Michael Prentice

**Name of the Vulnerable Software and Affected Versions** angular versions 1.2.21 and later **Description** The issue is related to the angular.copy() utility function, which uses an insecure regular expression. This can lead to a Regular Expression Denial of Service (ReDoS) via a large carefully-crafted input, resulting in catastrophic backtracking. Exploiting this issue is possible, allowing a remote attacker to cause a denial of service. **Recommendations** For versions 1.2.21 and later, consider disabling the `angular.copy()` function until a patch is available to prevent potential exploitation. Restricting the input to the `angular.copy()` function can also help minimize the risk of catastrophic backtracking. As a temporary workaround, avoid using large inputs that could trigger the insecure regular expression. At the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** angular versions 1.4.9 and later **Description** The issue is related to the usage of an insecure regular expression in the input[url] functionality of the angular package, which can lead to a Regular Expression Denial of Service (ReDoS) via the <input type="url"> element. Exploiting this vulnerability is possible by a large carefully-crafted input, which can result in catastrophic backtracking. This can allow a remote attacker to cause a denial of service. **Recommendations** For angular versions 1.4.9 and later, consider disabling the input[url] functionality until a patch is available. Restrict access to the <input type="url"> element to minimize the risk of exploitation. Avoid using the input[url] functionality with large or untrusted inputs until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** angular versions 1.0.0 and later **Description** The issue is related to the $resource service in angular, which uses an insecure regular expression. This can lead to a Regular Expression Denial of Service (ReDoS) when a large, carefully-crafted input is provided, resulting in catastrophic backtracking. The vulnerability can be exploited by a remote attacker to cause a denial of service. **Recommendations** For angular versions 1.0.0 and later, consider disabling the $resource service until a patch is available to prevent potential exploitation. Restrict access to the $resource service to minimize the risk of denial of service attacks. Avoid using the $resource service with large, untrusted inputs until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** angular versions prior to the fixed version **Description** The issue is related to Cross-site Scripting (XSS) due to insecure page caching in the Internet Explorer browser, allowing interpolation of <textarea> elements. This occurs because the application does not take adequate measures to protect the structure of web pages, potentially enabling a remote attacker to conduct an XSS attack. **Recommendations** For all versions of angular, consider migrating to the actively maintained package @angular/core to receive security updates, as the angular package is deprecated. As a temporary workaround, consider restricting the use of the insecure page caching feature in the Internet Explorer browser until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** angular versions 1.7.0 and higher **Description** The issue is related to the use of a regular expression with inefficient computational complexity in the Angular application design environment and single-page application development platform. This can be exploited by a remote attacker to cause a denial of service. The vulnerability is triggered by providing a custom locale rule that allows assigning a high value to the `posPre` parameter in `NUMBER FORMATS.PATTERNS[1].posPre` using the `' '.repeat()` method. **Recommendations** For versions 1.7.0 and higher, consider disabling the custom locale rule functionality until a fix is available, or restrict the use of the `posPre` parameter in `NUMBER FORMATS.PATTERNS[1].posPre` to prevent assigning high values. At the moment, there is no information about a newer version that contains a fix for this vulnerability.