Code injection

This affects all versions of package ion-parser. If an attacker submits a malicious INI file to an application that parses it with parse , they will pollute the prototype on the application. This can be exploited further depending on the context...

CVE-2020-28462 Prototype Pollution

This affects all versions of package ion-parser. If an attacker submits a malicious INI file to an application that parses it with parse , they will pollute the prototype on the application. This can be exploited further depending on the context...

CVE-2020-28461 Prototype Pollution

This affects the package js-ini before 1.3.0. If an attacker submits a malicious INI file to an application that parses it with parse , they will pollute the prototype on the application. This can be exploited further depending on the context...

CVE-2020-28461

CVE-2020-28461 affects the js-ini package before 1.3.0. The vulnerability is a prototype pollution issue in the parse function when parsing untrusted INI-like inputs, enabling an attacker to contaminate the application prototype. Impact is context-dependent and not quantified in all sources, but ...

CVE-2020-28441

The CVE-2020-28441 issue affects the package conf-cfg-ini prior to 1.2.2. A malicious INI file parsed by decode can cause prototype pollution, allowing an attacker to pollute the application’s prototype and potentially enable further exploitation depending on context. Affected components: conf-cf...

CVE-2020-28441 Prototype Pollution

This affects the package conf-cfg-ini before 1.2.2. If an attacker submits a malicious INI file to an application that parses it with decode, they will pollute the prototype on the application. This can be exploited further depending on the context...

PT-2022-8903 · Js-Ini · Js-Ini

Name of the Vulnerable Software and Affected Versions: js-ini versions prior to 1.3.0 Description: The issue arises when an attacker submits a malicious INI file to an application that uses the parse function to parse it. This can lead to prototype pollution on the application, which can be furth...

js-ini 安全漏洞

js-ini is a Node.js package for encoding/decoding ini-like strings from the Russian individual developer Denis. A security vulnerability exists in versions of js-ini prior to 1.3.0 that stems from the package's susceptibility to prototype contamination, which can be exploited by an attacker to...

PT-2022-8904 · Unknown · Ion-Parser

Name of the Vulnerable Software and Affected Versions: ion-parser versions all Description: The issue affects the ion-parser package, where an attacker can submit a malicious INI file to an application that uses the parse function, leading to prototype pollution on the application. This can be...

PT-2022-22213 · Wavlink · Wavlink Wifi-Repeater Rpta2-77W

Name of the Vulnerable Software and Affected Versions: Wavlink WiFi-Repeater RPTA2-77W.M4300.01.GD.2017Sep19 Description: The issue is related to an access control problem, allowing attackers to obtain key device information by accessing the Tftpd32.ini file. Recommendations: For Wavlink...

PT-2022-8895 · Unknown · Conf-Cfg-Ini

Name of the Vulnerable Software and Affected Versions: conf-cfg-ini versions prior to 1.2.2 Description: The issue arises when an attacker submits a malicious INI file to an application that parses it with decode, resulting in prototype pollution on the application. This can be exploited further...

conf-cfg-ini 安全漏洞

conf-cfg-ini is a package from the individual developer Rolf Loges in Germany. It uses Node.js to encode and decode conf/cfg/ini-Files. A security vulnerability exists in conf-cfg-ini versions prior to 1.2.2, which stems from the fact that this package is susceptible to prototype contamination; i...

OESA-2022-1769 nodejs security update

Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices...

CVE-2021-36461

An Arbitrary File Upload vulnerability exists in Microweber 1.1.3 that allows attackers to getshell via the Settings Upload Picture section by uploading pictures with malicious code, user.ini...

Linux kernel 安全漏洞

ini class to trigger a buffer overflow and gain access to out-of-bounds memory, which can lead to a crash or elevate their privileges to administrator and execute arbitrary commands...

Motorola Solutions MDLC 安全漏洞

Motorola Solutions MDLC is a data communication protocol from Motorola Solutions. A security vulnerability exists in Motorola Solutions MDLC, which arises from the application driver storing passwords in plaintext in the wmdlcdrv.ini driver configuration file...

Malicious Package

Overview shared-ini-file-loader is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this...

CVE-2022-1788

Due to missing checks the Change Uploaded File Permissions WordPress plugin through 4.0.0 is vulnerable to CSRF attacks. This can be used to change the file and folder permissions of any folder. This could be problematic when specific files like ini files are made readable for everyone due to thi...

CVE-2022-23167

Attacker crafts a GET request to: /mobile/downloadfile.aspx? Filename =../.. /windows/boot.ini the LFI is UNAUTHENTICATED...

Change Uploaded File Permissions <= 4.0.0 - File Permission Update via CSRF

Due to missing checks the plugin is vulnerable to CSRF attacks. This can be used to change the file and folder permissions of any folder. This could be problematic when specific files like ini files are made readable for everyone due to this. PoC...