| Package | Affected versions | Patched versions |
|---|---|---|
| angularjs | ≥ 1.0.0, ≤ 1.4.14 | |
| decision manager | = 7.0 | |
| process automation | = 7.0 | |
| angular | < 1.5.0-beta.1 | 1.5.0-beta.1 |
Versions of angular prior to 1.5.0-beta.1 are vulnerable to Cross-Site Scripting. The package fails to sanitize xlink:href attributes, which may allow attackers to execute arbitrary JavaScript in a victim's browser if the value is user-controlled.
Upgrade to version 1.5.0-beta.1 or later.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free