following content to the Editor value demonstrates the issue: . Recommendatio...

PT-2020-21363

Name of the Vulnerable Software and Affected Versions @progress/kendo-angular-editor versions prior to 1.2.3 Description The issue allows for Cross-Site Scripting when the Editor content contains potentially malicious scripts in element event handlers, which get executed. For example, adding the...

@amitport/useful (>=0.5.0, <=0.5.2), @arivazhagan/demo-project (1.0.1) +1015 more potentially affected by unknown CVE via angular (>=1.0.8, <=1.7.9)

angular NPM version =1.0.8, =0.5.0, =0.0.8, =2.3.0, =1.5.8, =2.8.3-2, =0.1.0, =1.0.0, =0.0.7, =0.0.1, =0.2.24, =0.0.1, =0.0.1, =0.0.5, =0.1.7 and more Source cves: unknown CVE Source advisory: OSV:GHSA-5CP4-XMRW-59WF...

@amitport/useful (>=0.5.0, <=0.5.2), @arivazhagan/demo-project (1.0.1) +1015 more potentially affected by unknown CVE via angular (>=1.0.8, <=1.7.9)

angular NPM version =1.0.8, =0.5.0, =0.0.8, =2.3.0, =1.5.8, =2.8.3-2, =0.1.0, =1.0.0, =0.0.7, =0.0.1, =0.2.24, =0.0.1, =0.0.1, =0.0.5, =0.1.7 and more Source cves: unknown CVE Source advisory: GHSA-5CP4-XMRW-59WF...

CVE-2020-7676

A XSS flaw was found in nodejs-angular. The regex-based input HTML replacement may turn sanitized code into unsanitized one. Wrapping "" elements in "" ones changes parsing behavior, leading to possibly unsanitizing code...

Angular vulnerable to Cross-site Scripting

angular.js prior to 1.8.0 allows cross site scripting. The regex-based input HTML replacement may turn sanitized code into unsanitized one. Wrapping elements in ones changes parsing behavior, leading to possibly unsanitizing code...

@amitport/useful (>=0.5.0, <=0.5.2), @arivazhagan/demo-project (1.0.1) +1015 more potentially affected by CVE-2020-7676 via angular (>=1.0.8, <=1.7.9)

angular NPM version =1.0.8, =0.5.0, =0.0.8, =2.3.0, =1.5.8, =2.8.3-2, =0.1.0, =1.0.0, =0.0.7, =0.0.1, =0.2.24, =0.0.1, =0.0.1, =0.0.5, =0.1.7 and more Source cves: CVE-2020-7676 Source advisory: OSV:GHSA-MHP6-PXH8-R675...

GHSA-MHP6-PXH8-R675 Angular vulnerable to Cross-site Scripting

angular.js prior to 1.8.0 allows cross site scripting. The regex-based input HTML replacement may turn sanitized code into unsanitized one. Wrapping elements in ones changes parsing behavior, leading to possibly unsanitizing code...

@amitport/useful (>=0.5.0, <=0.5.2), @arivazhagan/demo-project (1.0.1) +1015 more potentially affected by CVE-2020-7676 via angular (>=1.0.8, <=1.7.9)

angular NPM version =1.0.8, =0.5.0, =0.0.8, =2.3.0, =1.5.8, =2.8.3-2, =0.1.0, =1.0.0, =0.0.7, =0.0.1, =0.2.24, =0.0.1, =0.0.1, =0.0.5, =0.1.7 and more Source cves: CVE-2020-7676 Source advisory: GHSA-MHP6-PXH8-R675...

Cross-site Scripting (XSS)

angular is vulnerable to cross-site scripting XSS. The vulnerability exists as the regex-based replacement, XHTMLTAGREGEXP, could convert sanitized code which has wrapped into , into unsanitized code...

@amitport/useful (>=0.5.0, <=0.5.2), @arivazhagan/demo-project (1.0.1) +1016 more potentially affected by CVE-2020-7676 via angular (>=0.0.1, <=1.7.9)

angular NPM version =0.0.1, =0.5.0, =0.0.8, =2.3.0, =1.5.8, =2.8.3-2, =0.1.0, =1.0.0, =0.0.7, =0.0.1, =0.2.24, =0.0.1, =0.0.1, =0.0.5, =0.1.7 and more Source cves: CVE-2020-7676 Source advisory: MEND:CVE-2020-7676...

@amitport/useful (>=0.5.0, <=0.5.2), @nuskin/ns-agelocme-core (>=0.1.0, <=3.35.0) +83 more potentially affected by CVE-2020-7676 via angular-route (>=1.2.17-build.163.1, <=1.5.11)

angular-route NPM version =1.2.17-build.163.1, =0.5.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =8.0.0, =10.2.0 and more Source cves: CVE-2020-7676 Source advisory: MEND:CVE-2020-7676...

@cobrowser/cb_services (>=0.2.7, <=1.1.17), @covisint/cui-i18n (>=1.0.0, <=1.0.45) +74 more potentially affected by CVE-2020-7676 via angular-cookies (>=1.2.27, <=1.5.11)

angular-cookies NPM version =1.2.27, =0.2.7, =1.0.0, =1.0.1, =1.2.6, =1.0.0, =1.0.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =3.14.2 and more Source cves: CVE-2020-7676 Source advisory: MEND:CVE-2020-7676...

@nuskin/ns-agelocme-core (>=0.1.0, <=3.35.0), @nuskin/ns-agelocme-mobile (>=0.1.0, <=3.14.2) +27 more potentially affected by CVE-2020-7676 via angular-touch (>=1.4.5, <=1.5.11)

angular-touch NPM version =1.4.5, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.14.2, =0.0.1, =1.1.9, =1.4.0 and more Source cves: CVE-2020-7676 Source advisory: MEND:CVE-2020-7676...

@amitport/useful (>=0.5.0, <=0.5.2), @bloomreach/hippo-theme (2.2.3) +46 more potentially affected by CVE-2020-7676 via angular-aria (>=1.4.5, <=1.5.11)

angular-aria NPM version =1.4.5, =0.5.0, =1.0.0, =1.0.0, =1.2.1, =2.4.0, =0.10.4, =4.0.0, =0.2.4, =0.0.4, =0.0.10, =0.0.1, =1.1.9, =2.1.9, =2.1.13 and more Source cves: CVE-2020-7676 Source advisory: MEND:CVE-2020-7676...

@covisint/cui-i18n (>=1.0.0, <=1.0.45), @covisint/cui-idm-b2x (>=1.0.1, <=1.3.0) +10 more potentially affected by CVE-2020-7676 via angular-i18n (>=1.2.32, <=1.5.11)

angular-i18n NPM version =1.2.32, =1.0.0, =1.0.1, =8.0.0, =0.0.1, =2.8.46, =2.8.16, =0.0.5, =1.0.0, =1.2.0, =1.24.0 Source cves: CVE-2020-7676 Source advisory: MEND:CVE-2020-7676...

Angular template injection on custom report name field

Summary Report name field is affected by angular template injection which can lead to XSS attacks. Impact Custom report name field can lead to XSS attacks by malicious users. The attacker must have a valid Guardian/CMC login with the ‘Report editor’ capability to leverage this. Mitigation None...

@amitport/useful (>=0.5.0, <=0.5.2), @arivazhagan/demo-project (1.0.1) +1015 more potentially affected by CVE-2020-7676 via angular (>=1.0.8, <=1.7.9)

angular NPM version =1.0.8, =0.5.0, =0.0.8, =2.3.0, =1.5.8, =2.8.3-2, =0.1.0, =1.0.0, =0.0.7, =0.0.1, =0.2.24, =0.0.1, =0.0.1, =0.0.5, =0.1.7 and more Source cves: CVE-2020-7676 Source advisory: SNYK:JS-ANGULAR-570058...