{"id":"EUVD-2020-1502","revision":"e9b1249943834bcd96c70b1af4e745f5","records":[{"revision":"e9b1249943834bcd96c70b1af4e745f5","observedAt":"2026-11-01T18:03:00.742+00:00","statement":{"source":"euvd","id":"EUVD-2020-1502","aliases":["CVE-2020-7788","GHSA-qqgx-2p2h-9c37"],"title":"This affects the package ini before 1.3.6. If an attacker submits a malicious INI file to an application that parses it with ini.parse, they will pollute the prototype on the application. This can be exploited further depending on the conte…","description":"This affects the package ini before 1.3.6. If an attacker submits a malicious INI file to an application that parses it with ini.parse, they will pollute the prototype on the application. This can be exploited further depending on the context.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P","score":7.3,"severity":null}],"references":["https://snyk.io/vuln/SNYK-JS-INI-1048974","https://github.com/npm/ini/commit/56d2805e07ccd94e2ba0984ac9240ff02d44b6f1","https://lists.debian.org/debian-lts-announce/2020/12/msg00032.html"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-1502","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Dec 11, 2020, 10:45:14 AM","dateUpdated":"Oct 8, 2026, 9:13:48 PM"},"relatedAdvisories":[{"id":"RHSA-2022:0350","title":"Red Hat Security Advisory: nodejs:14 security, bug fix, and enhancement update","vulnerabilityIds":["CVE-2020-7788","CVE-2020-28469","CVE-2021-3807","CVE-2021-3918","CVE-2021-22959","CVE-2021-22960","CVE-2021-33502","CVE-2021-37701","CVE-2021-37712"]},{"id":"RHSA-2021:3280","title":"Red Hat Security Advisory: rh-nodejs14-nodejs and rh-nodejs14-nodejs-nodemon security update","vulnerabilityIds":["CVE-2020-7788","CVE-2020-28469","CVE-2021-3672","CVE-2021-22930","CVE-2021-22931","CVE-2021-22939","CVE-2021-22940","CVE-2021-23343","CVE-2021-32803","CVE-2021-32804"]},{"id":"RHSA-2021:0548","title":"Red Hat Security Advisory: nodejs:10 security update","vulnerabilityIds":["CVE-2020-7608","CVE-2020-7754","CVE-2020-7774","CVE-2020-7788","CVE-2020-8116","CVE-2020-8252","CVE-2020-8265","CVE-2020-8287","CVE-2020-15095","CVE-2020-15366"]},{"id":"RHSA-2021:0485","title":"Red Hat Security Advisory: rh-nodejs12-nodejs security update","vulnerabilityIds":["CVE-2018-3750","CVE-2019-10746","CVE-2019-10747","CVE-2020-7754","CVE-2020-7788","CVE-2020-8265","CVE-2020-8287"]},{"id":"RHSA-2021:0421","title":"Red Hat Security Advisory: rh-nodejs14-nodejs security update","vulnerabilityIds":["CVE-2020-7754","CVE-2020-7774","CVE-2020-7788","CVE-2020-8265","CVE-2020-8277","CVE-2020-8287","CVE-2020-15366"]},{"id":"WID-SEC-W-2023-0856","title":"IBM QRadar SIEM: Mehrere Schwachstellen","vulnerabilityIds":["CVE-2020-11655","CVE-2020-11656","CVE-2020-13434","CVE-2020-13435","CVE-2020-13630","CVE-2020-13631","CVE-2020-13632","CVE-2020-15168","CVE-2020-15358","CVE-2020-28469","CVE-2020-7788","CVE-2020-9327","CVE-2021-22918","CVE-2021-22930","CVE-2021-22931","CVE-2021-22939","CVE-2021-22940","CVE-2021-23343","CVE-2021-23362","CVE-2021-27290","CVE-2021-32803","CVE-2021-32804","CVE-2021-33502","CVE-2021-3672","CVE-2021-37701","CVE-2021-37712","CVE-2021-37713","CVE-2021-3807","CVE-2021-3918"]},{"id":"RHSA-2021:0551","title":"Red Hat Security Advisory: nodejs:14 security and bug fix update","vulnerabilityIds":["CVE-2020-7754","CVE-2020-7774","CVE-2020-7788","CVE-2020-8265","CVE-2020-8277","CVE-2020-8287","CVE-2020-15366"]},{"id":"RHSA-2021:0521","title":"Red Hat Security Advisory: rh-nodejs10-nodejs security update","vulnerabilityIds":["CVE-2020-7608","CVE-2020-7754","CVE-2020-7774","CVE-2020-7788","CVE-2020-8116","CVE-2020-8252","CVE-2020-8265","CVE-2020-8287","CVE-2020-15095","CVE-2020-15366"]},{"id":"RHSA-2021:5171","title":"Red Hat Security Advisory: nodejs:16 security, bug fix, and enhancement update","vulnerabilityIds":["CVE-2020-7788","CVE-2020-28469","CVE-2021-3807","CVE-2021-3918","CVE-2021-22959","CVE-2021-22960","CVE-2021-33502"]},{"id":"RHSA-2022:6595","title":"Red Hat Security Advisory: nodejs and nodejs-nodemon security and bug fix update","vulnerabilityIds":["CVE-2020-7788","CVE-2020-28469","CVE-2021-3807","CVE-2021-33502","CVE-2022-29244","CVE-2022-32212","CVE-2022-32213","CVE-2022-32214","CVE-2022-32215","CVE-2022-33987"]},{"id":"RHSA-2021:3281","title":"Red Hat Security Advisory: rh-nodejs12-nodejs and rh-nodejs12-nodejs-nodemon security update","vulnerabilityIds":["CVE-2020-7788","CVE-2020-28469","CVE-2021-3672","CVE-2021-22930","CVE-2021-22931","CVE-2021-22939","CVE-2021-22940","CVE-2021-23343","CVE-2021-32803","CVE-2021-32804"]},{"id":"RHSA-2021:0549","title":"security update for nodejs","vulnerabilityIds":["CVE-2018-3750","CVE-2019-10746","CVE-2019-10747","CVE-2020-7754","CVE-2020-7788","CVE-2020-8265","CVE-2020-8287"]},{"id":"RHSA-2022:0246","title":"Red Hat Security Advisory: nodejs:14 security, bug fix, and enhancement update","vulnerabilityIds":["CVE-2020-7788","CVE-2020-28469","CVE-2021-3807","CVE-2021-3918","CVE-2021-22959","CVE-2021-22960","CVE-2021-33502","CVE-2021-37701","CVE-2021-37712"]}],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2020-1502","identifiers":["EUVD-2020-1502","CVE-2020-7788","GHSA-qqgx-2p2h-9c37"]},"retained":false,"historicalAffected":[]}],"coverage":[]}