Prototype Pollution

multi-ini is vulnerable to prototype pollution. An attacker is able to inject properties into existing construct prototypes and modify attributes such as proto, constructor and prototype...

Prototype Pollution

multi-ini is vulnerable to prototype pollution. An attacker is able to inject properties into existing construct prototypes and modify attributes such as proto, constructor and prototype by specifying the constructor.proto object as part of an array. This vulnerability exists due to bypass of the...

CVE-2020-28460

This affects the package multi-ini before 2.1.2. It is possible to pollute an object's prototype by specifying the constructor.proto object as part of an array. This is a bypass of CVE-2020-28448...

CVE-2020-28448

This affects the package multi-ini before 2.1.1. It is possible to pollute an object's prototype by specifying the proto object as part of an array...

CVE-2020-28448

This affects the package multi-ini before 2.1.1. It is possible to pollute an object's prototype by specifying the proto object as part of an array...

CVE-2020-28460

This affects the package multi-ini before 2.1.2. It is possible to pollute an object's prototype by specifying the constructor.proto object as part of an array. This is a bypass of CVE-2020-28448...

Type confusion

This affects the package multi-ini before 2.1.2. It is possible to pollute an object's prototype by specifying the constructor.proto object as part of an array. This is a bypass of CVE-2020-28448...

Code injection

This affects the package multi-ini before 2.1.1. It is possible to pollute an object's prototype by specifying the proto object as part of an array...

CVE-2020-28448

CVE-2020-28448 affects the multi-ini package (before 2.1.1). It enables prototype pollution by placing the proto object in an array, allowing modification of object prototypes. Related advisory entries (GHSA: prototype pollution in multi-ini) and OSV/NVD stanzas confirm the same underlying issue ...

CVE-2020-28448 Prototype Pollution

This affects the package multi-ini before 2.1.1. It is possible to pollute an object's prototype by specifying the proto object as part of an array...

CVE-2020-28460

CVE-2020-28460 affects the multi-ini package (versions before 2.1.2). The issue is prototype pollution: an attacker can pollute an object’s prototype by placing the proto/constructor.proto object inside an array, bypassing CVE-2020-28448. Connected advisories confirm this vulnerability and link t...

Evangelion1204 Multi-ini Resource Management Error Vulnerability

Evangelion1204 Multi-ini is Evangelion1204 individual developers of a Javascript-based language written for Ini configuration file parsing code base . The code base supports compatibility with the Zend file format. A security vulnerability exists in versions of multi-ini prior to 2.1.1, which ste...

Evangelion1204 Multi-ini Resource Management Error Vulnerability

Evangelion1204 Multi-ini is Evangelion1204 individual developers of a Javascript-based language written for Ini configuration file parsing code library . The code base supports compatibility with the Zend file format. A security vulnerability exists in versions prior to multi-ini 2.1.2, which ste...

PT-2020-17015 · Multi-Ini · Multi-Ini

Name of the Vulnerable Software and Affected Versions: multi-ini versions prior to 2.1.2 Description: The issue allows an object's prototype to be polluted by specifying the constructor.proto object as part of an array, effectively bypassing a previous security measure. Recommendations: For...

PT-2020-17012 · Multi-Ini · Multi-Ini

Name of the Vulnerable Software and Affected Versions: multi-ini versions prior to 2.1.1 Description: The issue allows an object's prototype to be polluted by specifying the proto object as part of an array. This can potentially lead to unintended behavior or security issues. Recommendations: For...

Debian: Security Advisory (DLA-2503-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] [DLA 2503-1] node-ini security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-2503-1 [email protected] https://www.debian.org/lts/security/ Chris Lamb December 21, 2020 https://wiki.debian.org/LTS -...

DLA-2503-1 node-ini - security update

Bulletin has no description...

eslint-plugin-mozilla (>=2.7.0 <=2.9.2), gatsby (>=2.24.6-telemetry-test.19 <=2.24.6-telemetry-test.20) +3 more potentially affected by CVE-2020-28448 +1 more via multi-ini (=2.1.0)

multi-ini NPM version =2.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on multi-ini and may be impacted: - eslint-plugin-mozilla =2.7.0, =2.24.6-telemetry-test.19, =2.12.64-telemetry-test.19, =0.1.54-telemetry-test.19, =1.3.21-telemetry-test.19,...

CVE-2020-7788

A flaw was found in nodejs-ini. If an attacker submits a malicious INI file to an application that parses it with ini.parse, they will pollute the prototype on the application. This can be exploited further depending on the context...