Search for packages
| purl | pkg:npm/angular@1.5.2 |
| Next non-vulnerable version | None. |
| Latest non-vulnerable version | None. |
| Risk score | 3.4 |
| Advisory | Summary | Fixed in package version |
|---|---|---|
|
GHSA-j58c-ww9w-pwp5
Aliases: CVE-2025-0716 |
AngularJS improperly sanitizes SVG elements Improper sanitization of the value of the 'href' and 'xlink:href' attributes in '<image>' SVG elements … | There are no reported fixed by versions. |
|
GHSA-prc3-vjfx-vhm9
Aliases: CVE-2022-25869 |
Angular (deprecated package) Cross-site Scripting All versions of package angular are vulnerable to Cross-site Scripting (XSS) due to insecure page … | There are no reported fixed by versions. |
|
GHSA-89mq-4x47-5v83
Aliases: CVE-2019-10768 |
angular Prototype Pollution vulnerability Versions of `angular ` prior to 1.7.9 are vulnerable to prototype pollution. The deprecated API function … |
Vulnerable |
|
GHSA-28hp-fgcr-2r4h
Aliases: GMS-2019-114 |
Cross-Site Scripting via JSONP JSONP allows untrusted resource URLs, which provides a vector for attack by malicious actors. |
Vulnerable |
|
GHSA-4w4v-5hc9-xrr2
Aliases: CVE-2024-21490 |
angular vulnerable to super-linear runtime due to backtracking This affects versions of the package angular from 1.3.0. A regular expression … | There are no reported fixed by versions. |
|
GHSA-mqm9-c95h-x2p6
Aliases: CVE-2024-8373 |
Improper sanitization of the value of the `[srcset]` attribute in `<source>` HTML elements in AngularJS allows attackers to bypass common … | There are no reported fixed by versions. |
|
GHSA-m9gf-397r-hwpg
Aliases: CVE-2024-8372 |
Improper sanitization of the value of the `[srcset]` attribute in AngularJS allows attackers to bypass common image source restrictions, which … | There are no reported fixed by versions. |
|
GHSA-2qqx-w9hr-q5gx
Aliases: CVE-2023-26117 |
angular vulnerable to regular expression denial of service via the $resource service All versions of the package angular are vulnerable … | There are no reported fixed by versions. |
|
GHSA-2vrf-hf26-jrp5
Aliases: CVE-2023-26116 |
angular vulnerable to regular expression denial of service via the angular.copy() utility All versions of the package angular are vulnerable … | There are no reported fixed by versions. |
|
GHSA-qwqh-hm9m-p5hr
Aliases: CVE-2023-26118 |
angular vulnerable to regular expression denial of service via the <input type="url"> element All versions of the package angular are … | There are no reported fixed by versions. |
|
GHSA-mhp6-pxh8-r675
Aliases: CVE-2020-7676 |
Angular vulnerable to Cross-site Scripting angular.js prior to 1.8.0 allows cross site scripting. The regex-based input HTML replacement may turn … |
Vulnerable |
|
GHSA-5cp4-xmrw-59wf
Aliases: GMS-2020-703 |
XSS via JQLite DOM manipulation functions in AngularJS ### Summary XSS may be triggered in AngularJS applications that sanitize user-controlled … |
Vulnerable |
|
GMS-2017-115
|
Denial of service in $sanitize Running $sanitize on bad HTML can freeze the browser. The problem occurs with clobbered data; … |
Vulnerable |
|
GMS-2016-73
|
Bypass CSP protection Extension URIs (`resource://...`) bypass ````Content-Security-Policy```` in Chrome and Firefox and can always be loaded. Now if a … |
Vulnerable Vulnerable Vulnerable |
|
GMS-2017-110
|
Bypass CSP protection , AngularJS allows bootstrapping of invalid/bad svg and currentScript if it was clobbered. |
Vulnerable |
|
GMS-2017-134
|
XSS in $sanitize in Safari/Firefox Both Firefox and Safari are vulnerable to XSS if we use an inert document created … |
Vulnerable |
|
GMS-2018-9
|
Cross Site Scripting On Firefox there is a XSS vulnerability if a malicious attacker can write into the `xml:base` attribute … |
Vulnerable |
|
GHSA-7x27-g8rg-x87w
Aliases: CVE-2026-11998 |
Angular's deprecated package has a Cross-Site Scripting issue A flaw in AngularJS' Strict Contextual Escaping (SCE) logic allows bypassing certain … | There are no reported fixed by versions. |