BW
Company Details
Linkedin ID:
bank-of-the-west
Website:
Employees number:
5,232
Number of followers:
75,398
NAICS:
52211
Industry Type:
Homepage:
www.bmo.com
IP Addresses:
0
Company ID:
BAN_2402391
Scan Status:
In-progress
Bank of the West Company CyberSecurity Posture
www.bmo.com
We’ve joined the BMO Family. Please note that we’re no longer monitoring or responding to comments. Reach out to https://www.linkedin.com/company/bmo-us/ with any questions. Follow BMO US: https://www.linkedin.com/company/bmo-us/ ©2023 Bank of the West is a trade name used by BMO Harris Bank N.A. Banking products and services are subject to approval and are provided by BMO Harris Bank N.A. Member FDIC. Bank of the West is not affiliated with BNP Paribas.
Bank of the West A.I CyberSecurity Scoring
BW Risk Score (AI oriented)Between 700 and 749
BW
Updated:
- Powered by our proprietary A.I cyber incident model
- Insurance preferes TPRM score to calculate premium
BW Global Score (TPRM)XXXX
BW
- Instant access to detailed risk factors
- Benchmark vs. industry & size peers
- Vulnerabilities
- Findings
BW Company CyberSecurity News & History
Past Incidents
6
Attack Types
1
Bank of the West
Breach
Rankiteo Explanation
Attack limited on finance or reputation
Description: The California Office of the Attorney General reported a data breach involving Bank of the West on July 16, 2014. The breach was related to an email scam that compromised the login credentials of two employees, potentially exposing customer names and Social Security Numbers, though no evidence of actual viewing or theft was confirmed.
Bank of the West
Breach
Rankiteo Explanation
Attack limited on finance or reputation
Description: The California Office of the Attorney General reported that Bank of the West experienced a data breach involving ATM skimming devices discovered on April 9, 2017. The breach potentially exposed debit card numbers and PINs as a result of fraudulent activities affecting customers in Southern California. It is estimated that the unauthorized devices were in place from February 1, 2017, to April 9, 2017.
Bank of the West
Breach
Rankiteo Explanation
Attack limited on finance or reputation
Description: The California Office of the Attorney General reported a data breach involving Bank of the West on April 5, 2019. The breach occurred due to the installation of an ATM skimming device at the Campbell Branch ATM between December 3, 2018, and December 22, 2018, potentially compromising debit card information such as card numbers and PINs for an unspecified number of individuals.
Bank of the West
Breach
Rankiteo Explanation
Attack with significant impact with internal employee data leaks
Description: The California Office of the Attorney General reported a data breach involving Bank of the West on February 5, 2014. The breach, discovered on December 19, 2013, involved unauthorized access to a retired internet application for job listings and applications, potentially exposing user names, passwords, and personal information such as names, addresses, social security numbers, and driver's license numbers. The number of affected individuals is currently unknown.
Bank of the West
Breach
Rankiteo Explanation
Attack with significant impact with internal employee data leaks
Description: On August 20, 2018, the California Office of the Attorney General reported a data breach involving Bank of the West that occurred on March 2, 2018. Unauthorized third parties accessed employee email accounts at a contracted service provider, potentially affecting personal information including business names and Social Security numbers linked to businesses. The number of affected individuals is unknown.
Bank of the West
Breach
Rankiteo Explanation
Attack with significant impact with customers data leaks
Description: The California Office of the Attorney General disclosed a **data breach** at **Bank of the West** on **June 23, 2022**, stemming from an **ATM skimming incident** detected between **November 10, 2021, and April 18, 2022**. The breach involved unauthorized access to **card numbers, PINs, and personal information** of customers using compromised ATMs. While the exact number of affected individuals remains undisclosed, the incident exposed sensitive financial and personal data, posing risks of **fraudulent transactions, identity theft, and unauthorized account access**.The breach was likely executed through **physical tampering of ATMs**—a common tactic where criminals install skimming devices to capture card details and PINs. Although no explicit mention of large-scale financial losses or systemic disruptions was reported, the exposure of **payment card data and personal identifiers** suggests a direct threat to customers' financial security and privacy. The prolonged detection window (over **five months**) further exacerbates the potential for misuse of the stolen data before mitigation measures were implemented.This incident underscores vulnerabilities in **physical and digital payment infrastructure**, highlighting the need for enhanced monitoring, customer notifications, and fraud prevention protocols to mitigate post-breach risks.
BW Company Scoring based on AI Models
Cyber Incidents Likelihood 3 - 6 - 9 months
A.I Risk Score Likelihood 3 - 6 - 9 months
Underwriter Stats for BW
Incidents vs Banking Industry Average (This Year)
No incidents recorded for Bank of the West in 2025.
Incidents vs All-Companies Average (This Year)
No incidents recorded for Bank of the West in 2025.
Incident Types BW vs Banking Industry Avg (This Year)
No incidents recorded for Bank of the West in 2025.
Incident History — BW (X = Date, Y = Severity)
BW cyber incidents detection timeline including parent company and subsidiaries
BW Company Subsidiaries
We’ve joined the BMO Family. Please note that we’re no longer monitoring or responding to comments. Reach out to https://www.linkedin.com/company/bmo-us/ with any questions. Follow BMO US: https://www.linkedin.com/company/bmo-us/ ©2023 Bank of the West is a trade name used by BMO Harris Bank N.A. Banking products and services are subject to approval and are provided by BMO Harris Bank N.A. Member FDIC. Bank of the West is not affiliated with BNP Paribas.
Loading...
BW Similar Companies
PT Bank Rakyat Indonesia (Persero) Tbk
Bank Rakyat Indonesia (BRI) adalah salah satu bank milik pemerintah yang terbesar di Indonesia. BRI didirikan di Purwokerto, Jawa Tengah oleh Raden Bei Aria Wirjaatmadja pada 16 Desember 1895. Lebih dari 128 tahun memberi pelayanan terbaik bagi seluruh lapisan masyarakat, BRI turut andil dalam upa
PT. BANK NEGARA INDONESIA (Persero) Tbk.
Since its establishment in 1946, BNI has been part of the dynamic of national development in Indonesia. Now BNI has grown and developed into a solid national bank with a sustainable financial performance. ‘Serving the Country, Pride of the Nation”, BNI continues to increase its contribution for the
TD
The Toronto-Dominion Bank & its subsidiaries are collectively known as TD Bank Group (TD). TD is the sixth largest bank in North America by assets & serves approx. 28 million customers in a number of locations in key financial centres around the globe. With over 95,000 employees, TD ranks among the
Central Bank of India
Welcome to the official LinkedIn page of Central Bank of India. Central Bank of India offers a wide range of products and services for every segment. Please join us to know more about our best products & services, attractive offers and the latest updates. We invite & value your active participatio
Standard Chartered
We are a leading international banking group, with a presence in 54 of the world’s most dynamic markets. Our purpose is to drive commerce and prosperity through our unique diversity, and our heritage and values are expressed in our brand promise, here for good. If you’re interested joining Standar
Somos una Corporación líder y comprometida con el país que brinda servicios financieros de excelencia a cada segmento de clientes. Buscamos permanentemente ser el mejor Banco para ellos, ser el mejor lugar para trabajar y ser la mejor inversión para nuestros accionistas. Lo hacemos de forma colabora
BNP Paribas Fortis
For over 200 years, BNP Paribas Fortis has helped drive the growth and prosperity of Belgium’s economy and communities. The mission of our 12,000 colleagues is clear: be the trusted financial partner for four million individual customers, businesses and organisations. We do this by offering advice a
Intesa Sanpaolo è il maggior gruppo bancario in Italia con una significativa presenza internazionale. Il suo business model distintivo la rende leader a livello europeo nel Wealth Management, Protection & Advisory e ne caratterizza l’orientamento al digitale. I’impegno in ambito ESG prevede, entro i
Russian Standard Bank
Russian Standard Bank - leading private bank in the lending market. Bank sells credit programs in more than 1,200 locations across the country. Number of clients of the bank exceeded 23 millions, the total amount of consumer loans exceeded $30 billions. The number of trading partners of the Bank
.png)
BW CyberSecurity News
November 18, 2025 08:00 AM
The Complete List of Hacker And Cybersecurity Movies
Hacker's Movie Guide” with Foreword by Steve Wozniak, co-founder of Apple.
November 15, 2025 08:00 AM
EY US - Home | Building a better working world
Our commitment to audit quality. At EY US, we are bringing our bold vision for the future of audit to life with quality at the center,...
October 04, 2025 07:00 AM
North Korean agents pretending to be IT guys have funneled up to $1 billion into Kim Jong Un's nuclear program
Using AI to create fake identities, they get remote jobs, then hide in plain sight—in Slack, on Zooms, and in corporate infrastructure.
August 27, 2025 07:22 PM
Mastercard Open Finance and Banking Solutions
Unlock the potential of open banking solutions with Mastercard Open Finance, paving the way for seamless financial innovation.
August 26, 2025 07:00 AM
West Chester notified of potential cybersecurity breach, township officials say
Township officials said they were alerted that a "malicious hacking group" appeared to have targeted their central email server.
July 31, 2025 07:00 AM
Article | Former CISA lead Jen Easterly says ‘manufactured outrage’ to blame for West Point ousting
Jen Easterly, the former director of the Cybersecurity and Infrastructure Security Agency, on Thursday pointed to “manufactured outrage” as...
July 30, 2025 07:00 AM
Army secretary directs West Point to rescind appointment of Biden-era cybersecurity director
The Secretary of the Army has directed the U.S. Military Academy at West Point to review its hiring practices and rescind the appointment of...
June 26, 2025 07:00 AM
Police say uni hacker has 'very high level of technical skill'
Police believe a former Western Sydney University student allegedly escalated from hacking into the uni's servers for free parking to...
June 23, 2025 07:00 AM
Article | Cybersecurity groups track surge in Iranian-linked threats to US orgs
Multiple leading cybersecurity firms on Monday reported surges in threats to US organizations linked to Iranian hackers after the US struck Iranian nuclear...
Frequently Asked Questions
Explore insights on cybersecurity incidents, risk posture, and Rankiteo's assessments.
BW CyberSecurity History Information
Official Website of Bank of the West
The official website of Bank of the West is www.bmo.com.
Bank of the West’s AI-Generated Cybersecurity Score
According to Rankiteo, Bank of the West’s AI-generated cybersecurity score is 704, reflecting their Moderate security posture.
How many security badges does Bank of the West’ have ?
According to Rankiteo, Bank of the West currently holds 0 security badges, indicating that no recognized compliance certifications are currently verified for the organization.
Does Bank of the West have SOC 2 Type 1 certification ?
According to Rankiteo, Bank of the West is not certified under SOC 2 Type 1.
Does Bank of the West have SOC 2 Type 2 certification ?
According to Rankiteo, Bank of the West does not hold a SOC 2 Type 2 certification.
Does Bank of the West comply with GDPR ?
According to Rankiteo, Bank of the West is not listed as GDPR compliant.
Does Bank of the West have PCI DSS certification ?
According to Rankiteo, Bank of the West does not currently maintain PCI DSS compliance.
Does Bank of the West comply with HIPAA ?
According to Rankiteo, Bank of the West is not compliant with HIPAA regulations.
Does Bank of the West have ISO 27001 certification ?
According to Rankiteo,Bank of the West is not certified under ISO 27001, indicating the absence of a formally recognized information security management framework.
Industry Classification of Bank of the West
Bank of the West operates primarily in the Banking industry.
Number of Employees at Bank of the West
Bank of the West employs approximately 5,232 people worldwide.
Subsidiaries Owned by Bank of the West
Bank of the West presently has no subsidiaries across any sectors.
Bank of the West’s LinkedIn Followers
Bank of the West’s official LinkedIn profile has approximately 75,398 followers.
NAICS Classification of Bank of the West
Bank of the West is classified under the NAICS code 52211, which corresponds to Commercial Banking.
Bank of the West’s Presence on Crunchbase
No, Bank of the West does not have a profile on Crunchbase.
Bank of the West’s Presence on LinkedIn
Yes, Bank of the West maintains an official LinkedIn profile, which is actively utilized for branding and talent engagement, which can be accessed here: https://www.linkedin.com/company/bank-of-the-west.
Cybersecurity Incidents Involving Bank of the West
As of November 27, 2025, Rankiteo reports that Bank of the West has experienced 6 cybersecurity incidents.
Number of Peer and Competitor Companies
Bank of the West has an estimated 6,716 peer or competitor companies worldwide.
What types of cybersecurity incidents have occurred at Bank of the West ?
Incident Types: The types of cybersecurity incidents that have occurred include Breach.
How does Bank of the West detect and respond to cybersecurity incidents ?
Detection and Response: The company detects and responds to cybersecurity incidents through an communication strategy with public disclosure via california office of the attorney general..
Incident Details
Can you provide details on each incident ?
Title: Bank of the West Data Breach
Description: Unauthorized access to a retired internet application for job listings and applications, potentially exposing user names, passwords, and personal information such as names, addresses, social security numbers, and driver's license numbers.
Date Detected: 2013-12-19
Date Publicly Disclosed: 2014-02-05
Type: Data Breach
Attack Vector: Unauthorized Access
Vulnerability Exploited: Retired Internet Application
Title: Bank of the West ATM Skimming Data Breach
Description: The California Office of the Attorney General reported that Bank of the West experienced a data breach involving ATM skimming devices discovered on April 9, 2017. The breach potentially exposed debit card numbers and PINs as a result of fraudulent activities affecting customers in Southern California. It is estimated that the unauthorized devices were in place from February 1, 2017, to April 9, 2017.
Date Detected: 2017-04-09
Type: Data Breach
Attack Vector: ATM Skimming
Vulnerability Exploited: Physical Security
Motivation: Financial Gain
Title: Bank of the West Data Breach
Description: The California Office of the Attorney General reported a data breach involving Bank of the West on July 16, 2014. The breach was related to an email scam that compromised the login credentials of two employees, potentially exposing customer names and Social Security Numbers, though no evidence of actual viewing or theft was confirmed.
Date Detected: 2014-07-16
Date Publicly Disclosed: 2014-07-16
Type: Data Breach
Attack Vector: Email Scam
Vulnerability Exploited: Compromised Login Credentials
Title: Bank of the West Data Breach
Description: Unauthorized third parties accessed employee email accounts at a contracted service provider, potentially affecting personal information including business names and Social Security numbers linked to businesses.
Date Detected: 2018-03-02
Date Publicly Disclosed: 2018-08-20
Type: Data Breach
Attack Vector: Email Account Compromise
Threat Actor: Unauthorized third parties
Title: Bank of the West ATM Skimming Incident
Description: The California Office of the Attorney General reported a data breach involving Bank of the West on April 5, 2019. The breach occurred due to the installation of an ATM skimming device at the Campbell Branch ATM between December 3, 2018, and December 22, 2018, potentially compromising debit card information such as card numbers and PINs for an unspecified number of individuals.
Date Detected: 2019-04-05
Date Publicly Disclosed: 2019-04-05
Type: Data Breach
Attack Vector: ATM Skimming
Vulnerability Exploited: Physical Security
Motivation: Financial Gain
Title: Bank of the West ATM Skimming Incident
Description: The California Office of the Attorney General reported a data breach involving Bank of the West on June 23, 2022. The breach involved an ATM skimming incident discovered between November 10, 2021, and April 18, 2022, potentially compromising card numbers, PINs, and personal information of affected individuals, but the total number of individuals affected is unknown.
Date Detected: 2022-04-18
Date Publicly Disclosed: 2022-06-23
Type: Data Breach (ATM Skimming)
Attack Vector: Physical ATM Skimming Device
Motivation: Financial Gain (Likely)
What are the most common types of attacks the company has faced ?
Common Attack Types: The most common types of attacks the company has faced is Breach.
How does the company identify the attack vectors used in incidents ?
Identification of Attack Vectors: The company identifies the attack vectors used in incidents through ATM Machines, Email Scam, Email Account Compromise, ATM Skimming Device and Physical ATM Tampering.
Impact of the Incidents
What was the impact of each incident ?
Incident : Data Breach BAN049072425
Data Compromised: User names, Passwords, Names, Addresses, Social security numbers, Driver's license numbers
Systems Affected: Retired Internet Application for Job Listings and Applications
Incident : Data Breach BAN235072825
Data Compromised: Debit card numbers, Pins
Systems Affected: ATM Machines
Payment Information Risk: High
Incident : Data Breach BAN358080425
Data Compromised: Customer names, Social security numbers
Incident : Data Breach BAN421080525
Data Compromised: Business names, Social security numbers
Incident : Data Breach BAN632080525
Data Compromised: Debit card numbers, Pins
Systems Affected: ATM
Payment Information Risk: High
Incident : Data Breach (ATM Skimming) BAN038090625
Data Compromised: Card numbers, Pins, Personal information
Systems Affected: ATMs
Brand Reputation Impact: Potential Negative Impact (Undisclosed)
Identity Theft Risk: High (Potential)
Payment Information Risk: High (Card Numbers and PINs Compromised)
What types of data are most commonly compromised in incidents ?
Commonly Compromised Data Types: The types of data most commonly compromised in incidents are User Names, Passwords, Names, Addresses, Social Security Numbers, Driver'S License Numbers, , Debit Card Numbers, Pins, , Customer Names, Social Security Numbers, , Business Names, Social Security Numbers, , Debit Card Numbers, Pins, , Card Numbers, Pins, Personal Information and .
Which entities were affected by each incident ?
Incident : Data Breach BAN049072425
Entity Name: Bank of the West
Entity Type: Financial Institution
Industry: Banking
Incident : Data Breach BAN235072825
Entity Name: Bank of the West
Entity Type: Financial Institution
Industry: Banking
Location: Southern California
Incident : Data Breach BAN358080425
Entity Name: Bank of the West
Entity Type: Financial Institution
Industry: Banking
Location: California
Incident : Data Breach BAN421080525
Entity Name: Bank of the West
Entity Type: Financial Institution
Industry: Banking
Incident : Data Breach BAN632080525
Entity Name: Bank of the West
Entity Type: Financial Institution
Industry: Banking
Location: Campbell Branch
Incident : Data Breach (ATM Skimming) BAN038090625
Entity Name: Bank of the West
Entity Type: Financial Institution
Industry: Banking
Location: California, USA
Customers Affected: Unknown
Response to the Incidents
What measures were taken in response to each incident ?
Incident : Data Breach (ATM Skimming) BAN038090625
Communication Strategy: Public Disclosure via California Office of the Attorney General
Data Breach Information
What type of data was compromised in each breach ?
Incident : Data Breach BAN049072425
Type of Data Compromised: User names, Passwords, Names, Addresses, Social security numbers, Driver's license numbers
Sensitivity of Data: High
Personally Identifiable Information: NamesAddressesSocial Security NumbersDriver's License Numbers
Incident : Data Breach BAN235072825
Type of Data Compromised: Debit card numbers, Pins
Sensitivity of Data: High
Incident : Data Breach BAN358080425
Type of Data Compromised: Customer names, Social security numbers
Sensitivity of Data: High
Incident : Data Breach BAN421080525
Type of Data Compromised: Business names, Social security numbers
Sensitivity of Data: High
Incident : Data Breach BAN632080525
Type of Data Compromised: Debit card numbers, Pins
Sensitivity of Data: High
Incident : Data Breach (ATM Skimming) BAN038090625
Type of Data Compromised: Card numbers, Pins, Personal information
Number of Records Exposed: Unknown
Sensitivity of Data: High
Data Exfiltration: Likely (via Skimming Device)
Personally Identifiable Information: Yes
Regulatory Compliance
Were there any regulatory violations and fines imposed for each incident ?
Incident : Data Breach (ATM Skimming) BAN038090625
Regulatory Notifications: California Office of the Attorney General
References
Where can I find more information about each incident ?
Incident : Data Breach BAN049072425
Source: California Office of the Attorney General
Date Accessed: 2014-02-05
Incident : Data Breach BAN235072825
Source: California Office of the Attorney General
Incident : Data Breach BAN358080425
Source: California Office of the Attorney General
Date Accessed: 2014-07-16
Incident : Data Breach BAN421080525
Source: California Office of the Attorney General
Date Accessed: 2018-08-20
Incident : Data Breach BAN632080525
Source: California Office of the Attorney General
Date Accessed: 2019-04-05
Incident : Data Breach (ATM Skimming) BAN038090625
Source: California Office of the Attorney General
Date Accessed: 2022-06-23
Where can stakeholders find additional resources on cybersecurity best practices ?
Additional Resources: Stakeholders can find additional resources on cybersecurity best practices at and Source: California Office of the Attorney GeneralDate Accessed: 2014-02-05, and Source: California Office of the Attorney General, and Source: California Office of the Attorney GeneralDate Accessed: 2014-07-16, and Source: California Office of the Attorney GeneralDate Accessed: 2018-08-20, and Source: California Office of the Attorney GeneralDate Accessed: 2019-04-05, and Source: California Office of the Attorney GeneralDate Accessed: 2022-06-23.
Investigation Status
What is the current status of the investigation for each incident ?
Incident : Data Breach (ATM Skimming) BAN038090625
Investigation Status: Disclosed; Details Limited
How does the company communicate the status of incident investigations to stakeholders ?
Communication of Investigation Status: The company communicates the status of incident investigations to stakeholders through Public Disclosure via California Office of the Attorney General.
Initial Access Broker
How did the initial access broker gain entry for each incident ?
Incident : Data Breach BAN235072825
Entry Point: ATM Machines
Incident : Data Breach BAN358080425
Entry Point: Email Scam
Incident : Data Breach BAN421080525
Entry Point: Email Account Compromise
Incident : Data Breach BAN632080525
Entry Point: ATM Skimming Device
Incident : Data Breach (ATM Skimming) BAN038090625
Entry Point: Physical ATM Tampering
High Value Targets: Customer Payment Data
Data Sold on Dark Web: Customer Payment Data
Post-Incident Analysis
What were the root causes and corrective actions taken for each incident ?
Incident : Data Breach BAN358080425
Root Causes: Compromised Login Credentials
Incident : Data Breach BAN632080525
Root Causes: Installation of ATM skimming device
Incident : Data Breach (ATM Skimming) BAN038090625
Root Causes: Likely Physical Security Lapse at ATMs
Additional Questions
General Information
Who was the attacking group in the last incident ?
Last Attacking Group: The attacking group in the last incident was an Unauthorized third parties.
Incident Details
What was the most recent incident detected ?
Most Recent Incident Detected: The most recent incident detected was on 2013-12-19.
What was the most recent incident publicly disclosed ?
Most Recent Incident Publicly Disclosed: The most recent incident publicly disclosed was on 2022-06-23.
Impact of the Incidents
What was the most significant data compromised in an incident ?
Most Significant Data Compromised: The most significant data compromised in an incident were User names, Passwords, Names, Addresses, Social Security Numbers, Driver's License Numbers, , Debit Card Numbers, PINs, , Customer Names, Social Security Numbers, , Business names, Social Security numbers, , Debit card numbers, PINs, , Card Numbers, PINs, Personal Information and .
What was the most significant system affected in an incident ?
Most Significant System Affected: The most significant system affected in an incident was Retired Internet Application for Job Listings and Applications and ATM Machines and ATM and ATMs.
Data Breach Information
What was the most sensitive data compromised in a breach ?
Most Sensitive Data Compromised: The most sensitive data compromised in a breach were Addresses, User names, Social Security numbers, Customer Names, Names, Driver's License Numbers, Business names, Personal Information, Card Numbers, Passwords, PINs, Debit Card Numbers, Debit card numbers and Social Security Numbers.
What was the number of records exposed in the most significant breach ?
Number of Records Exposed in Most Significant Breach: The number of records exposed in the most significant breach was 0.
References
What is the most recent source of information about an incident ?
Most Recent Source: The most recent source of information about an incident is California Office of the Attorney General.
Investigation Status
What is the current status of the most recent investigation ?
Current Status of Most Recent Investigation: The current status of the most recent investigation is Disclosed; Details Limited.
Initial Access Broker
What was the most recent entry point used by an initial access broker ?
Most Recent Entry Point: The most recent entry point used by an initial access broker were an ATM Skimming Device, Email Account Compromise, Physical ATM Tampering, Email Scam and ATM Machines.
Post-Incident Analysis
What was the most significant root cause identified in post-incident analysis ?
Most Significant Root Cause: The most significant root cause identified in post-incident analysis was Compromised Login Credentials, Installation of ATM skimming device, Likely Physical Security Lapse at ATMs.
.png)
Latest Global CVEs (Not Company-Specific)
Description
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to versions 19.2.16, 20.3.14, and 21.0.1, there is a XSRF token leakage via protocol-relative URLs in angular HTTP clients. The vulnerability is a Credential Leak by App Logic that leads to the unauthorized disclosure of the Cross-Site Request Forgery (XSRF) token to an attacker-controlled domain. Angular's HttpClient has a built-in XSRF protection mechanism that works by checking if a request URL starts with a protocol (http:// or https://) to determine if it is cross-origin. If the URL starts with protocol-relative URL (//), it is incorrectly treated as a same-origin request, and the XSRF token is automatically added to the X-XSRF-TOKEN header. This issue has been patched in versions 19.2.16, 20.3.14, and 21.0.1. A workaround for this issue involves avoiding using protocol-relative URLs (URLs starting with //) in HttpClient requests. All backend communication URLs should be hardcoded as relative paths (starting with a single /) or fully qualified, trusted absolute URLs.
Risk Information
cvss4
Base: 7.7
Severity: LOW
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
References
- https://github.com/angular/angular/commit/0276479e7d0e280e0f8d26fa567d3b7aa97a516f
- https://github.com/angular/angular/commit/05fe6686a97fa0bcd3cf157805b3612033f975bc
- https://github.com/angular/angular/commit/3240d856d942727372a705252f7c8c115394a41e
- https://github.com/angular/angular/releases/tag/19.2.16
- https://github.com/angular/angular/releases/tag/20.3.14
- https://github.com/angular/angular/releases/tag/21.0.1
- https://github.com/angular/angular/security/advisories/GHSA-58c5-g7wp-6w37
Description
Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. An Uncontrolled Recursion vulnerability in node-forge versions 1.3.1 and below enables remote, unauthenticated attackers to craft deep ASN.1 structures that trigger unbounded recursive parsing. This leads to a Denial-of-Service (DoS) via stack exhaustion when parsing untrusted DER inputs. This issue has been patched in version 1.3.2.
Risk Information
cvss4
Base: 8.7
Severity: LOW
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Description
Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. An Integer Overflow vulnerability in node-forge versions 1.3.1 and below enables remote, unauthenticated attackers to craft ASN.1 structures containing OIDs with oversized arcs. These arcs may be decoded as smaller, trusted OIDs due to 32-bit bitwise truncation, enabling the bypass of downstream OID-based security decisions. This issue has been patched in version 1.3.2.
Risk Information
cvss4
Base: 6.3
Severity: LOW
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Description
Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suricata community. Prior to versions 7.0.13 and 8.0.2, working with large buffers in Lua scripts can lead to a stack overflow. Users of Lua rules and output scripts may be affected when working with large buffers. This includes a rule passing a large buffer to a Lua script. This issue has been patched in versions 7.0.13 and 8.0.2. A workaround for this issue involves disabling Lua rules and output scripts, or making sure limits, such as stream.depth.reassembly and HTTP response body limits (response-body-limit), are set to less than half the stack size.
Risk Information
cvss3
Base: 7.5
Severity: LOW
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Description
Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suricata community. In versions from 8.0.0 to before 8.0.2, a NULL dereference can occur when the entropy keyword is used in conjunction with base64_data. This issue has been patched in version 8.0.2. A workaround involves disabling rules that use entropy in conjunction with base64_data.
Risk Information
cvss3
Base: 7.5
Severity: LOW
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Access Data Using Our API
Get company history
curl -i -X GET 'https://api.rankiteo.com/underwriter-getcompany-history?linkedin_id=bank-of-the-west' -H 'apikey: YOUR_API_KEY_HERE'
RapidWhat Do We Measure ?
Incident
Finding
Grade
Digital Assets
Every week, Rankiteo analyzes billions of signals to give organizations a sharper, faster view of emerging risks. With deeper, more actionable intelligence at their fingertips, security teams can outpace threat actors, respond instantly to Zero-Day attacks, and dramatically shrink their risk exposure window.
These are some of the factors we use to calculate the overall score:
Network Security
Identify exposed access points, detect misconfigured SSL certificates, and uncover vulnerabilities across the network infrastructure.
SBOM (Software Bill of Materials)
Gain visibility into the software components used within an organization to detect vulnerabilities, manage risk, and ensure supply chain security.
CMDB (Configuration Management Database)
Monitor and manage all IT assets and their configurations to ensure accurate, real-time visibility across the company's technology environment.
Threat Intelligence
Leverage real-time insights on active threats, malware campaigns, and emerging vulnerabilities to proactively defend against evolving cyberattacks.
Rankiteo is a unified scoring and risk platform that analyzes billions of signals weekly to help organizations gain faster, more actionable insights into emerging threats. Empowering teams to outpace adversaries and reduce exposure.
