CVE-2020-5219

Angular Expressions before version 1.0.1 has a remote code execution vulnerability if you call expressions.compileuserControlledInput where userControlledInput is text that comes from user input. If running angular-expressions in the browser, an attacker could run any browser script when the...

CVE-2020-5219

Angular Expressions before version 1.0.1 has a remote code execution vulnerability if you call expressions.compileuserControlledInput where userControlledInput is text that comes from user input. If running angular-expressions in the browser, an attacker could run any browser script when the...

Remote code execution

Angular Expressions before version 1.0.1 has a remote code execution vulnerability if you call expressions.compileuserControlledInput where userControlledInput is text that comes from user input. If running angular-expressions in the browser, an attacker could run any browser script when the...

Remote Code Execution in Angular Expressions

Impact The vulnerability, reported by GoSecure Inc, allows Remote Code Execution, if you call expressions.compileuserControlledInput where userControlledInput is text that comes from user input. If running angular-expressions in the browser, an attacker could run any browser script when the...

opendocx-node (>=0.2.2-alpha, <=2.0.3), yatte (>=1.4.0-beta.12, <=3.0.0-alpha.1) potentially affected by CVE-2020-5219 via angular-expressions (1.0.0)

angular-expressions NPM version 1.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on angular-expressions and may be impacted: - opendocx-node =0.2.2-alpha, =1.4.0-beta.12, =3.0.0-alpha.1 Source cves: CVE-2020-5219 Source advisory: OSV:GHSA-HXHM-96PP-2...

GHSA-HXHM-96PP-2M43 Remote Code Execution in Angular Expressions

Impact The vulnerability, reported by GoSecure Inc, allows Remote Code Execution, if you call expressions.compileuserControlledInput where userControlledInput is text that comes from user input. If running angular-expressions in the browser, an attacker could run any browser script when the...

CVE-2020-5219

Angular Expressions before version 1.0.1 has a remote code execution vulnerability if you call expressions.compileuserControlledInput where userControlledInput is text that comes from user input. If running angular-expressions in the browser, an attacker could run any browser script when the...

CVE-2020-5219 Remote Code Execution in Angular Expressions

Angular Expressions before version 1.0.1 has a remote code execution vulnerability if you call expressions.compileuserControlledInput where userControlledInput is text that comes from user input. If running angular-expressions in the browser, an attacker could run any browser script when the...

CVE-2020-5219

The CVE-2020-5219 entry concerns angular-expressions prior to version 1.0.1. The underlying issue is a remote code execution vulnerability triggered when user-supplied input is passed to expressions.compile(userControlledInput). In the browser, this can allow execution of arbitrary browser script...

PT-2020-18315

Name of the Vulnerable Software and Affected Versions Angular Expressions versions prior to 1.0.1 Description The issue allows for remote code execution if expressions.compileuserControlledInput is called where userControlledInput is text from user input. In a browser environment, an attacker cou...

CVE-2020-5219: Improper Neutralization of Special Elements in Output Used by a Downstream Component

Angular Expressions before version 1.0.1 has a remote code execution vulnerability if you call expressions.compileuserControlledInput where userControlledInput is text that comes from user input. If running angular-expressions in the browser, an attacker could run any browser script when the...

CVE-2019-17125

A Reflected Client Side Template Injection CSTI with Angular was discovered in the SolarWinds Orion Platform 2019.2 HF1 in many forms. An attacker can inject an Angular expression and escape the Angular sandbox to achieve stored XSS...

CVE-2019-17127

A Stored Client Side Template Injection CSTI with Angular was discovered in the SolarWinds Orion Platform 2019.2 HF1 in many application forms. An attacker can inject an Angular expression and escape the Angular sandbox to achieve stored XSS. This can lead to privilege escalation...

CVE-2019-17127

A Stored Client Side Template Injection CSTI with Angular was discovered in the SolarWinds Orion Platform 2019.2 HF1 in many application forms. An attacker can inject an Angular expression and escape the Angular sandbox to achieve stored XSS. This can lead to privilege escalation...

CVE-2019-17125

A Reflected Client Side Template Injection CSTI with Angular was discovered in the SolarWinds Orion Platform 2019.2 HF1 in many forms. An attacker can inject an Angular expression and escape the Angular sandbox to achieve stored XSS...

Design/Logic Flaw

A Stored Client Side Template Injection CSTI with Angular was discovered in the SolarWinds Orion Platform 2019.2 HF1 in many application forms. An attacker can inject an Angular expression and escape the Angular sandbox to achieve stored XSS. This can lead to privilege escalation...

CVE-2019-17127

A Stored Client Side Template Injection CSTI with Angular was discovered in the SolarWinds Orion Platform 2019.2 HF1 in many application forms. An attacker can inject an Angular expression and escape the Angular sandbox to achieve stored XSS. This can lead to privilege escalation...

CVE-2019-17127

Summary: CVE-2019-17127 describes a Stored Client Side Template Injection (CSTI) in SolarWinds Orion Platform 2019.2 HF1. The vulnerability allows an attacker to inject an Angular expression and escape the Angular sandbox, causing stored XSS and potential privilege escalation. The affected compon...

CVE-2019-17125

A Reflected Client Side Template Injection CSTI with Angular was discovered in the SolarWinds Orion Platform 2019.2 HF1 in many forms. An attacker can inject an Angular expression and escape the Angular sandbox to achieve stored XSS...

CVE-2019-17125

CVE-2019-17125 concerns a Reflected Client‑Side Template Injection (CSTI) in SolarWinds Orion Platform 2019.2 HF1. The CSTI arises via Angular expressions that attackers can inject to escape the Angular sandbox, enabling stored XSS across multiple input vectors within the Orion Web UI. The NVD en...