Threats Tagged 'ghsa-jfgx-762w-99vr'
View all threats tagged with 'ghsa-jfgx-762w-99vr'. Filter and sort to focus on specific types of threats.
Stop chasing alerts. Route them.
Start free, then upgrade once to turn Radar into an automated delivery engine for your security stack.
Custom feeds / Automations: email, Slack, webhooks, SIEM/MISP / API access (baseline limits)
API access activates after upgrading in Console -> Billing.
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.
Filter Threats
Narrow down the results by type, severity, or affected countries
Threats Tagged 'ghsa-jfgx-762w-99vr'
Click on any threat for detailed analysis and mitigation recommendations
0 An incomplete fix in @angular/common's HttpClient for CVE-2025-66035 allows Cross-Site Request Forgery (XSRF) tokens to be leaked to attacker-controlled cross-origin domains due to discrepancies between a regular expression used for URL detection and the browser's WHATWG URL parser. This affects Angular versions prior to 21.0.3 and 20.3.34, where the XSRF token header may be attached to requests that the browser resolves as cross-origin. The vulnerability enables attackers to capture valid XSRF tokens if their server accepts the request and custom header via CORS, potentially enabling CSRF attacks. The issue is fixed in Angular 21.0.3, all 22.x releases, and 20.3.34 by replacing the regex with a proper origin comparison using the standard URL constructor. Join the discussion | GCVE Database | 10/20/2026, 20:37:57 UTC Added: 10/20/2026, 22:33:39 UTC |
Showing 1 to 1 of 1 result