22 matches found
CVE-2026-25125
October is a Content Management System CMS and web platform. Versions prior to 3.7.14 and 4.1.10 contain a server-side information disclosure vulnerability in the INI settings parser. Because PHP's parseinistring function supports $ syntax for environment variable interpolation, attackers with...
AZL-40346 CVE-2024-2746 affecting package dnf5 for versions less than 5.1.11-3
Incomplete fix for CVE-2024-1929 The problem with CVE-2024-1929 was that the dnf5 D-Bus daemon accepted arbitrary configuration parameters from unprivileged users, which allowed a local root exploit by tricking the daemon into loading a user controlled "plugin". All of this happened before Polkit...
SUSE CVE-2017-11628
In PHP before 5.6.31, 7.x before 7.0.21, and 7.1.x before 7.1.7, a stack-based buffer overflow in the zendinidoop function in Zend/zendiniparser.c could cause a denial of service or potentially allow executing code. NOTE: this is only relevant for PHP applications that accept untrusted input...
GHSA-7VRV-5M2H-RJW9 ion-parser Prototype Pollution when malicious INI file submitted to application that parses with `parse`
This affects all versions of package ion-parser. If an attacker submits a malicious INI file to an application that parses it with parse , they will pollute the prototype on the application. This can be exploited further depending on the context...
js-ini security vulnerability
js-ini is a Node.js package for encoding/decoding ini-like strings from the Russian individual developer Denis. A security vulnerability exists in versions of js-ini prior to 1.3.0 that stems from the package's susceptibility to prototype contamination, which can be exploited by an attacker to...
fio:fuzz_parseini: Heap-use-after-free in sort_options
Detailed Report: https://oss-fuzz.com/testcase?key=5965431360323584 Project: fio Fuzzing Engine: afl Fuzz Target: fuzzparseini Job Type: aflasanfio Platform Id: linux Crash Type: Heap-use-after-free WRITE 8 Crash Address: 0x606000000200 Crash State: sortoptions fiooptionsparse parsejobsini...
fio:fuzz_parseini: Crash in log_err
Detailed Report: https://oss-fuzz.com/testcase?key=5300548857888768 Project: fio Fuzzing Engine: libFuzzer Fuzz Target: fuzzparseini Job Type: libfuzzerubsanfio Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x000500000004 Crash State: logerr fiooptionsparse parsejobsini Sanitizer:...
nodejs-ini: Prototype pollution via malicious INI file
A flaw was found in nodejs-ini. If an attacker submits a malicious INI file to an application that parses it with ini.parse, they will pollute the prototype on the application. This can be exploited further depending on the context...
fio:fuzz_parseini: Crash with empty stacktrace
Detailed Report: https://oss-fuzz.com/testcase?key=5127635201032192 Project: fio Fuzzing Engine: libFuzzer Fuzz Target: fuzzparseini Job Type: libfuzzerubsanfio Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x7f36a304acf0 Crash State: NULL Sanitizer: undefined UBSAN Recommended...
fio:fuzz_parseini: Segv on unknown address in add_file
Detailed Report: https://oss-fuzz.com/testcase?key=5887397356240896 Project: fio Fuzzing Engine: afl Fuzz Target: fuzzparseini Job Type: aflasanfio Platform Id: linux Crash Type: Segv on unknown address Crash Address: Crash State: addfile strfilenamecb handleoption Sanitizer: address ASAN Crash...
nodejs-ini: Prototype pollution via malicious INI file
A flaw was found in nodejs-ini. If an attacker submits a malicious INI file to an application that parses it with ini.parse, they will pollute the prototype on the application. This can be exploited further depending on the context...
Prototype Pollution
Overview iniparserjs is an ini style file parser for node Affected versions of this package are vulnerable to Prototype Pollution. This vulnerability relates when iniparser.js is concentrating arrays. Depending on if user input is provided, an attacker can overwrite and pollute the object prototy...
fio:fuzz_parseini: Crash with empty stacktrace
Detailed Report: https://oss-fuzz.com/testcase?key=6508571539931136 Project: fio Fuzzing Engine: libFuzzer Fuzz Target: fuzzparseini Job Type: libfuzzerubsanfio Platform Id: linux Crash Type: UNKNOWN WRITE Crash Address: 0x00030da8de18 Crash State: NULL Sanitizer: undefined UBSAN Recommended...
CVE-2020-7788
This affects the package ini before 1.3.6. If an attacker submits a malicious INI file to an application that parses it with ini.parse, they will pollute the prototype on the application. This can be exploited further depending on the context...
npm Ini Resource Management Error Vulnerability
npm Ini is a Javascript-based code library for parsing and serializing Ini format files from the US-based npm Inc. A resource management error vulnerability exists in npm Ini 1.3.6, which allows an attacker to exploit the vulnerability by submitting a malicious INI file to an application that wil...
Prototype Pollution
Overview ini before version 1.3.6 has a Prototype Pollution vulnerability. Impact If an attacker submits a malicious INI file to an application that parses it with ini.parse, they will pollute the prototype on the application. This can be exploited further depending on the context. Patches This h...
Prototype Pollution
Overview js-ini is a parsing and serialize ini files Affected versions of this package are vulnerable to Prototype Pollution. If an attacker submits a malicious INI file to an application that parses it with parse , they will pollute the prototype on the application. This can be exploited further...
[SECURITY] [DSA 4081-1] php5 security update
------------------------------------------------------------------------- Debian Security Advisory DSA-4081-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff January 08, 2018 https://www.debian.org/security/faq -...
USN-3382-1 php5, php7.0 vulnerabilities
It was discovered that the PHP opcache created keys for files it cached based on their filepath. A local attacker could possibly use this issue in a shared hosting environment to obtain sensitive information. This issue only affected Ubuntu 14.04 LTS. CVE-2015-8994 It was discovered that the PHP...
UBUNTU-CVE-2017-11628
In PHP before 5.6.31, 7.x before 7.0.21, and 7.1.x before 7.1.7, a stack-based buffer overflow in the zendinidoop function in Zend/zendiniparser.c could cause a denial of service or potentially allow executing code. NOTE: this is only relevant for PHP applications that accept untrusted input...