AZL-45153 CVE-2020-7788 affecting package nodejs-nodemon 2.0.3-5

This affects the package ini before 1.3.6. If an attacker submits a malicious INI file to an application that parses it with ini.parse, they will pollute the prototype on the application. This can be exploited further depending on the context...

Code injection

This affects the package ini before 1.3.6. If an attacker submits a malicious INI file to an application that parses it with ini.parse, they will pollute the prototype on the application. This can be exploited further depending on the context...

CVE-2020-7788

This affects the package ini before 1.3.6. If an attacker submits a malicious INI file to an application that parses it with ini.parse, they will pollute the prototype on the application. This can be exploited further depending on the context...

CVE-2020-7788

CVE-2020-7788 affects the ini package before 1.3.6. An attacker can submit a malicious INI file parsed by ini.parse, polluting the application’s prototype and potentially enabling further exploitation depending on context. Remediation: upgrade to ini 1.3.6 or newer.

CVE-2020-7788 Prototype Pollution

This affects the package ini before 1.3.6. If an attacker submits a malicious INI file to an application that parses it with ini.parse, they will pollute the prototype on the application. This can be exploited further depending on the context...

CVE-2020-7788

This affects the package ini before 1.3.6. If an attacker submits a malicious INI file to an application that parses it with ini.parse, they will pollute the prototype on the application. This can be exploited further depending on the context...

CVE-2020-7788

This affects the package ini before 1.3.6. If an attacker submits a malicious INI file to an application that parses it with ini.parse, they will pollute the prototype on the application. This can be exploited further depending on the context...

npm Ini Resource Management Error Vulnerability

npm Ini is a Javascript-based code library for parsing and serializing Ini format files from the US-based npm Inc. A resource management error vulnerability exists in npm Ini 1.3.6, which allows an attacker to exploit the vulnerability by submitting a malicious INI file to an application that wil...

37fis (>=1.0.0, <=1.0.2), 3loc (>=0.2.0, <=0.4.0) +1851 more potentially affected by CVE-2020-7788 via ini (>=1.0.0, <=1.3.5)

ini NPM version =1.0.0, =1.0.0, =0.2.0, =0.13.31, =0.0.17, =1.0.0, =1.0.0, =6.1.3, =1.0.99, =0.0.1-beta.2, =0.0.1-beta.2, =0.0.1-beta.2, =6.2.9, =1.0.3, =0.2.333, =0.2.346 and more Source cves: CVE-2020-7788 Source advisory: OSV:GHSA-QQGX-2P2H-9C37...

GHSA-QQGX-2P2H-9C37 ini before 1.3.6 vulnerable to Prototype Pollution via ini.parse

Overview The ini npm package before version 1.3.6 has a Prototype Pollution vulnerability. If an attacker submits a malicious INI file to an application that parses it with ini.parse, they will pollute the prototype on the application. This can be exploited further depending on the context. Patch...

ini before 1.3.6 vulnerable to Prototype Pollution via ini.parse

Overview The ini npm package before version 1.3.6 has a Prototype Pollution vulnerability. If an attacker submits a malicious INI file to an application that parses it with ini.parse, they will pollute the prototype on the application. This can be exploited further depending on the context. Patch...

Prototype Pollution

Overview ini before version 1.3.6 has a Prototype Pollution vulnerability. Impact If an attacker submits a malicious INI file to an application that parses it with ini.parse, they will pollute the prototype on the application. This can be exploited further depending on the context. Patches This h...

Prototype Pollution

Overview ini is an An ini encoder/decoder for node Affected versions of this package are vulnerable to Prototype Pollution. If an attacker submits a malicious INI file to an application that parses it with ini.parse, they will pollute the prototype on the application. This can be exploited furthe...

37fis (>=1.0.0, <=1.0.2), 3loc (>=0.2.0, <=0.4.0) +1851 more potentially affected by CVE-2020-7788 via ini (>=1.0.0, <=1.3.5)

ini NPM version =1.0.0, =1.0.0, =0.2.0, =0.13.31, =0.0.17, =1.0.0, =1.0.0, =6.1.3, =1.0.99, =0.0.1-beta.2, =0.0.1-beta.2, =0.0.1-beta.2, =6.2.9, =1.0.3, =0.2.333, =0.2.346 and more Source cves: CVE-2020-7788 Source advisory: SNYK:JS-INI-1048974...

Prototype Pollution

Overview conf-cfg-ini is an encode and decode ini,conf,cfg files Affected versions of this package are vulnerable to Prototype Pollution. If an attacker submits a malicious INI file to an application that parses it with decode, they will pollute the prototype on the application. This can be...

Prototype Pollution

Overview js-ini is a parsing and serialize ini files Affected versions of this package are vulnerable to Prototype Pollution. If an attacker submits a malicious INI file to an application that parses it with parse , they will pollute the prototype on the application. This can be exploited further...

eslint-plugin-mozilla (>=2.7.0, <=2.9.2), gatsby (>=2.24.6-telemetry-test.19, <=2.24.6-telemetry-test.20) +3 more potentially affected by CVE-2020-28448 via multi-ini (2.1.0)

multi-ini NPM version 2.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on multi-ini and may be impacted: - eslint-plugin-mozilla =2.7.0, =2.24.6-telemetry-test.19, =2.12.64-telemetry-test.19, =0.1.54-telemetry-test.19, =1.3.21-telemetry-test.19,...

Prototype Pollution

Overview multi-ini is an ini-file parser which supports multi line, multiple levels and arrays to get a maximum of compatibility with Zend config files. Affected versions of this package are vulnerable to Prototype Pollution. It is possible to pollute an object's prototype by specifying the proto...

PT-2020-6064 · Ini +6 · Ini +6

Name of the Vulnerable Software and Affected Versions: ini versions prior to 1.3.6 Description: The issue is related to an uncontrolled modification of object prototype attributes in the ini library. This can be exploited by submitting a malicious INI file to an application that parses it with...

grafana: information disclosure through world-readable grafana configuration files

An information-disclosure flaw was found in Grafana distributed by Red Hat. This flaw allows a local attacker access to potentially sensitive information such as secretkey and a bindpassword from the world-readable files /etc/grafana/grafana.ini and /etc/grafana/ldap.toml...