Vulnerabilities
Projects
Vulnerability Disclosure
About Us
Contact Us
Mend.io Vulnerability Database
What is a WS vulnerability ID?
What is an MSC vulnerability ID?
We found results for “”
CVE-2020-7676
Good to know:
Date: June 8, 2020
angular.js prior to 1.8.0 allows cross site scripting. The regex-based input HTML replacement may turn sanitized code into unsanitized one. Wrapping "<option>" elements in "<select>" ones changes parsing behavior, leading to possibly unsanitizing code.
Language: Java
Severity Score
Related Resources (27)
Severity Score
Weakness Type (CWE)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-79Top Fix
Upgrade Version
Upgrade to version angular - 1.5.23;angular - 1.8.0;angular-parse-ext - 1.5.23-parse-ext;angular-message-format - 1.5.23-message-format;angular-animate - 1.5.23-animate;angular-sanitize - 1.5.23-sanitize;angular-aria - 1.5.23-aria;angular-mocks - 1.5.23-mocks;angular-cookies - 1.5.23-cookies;angular-i18n - 1.5.23-i18n;angular-route - 1.5.23-route;angular-messages - 1.5.23-messages;angular-touch - 1.5.23-touch;angular-resource - 1.5.23-resource;angular-loader - 1.5.23-loader;angular - 1.5.23;angular-resource - 1.5.23-resource;angular-sanitize - 1.5.23-sanitize;angular-mocks - 1.5.23-mocks;angular-route - 1.5.23-route;angular-aria - 1.5.23-aria;angular-loader - 1.5.23-loader;angular-touch - 1.5.23-touch;angular-parse-ext - 1.5.23-parse-ext;angular-animate - 1.5.23-animate;angular-message-format - 1.5.23-message-format;angular-i18n - 1.5.23-i18n;angular-messages - 1.5.23-messages;angular-cookies - 1.5.23-cookies
CVSS v3.1
| Base Score: |
|
|---|---|
| Attack Vector (AV): | NETWORK |
| Attack Complexity (AC): | LOW |
| Privileges Required (PR): | LOW |
| User Interaction (UI): | REQUIRED |
| Scope (S): | CHANGED |
| Confidentiality (C): | LOW |
| Integrity (I): | LOW |
| Availability (A): | NONE |
CVSS v2
| Base Score: |
|
|---|---|
| Access Vector (AV): | NETWORK |
| Access Complexity (AC): | MEDIUM |
| Authentication (AU): | SINGLE |
| Confidentiality (C): | NONE |
| Integrity (I): | PARTIAL |
| Availability (A): | NONE |
| Additional information: |