Prototype Pollution

ini-parser is vulnerable to prototype pollution. An attacker is able to add and modify arbitrary properties via Object.prototype using a proto payload...

Ini-parser Resource Management Error Vulnerability

Ini-parser is a parser for .ini format files. A resource management error vulnerability exists in ini-parser 0.0.2 and earlier versions. An attacker can exploit this vulnerability to add or modify properties of Object.prototype to execute arbitrary code...

XAMPP Arbitrary Command Execution Vulnerability

XAMPP is a free open source cross-platform Web server solution stack package developed by Apache Friends. An arbitrary command execution vulnerability exists in XAMPP. An attacker can exploit this vulnerability by changing the .exe configuration in xampp-contol.ini for all users including...

CVE-2020-7617

ini-parser through 0.0.2 is vulnerable to Prototype Pollution.The library could be tricked into adding or modifying properties of Object.prototype using a 'proto' payload...

CVE-2020-7617

ini-parser through 0.0.2 is vulnerable to Prototype Pollution.The library could be tricked into adding or modifying properties of Object.prototype using a 'proto' payload...

CVE-2020-7617

ini-parser through 0.0.2 is vulnerable to Prototype Pollution.The library could be tricked into adding or modifying properties of Object.prototype using a 'proto' payload...

CVE-2020-7617 Prototype Pollution

ini-parser through 0.0.2 is vulnerable to Prototype Pollution.The library could be tricked into adding or modifying properties of Object.prototype using a 'proto' payload...

CVE-2020-7617

The CVE-2020-7617 entry concerns the ini-parser package (up to version 0.0.2) and describes a Prototype Pollution vulnerability. An attacker can exploit a proto payload to add or modify properties on Object.prototype, enabling potential attacker-controlled behavior across JavaScript objects. Seve...

Prototype Pollution

Overview ini-parser is a package to parse .ini files. Affected versions of this package are vulnerable to Prototype Pollution. The library could be tricked into adding or modifying properties of Object.prototype using a proto payload. PoC var a = require"ini-parser"; a.parse'proto\ntoString=JHU';...

@dawnjs/cli (>=1.11.0, <=1.13.7), @dawnjs/dn-middleware-lint (3.0.12) +49 more potentially affected by CVE-2020-7617 via ini-parser (0.0.2)

ini-parser NPM version 0.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on ini-parser and may be impacted: - @dawnjs/cli =1.11.0, =1.0.0, =0.0.1, =1.0.0-beta, =0.0.2, =0.0.1, =0.5.12, =1.0.1, =0.0.1, =3.0.0-alpha.36, =1.0.11, =1.1.4 and more Source...

Avast Secure Browser Local Elevation of Privilege Vulnerability

Avast Secure Browser is a new browser built for privacy. A security vulnerability exists in Avast Secure Browser version 76.0.1659.101 that stems from an insecure ACL set by the AvastBrowserUpdate.exe file. The vulnerability can be exploited by creating a hard link named Update.ini in the...

PHP-FPM 7.x Remote Code Execution Exploit

This Metasploit module exploits an underflow vulnerability in PHP-FPM versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 of PHP-FPM on Nginx. Only servers with certain Nginx + PHP-FPM configurations are exploitable. This is a port of the original neex's exploit code see refs...

PT-2020-9879 · Avast · Avast Secure Browser

Name of the Vulnerable Software and Affected Versions: Avast Secure Browser version 76.0.1659.101 Description: A Local Privilege Escalation issue was discovered due to an insecure ACL set by the AvastBrowserUpdate.exe when AvastSecureBrowser.exe checks for new updates. The elevated process cleans...

PHP-FPM Underflow RCE

This module exploits an underflow vulnerability in versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 of PHP-FPM on Nginx. Only servers with certains Nginx + PHP-FPM configurations are exploitable. This is a port of the original neex's exploit code see refs.. First, it detects...

Design/Logic Flaw

mIRC before 7.55 allows remote command execution by using argument injection through custom URI protocol handlers. The attacker can specify an irc:// URI that loads an arbitrary .ini file from a UNC share pathname. Exploitation depends on browser-specific URI handling Chrome is not exploitable...

(0Day) Wecon LeviStudioU DataLogTool INI Parser Stack-based Buffer Overflow Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Wecon LeviStudioU. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within DataLogTool.ex...

Icinga Web 2 Information Disclosure Vulnerability

Icinga Web 2 is a PHP-based responsive and extensible web application framework from the Icinga project. A security vulnerability exists in Icinga Web 2 version 2.6.1. An attacker can exploit the vulnerability to inject PHP ini-file directives and obtain information...

CVE-2018-18249

Icinga Web 2 before 2.6.2 allows injection of PHP ini-file directives via vectors involving environment variables as the channel to send information to the attacker, such as a name=$PATH$APACHERUNDIR$APACHERUNUSER parameter to /icingaweb2/navigation/add or /icingaweb2/dashboard/new-dashlet...

DEBIAN-CVE-2018-18249

Icinga Web 2 before 2.6.2 allows injection of PHP ini-file directives via vectors involving environment variables as the channel to send information to the attacker, such as a name=$PATH$APACHERUNDIR$APACHERUNUSER parameter to /icingaweb2/navigation/add or /icingaweb2/dashboard/new-dashlet...

CVE-2018-18249

Icinga Web 2 before 2.6.2 allows injection of PHP ini-file directives via vectors involving environment variables as the channel to send information to the attacker, such as a name=$PATH$APACHERUNDIR$APACHERUNUSER parameter to /icingaweb2/navigation/add or /icingaweb2/dashboard/new-dashlet...