nodejs-ini: Prototype pollution via malicious INI file

A flaw was found in nodejs-ini. If an attacker submits a malicious INI file to an application that parses it with ini.parse, they will pollute the prototype on the application. This can be exploited further depending on the context...

nodejs-ini: Prototype pollution via malicious INI file

A flaw was found in nodejs-ini. If an attacker submits a malicious INI file to an application that parses it with ini.parse, they will pollute the prototype on the application. This can be exploited further depending on the context...

nodejs-ini: Prototype pollution via malicious INI file

A flaw was found in nodejs-ini. If an attacker submits a malicious INI file to an application that parses it with ini.parse, they will pollute the prototype on the application. This can be exploited further depending on the context...

CVE-2020-28472

This affects the package @aws-sdk/shared-ini-file-loader before 1.0.0-rc.9; the package aws-sdk before 2.814.0. If an attacker submits a malicious INI file to an application that parses it with loadSharedConfigFiles , they will pollute the prototype on the application. This can be exploited furth...

Code injection

This affects the package @aws-sdk/shared-ini-file-loader before 1.0.0-rc.9; the package aws-sdk before 2.814.0. If an attacker submits a malicious INI file to an application that parses it with loadSharedConfigFiles , they will pollute the prototype on the application. This can be exploited furth...

CVE-2020-28472

This affects the package @aws-sdk/shared-ini-file-loader before 1.0.0-rc.9; the package aws-sdk before 2.814.0. If an attacker submits a malicious INI file to an application that parses it with loadSharedConfigFiles , they will pollute the prototype on the application. This can be exploited furth...

CVE-2020-28472 Prototype Pollution

This affects the package @aws-sdk/shared-ini-file-loader before 1.0.0-rc.9; the package aws-sdk before 2.814.0. If an attacker submits a malicious INI file to an application that parses it with loadSharedConfigFiles , they will pollute the prototype on the application. This can be exploited furth...

CVE-2020-28472

Prototype Pollution vulnerability CVE-2020-28472 affects @aws-sdk/shared-ini-file-loader (< 1.0.0-rc.9) and aws-sdk (

@alwaysai/serverless-component (>=1.19.0-alpha.0, <=1.19.2), @andre.bonna/serverless-next.js (1.14.1) +536 more potentially affected by CVE-2020-28472 via @aws-sdk/shared-ini-file-loader (>=0.1.0-preview.1, <=1.0.0-rc.8)

@aws-sdk/shared-ini-file-loader NPM version =0.1.0-preview.1, =1.19.0-alpha.0, =1.2.19-preview.112, =1.0.38-preview.116, =1.0.1-preview.0, =1.0.1-preview.0, =1.2.27-preview.116, =1.0.29-preview.139, =1.0.29-preview.139, =1.0.9-preview.5387, =1.0.32-preview.139, =1.2.1-ui-preview.54,...

PT-2021-11539

Name of the Vulnerable Software and Affected Versions: @aws-sdk/shared-ini-file-loader versions prior to 1.0.0-rc.9 aws-sdk versions prior to 2.814.0 Description: The issue arises when an attacker submits a malicious INI file to an application that parses it with loadSharedConfigFiles. This can...

CVE-2020-28472: Undefined Security Weakness

This affects the package @aws-sdk/shared-ini-file-loader before 1.0.0-rc.9; the package aws-sdk before 2.814.0. If an attacker submits a malicious INI file to an application that parses it with loadSharedConfigFiles , they will pollute the prototype on the application. This can be exploited furth...

@alwaysai/serverless-component (>=1.19.0-alpha.0, <=1.19.2), @andre.bonna/serverless-next.js (1.14.1) +318 more potentially affected by CVE-2020-28472 via @aws-sdk/shared-ini-file-loader (>=1.0.0-beta.4, <=1.0.0-rc.8)

@aws-sdk/shared-ini-file-loader NPM version =1.0.0-beta.4, =1.19.0-alpha.0, =1.2.19-preview.112, =1.0.38-preview.116, =1.0.1-preview.0, =1.0.1-preview.0, =1.2.27-preview.116, =1.0.29-preview.139, =1.0.29-preview.139, =1.0.9-preview.5387, =1.0.32-preview.139, =1.2.1-ui-preview.54,...

DEBIAN-CVE-2020-7788

This affects the package ini before 1.3.6. If an attacker submits a malicious INI file to an application that parses it with ini.parse, they will pollute the prototype on the application. This can be exploited further depending on the context...

Code injection

This affects the package ini before 1.3.6. If an attacker submits a malicious INI file to an application that parses it with ini.parse, they will pollute the prototype on the application. This can be exploited further depending on the context...

npm Ini Resource Management Error Vulnerability

npm Ini is a Javascript-based code library for parsing and serializing Ini format files from the US-based npm Inc. A resource management error vulnerability exists in npm Ini 1.3.6, which allows an attacker to exploit the vulnerability by submitting a malicious INI file to an application that wil...

CVE-2020-7788: Improperly Controlled Modification of Object Prototype Attributes

This affects the package ini before 1.3.6. If an attacker submits a malicious INI file to an application that parses it with ini.parse, they will pollute the prototype on the application. This can be exploited further depending on the context...

PT-2020-9879 · Avast · Avast Secure Browser

Name of the Vulnerable Software and Affected Versions: Avast Secure Browser version 76.0.1659.101 Description: A Local Privilege Escalation issue was discovered due to an insecure ACL set by the AvastBrowserUpdate.exe when AvastSecureBrowser.exe checks for new updates. The elevated process cleans...

Design/Logic Flaw

mIRC before 7.55 allows remote command execution by using argument injection through custom URI protocol handlers. The attacker can specify an irc:// URI that loads an arbitrary .ini file from a UNC share pathname. Exploitation depends on browser-specific URI handling Chrome is not exploitable...

CVE-2018-18249

Icinga Web 2 before 2.6.2 allows injection of PHP ini-file directives via vectors involving environment variables as the channel to send information to the attacker, such as a name=$PATH$APACHERUNDIR$APACHERUNUSER parameter to /icingaweb2/navigation/add or /icingaweb2/dashboard/new-dashlet...

CVE-2018-18249

Icinga Web 2 before 2.6.2 allows injection of PHP ini-file directives via vectors involving environment variables as the channel to send information to the attacker, such as a name=$PATH$APACHERUNDIR$APACHERUNUSER parameter to /icingaweb2/navigation/add or /icingaweb2/dashboard/new-dashlet...