There is a vulnerability in all angular versions before 1.5.0-beta.0, where after escaping the context of the web application, the web application delivers data to its users along with other trusted dynamic content, without validating it.

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 25.04 host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-7958-1 advisory.

    It was discovered that AngularJS did not properly sanitize certain `xlink:href` attributes. A remote     attacker could possibly use this issue to perform cross site scripting. This issue only affected Ubuntu     16.04 LTS. (CVE-2019-14863)

    It was discovered that AngularJS incorrectly handled certain regular expressions. An attacker could     possibly use this issue to cause AngularJS to consume resources, leading to a regular expression denial of     service. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS and Ubuntu 25.04.
    (CVE-2022-25844)

    It was discovered that AngularJS incorrectly handled certain regular expressions. An attacker could     possibly use this issue to cause AngularJS to consume resources, leading to a regular expression denial of     service. (CVE-2023-26116, CVE-2023-26117)

    It was discovered that AngularJS incorrectly handled certain regular expressions. An attacker could     possibly use this issue to cause AngularJS to consume resources, leading to a regular expression denial of     service. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS     and Ubuntu 25.04. (CVE-2023-26118, CVE-2024-21490)

    It was discovered that AngularJS did not properly sanitize certain inputs in HTML elements. A remote     attacker could possibly use this issue to perform spoofing and obtain sensitive information. This issue     only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS and Ubuntu 25.04.
    (CVE-2024-8372, CVE-2024-8373, CVE-2025-2336)

    It was discovered that AngularJS did not properly sanitize certain inputs in HTML elements. A remote     attacker could possibly use this issue to perform spoofing and obtain sensitive information.
    (CVE-2025-0716)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - There is a vulnerability in all angular versions before 1.5.0-beta.0, where after escaping the context of
    the web application, the web application delivers data to its users along with other trusted dynamic
    content, without validating it. (CVE-2019-14863)

The version of F5 Networks BIG-IP installed on the remote host is prior to 17.1.3 / 17.5.1.1. It is, therefore, affected by multiple vulnerabilities as referenced in the K000141459 advisory.

    CVE-2019-14863There is a vulnerability in all angular versions before 1.5.0-beta.0, where after escaping     the context of the web application, the web application delivers data to its users along with other     trusted dynamic content, without validating it.CVE-2022-25869All versions of package angular are     vulnerable to Cross-site Scripting (XSS) due to insecure page caching in the Internet Explorer browser,     which allows interpolation of <textarea> elements.

Tenable has extracted the preceding description block directly from the F5 Networks BIG-IP security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Earlier versions of this package package were vulnerable to Cross-site Scripting (XSS) due to no proper sanitization of xlink:href attributes.

For Debian 8 'Jessie', this problem has been fixed in version 1.2.26-1+deb8u1.

We recommend that you upgrade your angular.js packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
284659	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 25.04 : AngularJS vulnerabilities (USN-7958-1)	Nessus	Ubuntu Local Security Checks	medium
422569	SCA: security update for angular (GHSA-r5fx-8r73-v86c)	Tenable Cloud Security	SCA Checks	medium
422569	SCA: security update for angular (GHSA-r5fx-8r73-v86c)	Tenable Self-Hosted Container Security	SCA Checks	medium
209100	F5 Networks BIG-IP : Angular JS vulnerabilities (K000141459)	Nessus	F5 Networks Local Security Checks	medium
131134	Debian DLA-1995-1 : angular.js security update	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2019-14863

medium

Tenable Plugins

medium

medium

medium

medium

medium