ini before 1.3.6 vulnerable to Prototype Pollution via ini.parse

Overview The ini npm package before version 1.3.6 has a Prototype Pollution vulnerability. If an attacker submits a malicious INI file to an application that parses it with ini.parse, they will pollute the prototype on the application. This can be exploited further depending on the context. Patch...

Prototype Pollution

Overview ini before version 1.3.6 has a Prototype Pollution vulnerability. Impact If an attacker submits a malicious INI file to an application that parses it with ini.parse, they will pollute the prototype on the application. This can be exploited further depending on the context. Patches This h...

37fis (>=1.0.0, <=1.0.2), 3loc (>=0.2.0, <=0.4.0) +1852 more potentially affected by CVE-2020-7788 via ini (>=1.0.0, <=1.3.5)

ini NPM version =1.0.0, =1.0.0, =0.2.0, =0.13.31, =0.0.17, =1.0.0, =1.0.0, =6.1.3, =1.0.99, =0.0.1-beta.2, =0.0.1-beta.2, =0.0.1-beta.2, =6.2.9, =1.0.3, =0.2.333, =0.2.346 and more Source cves: CVE-2020-7788 Source advisory: SNYK:JS-INI-1048974...

Prototype Pollution

Overview ini is an An ini encoder/decoder for node Affected versions of this package are vulnerable to Prototype Pollution. If an attacker submits a malicious INI file to an application that parses it with ini.parse, they will pollute the prototype on the application. This can be exploited furthe...

Prototype Pollution

Overview conf-cfg-ini is an encode and decode ini,conf,cfg files Affected versions of this package are vulnerable to Prototype Pollution. If an attacker submits a malicious INI file to an application that parses it with decode, they will pollute the prototype on the application. This can be...

Prototype Pollution

Overview js-ini is a parsing and serialize ini files Affected versions of this package are vulnerable to Prototype Pollution. If an attacker submits a malicious INI file to an application that parses it with parse , they will pollute the prototype on the application. This can be exploited further...

eslint-plugin-mozilla (>=2.7.0, <=2.9.2), gatsby (>=2.24.6-telemetry-test.19, <=2.24.6-telemetry-test.20) +3 more potentially affected by CVE-2020-28448 via multi-ini (2.1.0)

multi-ini NPM version 2.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on multi-ini and may be impacted: - eslint-plugin-mozilla =2.7.0, =2.24.6-telemetry-test.19, =2.12.64-telemetry-test.19, =0.1.54-telemetry-test.19, =1.3.21-telemetry-test.19,...

Prototype Pollution

Overview multi-ini is an ini-file parser which supports multi line, multiple levels and arrays to get a maximum of compatibility with Zend config files. Affected versions of this package are vulnerable to Prototype Pollution. It is possible to pollute an object's prototype by specifying the proto...

PT-2020-6064

Name of the Vulnerable Software and Affected Versions ini versions prior to 1.3.6 Description The issue is related to an uncontrolled modification of object prototype attributes in the ini library. This can be exploited by submitting a malicious INI file to an application that parses it with...

grafana: information disclosure through world-readable grafana configuration files

An information-disclosure flaw was found in Grafana distributed by Red Hat. This flaw allows a local attacker access to potentially sensitive information such as secretkey and a bindpassword from the world-readable files /etc/grafana/grafana.ini and /etc/grafana/ldap.toml...

streetart-ini-ge.de Cross Site Scripting vulnerability OBB-1348939

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

The vulnerability of the parse function in the .ini parsing library .ini-parser, a package manager in NPM, allows a hacker to execute arbitrary code.

The vulnerability of the parse function in the .ini parsing library “ini-parser” from the NPM package is due to an uncontrolled resource consumption. Exploiting this vulnerability could allow a attacker to execute arbitrary code...

Prototype Pollution

ini-parser is vulnerable to prototype pollution. An attacker is able to add and modify properties of Object.prototype using a proto payload...

@dawnjs/cli (>=1.11.0, <=1.13.7), @dawnjs/dn-middleware-lint (3.0.12) +49 more potentially affected by CVE-2020-7617 via ini-parser (0.0.2)

ini-parser NPM version 0.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on ini-parser and may be impacted: - @dawnjs/cli =1.11.0, =1.0.0, =0.0.1, =1.0.0-beta, =0.0.2, =0.0.1, =0.5.12, =1.0.1, =0.0.1, =3.0.0-alpha.36, =1.0.11, =1.1.4 and more Source...

GHSA-96R7-MRQF-JHCC Prototype Pollution in ini-parser

All versions of ini-parser are vulnerable to prototype pollution. The parse function does not restrict the modification of an Object's prototype, which may allow an attacker to add or modify an existing property that will exist on all objects. Recommendation No fix is currently available. Conside...

Prototype Pollution in ini-parser

All versions of ini-parser are vulnerable to prototype pollution. The parse function does not restrict the modification of an Object's prototype, which may allow an attacker to add or modify an existing property that will exist on all objects. Recommendation No fix is currently available. Conside...

Prototype Pollution

Overview All versions of ini-parser are vulnerable to prototype pollution. The parse function does not restrict the modification of an Object's prototype, which may allow an attacker to add or modify an existing property that will exist on all objects. Recommendation No fix is currently available...

Prototype Pollution

ini-parser is vulnerable to prototype pollution. An attacker is able to add and modify arbitrary properties via Object.prototype using a proto payload...

XAMPP Arbitrary Command Execution Vulnerability

XAMPP is a free open source cross-platform Web server solution stack package developed by Apache Friends. An arbitrary command execution vulnerability exists in XAMPP. An attacker can exploit this vulnerability by changing the .exe configuration in xampp-contol.ini for all users including...

Ini-parser Resource Management Error Vulnerability

Ini-parser is a parser for .ini format files. A resource management error vulnerability exists in ini-parser 0.0.2 and earlier versions. An attacker can exploit this vulnerability to add or modify properties of Object.prototype to execute arbitrary code...