@alwaysai/serverless-component (>=1.19.0-alpha.0, <=1.19.2), @andre.bonna/serverless-next.js (1.14.1) +318 more potentially affected by CVE-2020-28472 via @aws-sdk/shared-ini-file-loader (>=1.0.0-beta.4, <=1.0.0-rc.8)

@aws-sdk/shared-ini-file-loader NPM version =1.0.0-beta.4, =1.19.0-alpha.0, =1.2.19-preview.112, =1.0.38-preview.116, =1.0.1-preview.0, =1.0.1-preview.0, =1.2.27-preview.116, =1.0.29-preview.139, =1.0.29-preview.139, =1.0.9-preview.5387, =1.0.32-preview.139, =1.2.1-ui-preview.54,...

GHSA-RRC9-GQF8-8RWG Prototype Pollution via file load in aws-sdk and @aws-sdk/shared-ini-file-loader

This affects the package @aws-sdk/shared-ini-file-loader before 1.0.0-rc.9; the package aws-sdk before 2.814.0. If an attacker submits a malicious INI file to an application that parses it with loadSharedConfigFiles , they will pollute the prototype on the application. This can be exploited furth...

@alwaysai/serverless-component (>=1.19.0-alpha.0, <=1.19.2), @andre.bonna/serverless-next.js (1.14.1) +318 more potentially affected by CVE-2020-28472 via @aws-sdk/shared-ini-file-loader (>=1.0.0-beta.4, <=1.0.0-rc.8)

@aws-sdk/shared-ini-file-loader NPM version =1.0.0-beta.4, =1.19.0-alpha.0, =1.2.19-preview.112, =1.0.38-preview.116, =1.0.1-preview.0, =1.0.1-preview.0, =1.2.27-preview.116, =1.0.29-preview.139, =1.0.29-preview.139, =1.0.9-preview.5387, =1.0.32-preview.139, =1.2.1-ui-preview.54,...

CVE-2020-28472

This affects the package @aws-sdk/shared-ini-file-loader before 1.0.0-rc.9; the package aws-sdk before 2.814.0. If an attacker submits a malicious INI file to an application that parses it with loadSharedConfigFiles , they will pollute the prototype on the application. This can be exploited furth...

@alwaysai/serverless-component (>=1.19.0-alpha.0, <=1.19.2), @andre.bonna/serverless-next.js (1.14.1) +536 more potentially affected by CVE-2020-28472 via @aws-sdk/shared-ini-file-loader (>=0.1.0-preview.1, <=1.0.0-rc.8)

@aws-sdk/shared-ini-file-loader NPM version =0.1.0-preview.1, =1.19.0-alpha.0, =1.2.19-preview.112, =1.0.38-preview.116, =1.0.1-preview.0, =1.0.1-preview.0, =1.2.27-preview.116, =1.0.29-preview.139, =1.0.29-preview.139, =1.0.9-preview.5387, =1.0.32-preview.139, =1.2.1-ui-preview.54,...

CVE-2020-28472: Undefined Security Weakness

This affects the package @aws-sdk/shared-ini-file-loader before 1.0.0-rc.9; the package aws-sdk before 2.814.0. If an attacker submits a malicious INI file to an application that parses it with loadSharedConfigFiles , they will pollute the prototype on the application. This can be exploited furth...

PT-2021-11539

Name of the Vulnerable Software and Affected Versions: @aws-sdk/shared-ini-file-loader versions prior to 1.0.0-rc.9 aws-sdk versions prior to 2.814.0 Description: The issue arises when an attacker submits a malicious INI file to an application that parses it with loadSharedConfigFiles. This can...

@alwaysai/serverless-component (>=1.19.0-alpha.0, <=1.19.2), @andre.bonna/serverless-next.js (1.14.1) +318 more potentially affected by CVE-2020-28472 via @aws-sdk/shared-ini-file-loader (>=1.0.0-beta.4, <=1.0.0-rc.8)

@aws-sdk/shared-ini-file-loader NPM version =1.0.0-beta.4, =1.19.0-alpha.0, =1.2.19-preview.112, =1.0.38-preview.116, =1.0.1-preview.0, =1.0.1-preview.0, =1.2.27-preview.116, =1.0.29-preview.139, =1.0.29-preview.139, =1.0.9-preview.5387, =1.0.32-preview.139, =1.2.1-ui-preview.54,...