eslint-plugin-mozilla (>=2.7.0 <=2.9.2), gatsby (>=2.24.6-telemetry-test.19 <=2.24.6-telemetry-test.20) +3 more potentially affected by CVE-2020-28448 via multi-ini (=2.1.0)

multi-ini NPM version =2.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on multi-ini and may be impacted: - eslint-plugin-mozilla =2.7.0, =2.24.6-telemetry-test.19, =2.12.64-telemetry-test.19, =0.1.54-telemetry-test.19, =1.3.21-telemetry-test.19,...

Prototype Pollution

Overview multi-ini is an ini-file parser which supports multi line, multiple levels and arrays to get a maximum of compatibility with Zend config files. Affected versions of this package are vulnerable to Prototype Pollution. It is possible to pollute an object's prototype by specifying the proto...

PT-2020-6064 · Ini +6 · Ini +6

Name of the Vulnerable Software and Affected Versions: ini versions prior to 1.3.6 Description: The issue is related to an uncontrolled modification of object prototype attributes in the ini library. This can be exploited by submitting a malicious INI file to an application that parses it with...

grafana: information disclosure through world-readable grafana configuration files

An information-disclosure flaw was found in Grafana distributed by Red Hat. This flaw allows a local attacker access to potentially sensitive information such as secretkey and a bindpassword from the world-readable files /etc/grafana/grafana.ini and /etc/grafana/ldap.toml...

streetart-ini-ge.de Cross Site Scripting vulnerability OBB-1348939

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

The vulnerability of the parse function in the .ini parsing library .ini-parser, a package manager in NPM, allows a hacker to execute arbitrary code.

The vulnerability of the parse function in the .ini parsing library “ini-parser” from the NPM package is due to an uncontrolled resource consumption. Exploiting this vulnerability could allow a attacker to execute arbitrary code...

Prototype Pollution

ini-parser is vulnerable to prototype pollution. An attacker is able to add and modify properties of Object.prototype using a proto payload...

@dawnjs/cli (>=1.11.0 <=1.13.7), @dawnjs/dn-middleware-lint (=3.0.12) +49 more potentially affected by CVE-2020-7617 via ini-parser (=0.0.2)

ini-parser NPM version =0.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on ini-parser and may be impacted: - @dawnjs/cli =1.11.0, =1.0.0, =0.0.1, =1.0.0-beta, =0.0.2, =0.0.1, =0.5.12, =1.0.1, =0.0.1, =3.0.0, =1.0.11, =1.1.4 and more Source cves:...

Prototype Pollution in ini-parser

All versions of ini-parser are vulnerable to prototype pollution. The parse function does not restrict the modification of an Object's prototype, which may allow an attacker to add or modify an existing property that will exist on all objects. Recommendation No fix is currently available. Conside...

GHSA-96R7-MRQF-JHCC Prototype Pollution in ini-parser

All versions of ini-parser are vulnerable to prototype pollution. The parse function does not restrict the modification of an Object's prototype, which may allow an attacker to add or modify an existing property that will exist on all objects. Recommendation No fix is currently available. Conside...

Prototype Pollution

Overview All versions of ini-parser are vulnerable to prototype pollution. The parse function does not restrict the modification of an Object's prototype, which may allow an attacker to add or modify an existing property that will exist on all objects. Recommendation No fix is currently available...

Prototype Pollution

ini-parser is vulnerable to prototype pollution. An attacker is able to add and modify arbitrary properties via Object.prototype using a proto payload...

Ini-parser Resource Management Error Vulnerability

Ini-parser is a parser for .ini format files. A resource management error vulnerability exists in ini-parser 0.0.2 and earlier versions. An attacker can exploit this vulnerability to add or modify properties of Object.prototype to execute arbitrary code...

XAMPP Arbitrary Command Execution Vulnerability

XAMPP is a free open source cross-platform Web server solution stack package developed by Apache Friends. An arbitrary command execution vulnerability exists in XAMPP. An attacker can exploit this vulnerability by changing the .exe configuration in xampp-contol.ini for all users including...

CVE-2020-7617

ini-parser through 0.0.2 is vulnerable to Prototype Pollution.The library could be tricked into adding or modifying properties of Object.prototype using a 'proto' payload...

CVE-2020-7617

ini-parser through 0.0.2 is vulnerable to Prototype Pollution.The library could be tricked into adding or modifying properties of Object.prototype using a 'proto' payload...

CVE-2020-7617 Prototype Pollution

ini-parser through 0.0.2 is vulnerable to Prototype Pollution.The library could be tricked into adding or modifying properties of Object.prototype using a 'proto' payload...

CVE-2020-7617

The CVE-2020-7617 entry concerns the ini-parser package (up to version 0.0.2) and describes a Prototype Pollution vulnerability. An attacker can exploit a proto payload to add or modify properties on Object.prototype, enabling potential attacker-controlled behavior across JavaScript objects. Seve...

@dawnjs/cli (>=1.11.0 <=1.13.7), @dawnjs/dn-middleware-lint (=3.0.12) +49 more potentially affected by CVE-2020-7617 via ini-parser (=0.0.2)

ini-parser NPM version =0.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on ini-parser and may be impacted: - @dawnjs/cli =1.11.0, =1.0.0, =0.0.1, =1.0.0-beta, =0.0.2, =0.0.1, =0.5.12, =1.0.1, =0.0.1, =3.0.0, =1.0.11, =1.1.4 and more Source cves:...

Prototype Pollution

Overview ini-parser is a package to parse .ini files. Affected versions of this package are vulnerable to Prototype Pollution. The library could be tricked into adding or modifying properties of Object.prototype using a proto payload. PoC var a = require"ini-parser"; a.parse'proto\ntoString=JHU';...