Overview 11 matches · 0 in Waratek scope · 0 protected · 0 exploited · 0 CISA KEV · 0 public PoC · 0 EPSS ≥ 0.5
11matches
0in Waratek scope0.0%
0protected0.0%
0exploited0.0%
0CISA KEV0.0%
0public PoC0.0%
0EPSS ≥ 0.50.0%
Protected by Waratek
0
0.0%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
0
0.0%
Outside Waratek scope
2
18.2%
Not applicable
9
81.8%
Withdrawn CVE
0
0.0%
blocked by ARMR today
0
0.0%
partly blocked
0
0.0%
not blocked
11
100.0%
not established
0
0.0%
unrecorded
0
0.0%
Exploited
0
0.0%
Working exploit published
0
0.0%
Proof of concept only
5
45.5%
Forecast only
0
0.0%
No public exploit
6
54.5%
split by
peak 3 / quarter
Q4 191
Not applicable1
High1
not blocked1
No public exploit1
Q1 201
Not applicable1
Medium1
not blocked1
No public exploit1
Q2 201
Not applicable1
Medium1
not blocked1
No public exploit1
Q3 200
Q4 200
Q1 210
Q2 210
Q3 210
Q4 210
Q1 220
Q2 222
Not applicable2
High1
Medium1
not blocked2
No public exploit2
Q3 221
Not applicable1
Medium1
not blocked1
No public exploit1
Q4 220
Q1 233
Not applicable3
Medium3
not blocked3
Proof of concept only3
Q2 230
Q3 230
Q4 230
Q1 240
Q2 240
Q3 242
Outside Waratek scope2
Medium2
not blocked2
Proof of concept only2
Q1 20Q3 20Q1 21Q3 21Q1 22Q3 22Q1 23Q3 23Q1 24Q3 24
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2024-8373 | Medium | 2024-09-09 | Outside Waratek scope | Proof of concept only | Improper sanitization of the value of the [srcset] attribute in <source> HTML elements in AngularJS allows attackers to bypass common image source restrictions, which can also lead to a form of Content Spoofing https://owasp.org/www-community/attacks/Content_Spoofing . This issue affects all versions of AngularJS. Note: The AngularJS project is End-of-Life and will not receive any updates to address this issue. For more information see here https://docs.angularjs.org/misc/version-support-status . |
| CVE-2024-8372 | Medium | 2024-09-09 | Outside Waratek scope | Proof of concept only | Improper sanitization of the value of the 'srcset' attribute in AngularJS allows attackers to bypass common image source restrictions, which can also lead to a form of Content Spoofing https://owasp.org/www-community/attacks/Content_Spoofing . This issue affects AngularJS versions 1.3.0-rc.4 and greater. Note: The AngularJS project is End-of-Life and will not receive any updates to address this issue. For more information see here https://docs.angularjs.org/misc/version-support-status . |
| CVE-2023-26118 | Medium | 2023-03-30 | Not applicable | Proof of concept only | Versions of the package angular from 1.4.9 are vulnerable to Regular Expression Denial of Service (ReDoS) via the <input type="url"> element due to the usage of an insecure regular expression in the input[url] functionality. Exploiting this vulnerability is possible by a large carefully-crafted input, which can result in catastrophic backtracking. |
| CVE-2023-26117 | Medium | 2023-03-30 | Not applicable | Proof of concept only | Versions of the package angular from 1.0.0 are vulnerable to Regular Expression Denial of Service (ReDoS) via the $resource service due to the usage of an insecure regular expression. Exploiting this vulnerability is possible by a large carefully-crafted input, which can result in catastrophic backtracking. |
| CVE-2023-26116 | Medium | 2023-03-30 | Not applicable | Proof of concept only | Versions of the package angular from 1.2.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the angular.copy() utility function due to the usage of an insecure regular expression. Exploiting this vulnerability is possible by a large carefully-crafted input, which can result in catastrophic backtracking. |
| CVE-2022-25869 | Medium | 2022-07-15 | Not applicable | No public exploit | All versions of the package angular; all versions of the package angularjs.core; all versions of the package angularjs are vulnerable to Cross-site Scripting (XSS) due to insecure page caching in the Internet Explorer browser, which allows interpolation of <textarea> elements. |
| CVE-2021-4231 | Medium | 2022-05-26 | Not applicable | No public exploit | A vulnerability was found in Angular up to 11.0.4/11.1.0-next.2. It has been classified as problematic. Affected is the handling of comments. The manipulation leads to cross site scripting. It is possible to launch the attack remotely but it might require an authentication first. Upgrading to version 11.0.5 and 11.1.0-next.3 is able to address this issue. The name of the patch is ba8da742e3b243e8f43d4c63aa842b44e14f2b09. It is recommended to upgrade the affected component. |
| CVE-2022-25844 | High | 2022-05-01 | Not applicable | No public exploit | The package angular after 1.7.0 are vulnerable to Regular Expression Denial of Service (ReDoS) by providing a custom locale rule that makes it possible to assign the parameter in posPre: ' '.repeat() of NUMBER_FORMATS.PATTERNS[1].posPre with a very high value. **Note:** 1) This package has been deprecated and is no longer maintained. 2) The vulnerable versions are 1.7.0 and higher. |
| CVE-2020-7676 | Medium | 2020-06-08 | Not applicable | No public exploit | angular.js prior to 1.8.0 allows cross site scripting. The regex-based input HTML replacement may turn sanitized code into unsanitized one. Wrapping "<option>" elements in "<select>" ones changes parsing behavior, leading to possibly unsanitizing code. |
| CVE-2019-14863 | Medium | 2020-01-02 | Not applicable | No public exploit | There is a vulnerability in all angular versions before 1.5.0-beta.0, where after escaping the context of the web application, the web application delivers data to its users along with other trusted dynamic content, without validating it. |
| CVE-2019-10768 | High | 2019-11-19 | Not applicable | No public exploit | In AngularJS before 1.7.9 the function `merge()` could be tricked into adding or modifying properties of `Object.prototype` using a `__proto__` payload. |