0i0 (1.0.10), 0xgank-tea-advice-pull (1.0.0) +9553 more potentially affected by CVE-2020-28477 +1 more via immer (>=7.0.0, <=9.0.5)

immer NPM version =7.0.0, =9.0.5 is affected by a known vulnerability. The following packages have a transitive dependency on immer and may be impacted: - 0i0 1.0.10 - 0xgank-tea-advice-pull 1.0.0 - 0xgank-tea-balance-pencil 1.0.0 - 0xgank-tea-brick-bell 1.0.0 - 0xgank-tea-cake-victory 1.0.0 -...

Security Bulletin: IBM App Connect Enterprise Certified Container Designer Authoring components may be vulnerable to a denial of service attack (CVE-2020-28477)

Summary A Designer Authoring component in App Connect Enterprise Certified Container may be vulnerable to a denial of service vulnerability due to a prototype polution vulnerability in one of the UI's dependencies Vulnerability Details CVEID: CVE-2020-28477 DESCRIPTION: Node.js immer module is...

RHEL 8 : RHV Manager (ovirt-engine) 4.4.z [ovirt-4.4.5] security, (Moderate) (RHSA-2021:1169)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:1169 advisory. The ovirt-engine package provides the manager for virtualization environments. This manager enables admins to define hosts and networks, as...

nodejs-immer: prototype pollution may lead to DoS or remote code execution

This affects all versions of package immer...

Prototype Pollution

Overview Overview Affected versions of immer are vulnerable to Prototype Pollution. Proof of exploit const applyPatches, enablePatches = require"immer"; enablePatches; let obj = ; console.log"Before : " + obj.polluted; applyPatches, op: 'add', path: "proto", "polluted" , value: "yes" ; //...

0i0 (1.0.10), @1productaweek/react-stately (>=0.1.1, <=0.1.7) +1068 more potentially affected by CVE-2020-28477 via immer (>=7.0.0, <=8.0.0)

immer NPM version =7.0.0, =0.1.1, =0.1.0, =0.0.3-alpha.52, =0.0.10, =0.0.1, =0.1.0, =0.1.1, =0.97.1-20210526212817, =0.1.0, =2.3.1, =1.0.59, =4.4.2, =4.5.9 and more Source cves: CVE-2020-28477 Source advisory: OSV:GHSA-9QMH-276G-X5PJ...

GHSA-9QMH-276G-X5PJ Prototype Pollution in immer

Overview Affected versions of immer are vulnerable to Prototype Pollution. Proof of exploit js const applyPatches, enablePatches = require"immer"; enablePatches; let obj = ; console.log"Before : " + obj.polluted; applyPatches, op: 'add', path: "proto", "polluted" , value: "yes" ; // applyPatches,...

Prototype Pollution

immer is vulnerable to prototype pollution. An attacker is able to exploit the vulnerability to inject arbitrary properties into existing construct prototypes and modify attributes such as proto, constructor and prototype...

CVE-2020-28477

This affects all versions of package immer...

CVE-2020-28477

This affects all versions of package immer...

Design/Logic Flaw

This affects all versions of package immer...

CVE-2020-28477

CVE-2020-28477 affects the Node.js module immer and is described as a denial of service arising from a prototype pollution flaw. The core issue is tied to how patch application handles player-supplied path keys (including array-like keys), which in some disclosures can bypass part of the vulnerab...

CVE-2020-28477 Prototype Pollution

This affects all versions of package immer...

Immer Security Breach

Immer is a Javascript-based state management library for the Immer community. A security vulnerability exists in all versions of Immer. No information about this vulnerability is available at this time, please stay tuned to CNNVD or the vendor's announcement...

CVE-2020-28477: Undefined Security Weakness

This affects all versions of package immer...

0i0 (1.0.10), @1productaweek/react-stately (>=0.1.1, <=0.1.7) +1068 more potentially affected by CVE-2020-28477 via immer (>=7.0.0, <=8.0.0)

immer NPM version =7.0.0, =0.1.1, =0.1.0, =0.0.3-alpha.52, =0.0.10, =0.0.1, =0.1.0, =0.1.1, =0.97.1-20210526212817, =0.1.0, =2.3.1, =1.0.59, =4.4.2, =4.5.9 and more Source cves: CVE-2020-28477 Source advisory: SNYK:JS-IMMER-1019369...

Prototype Pollution

Overview immer is a package that allows you to create your next immutable state by mutating the current one. Affected versions of this package are vulnerable to Prototype Pollution. PoC const applyPatches, enablePatches = require"immer"; enablePatches; let obj = ; console.log"Before : " +...

immer:flex-vector-gc: Crash in immer::detail::rbts::node<int, immer::memory_policy<immer::heap_policy<immer::gc

Project: https://github.com/arximboldi/immer.git Detailed Report: https://oss-fuzz.com/testcase?key=5660697665732608 Project: immer Fuzzing Engine: libFuzzer Fuzz Target: flex-vector-gc Job Type: libfuzzerasanimmer Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x7083eb04e907 Crash...

immer:flex-vector-gc: Crash in decltype

Project: https://github.com/arximboldi/immer.git Detailed Report: https://oss-fuzz.com/testcase?key=6017886557306880 Project: immer Fuzzing Engine: libFuzzer Fuzz Target: flex-vector-gc Job Type: libfuzzerasanimmer Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x00018055f9f9 Crash...

immer:flex-vector-gc: Crash in immer::detail::rbts::relaxed_pos<immer::detail::rbts::node<int, immer::memory_po

Project: https://github.com/arximboldi/immer.git Detailed Report: https://oss-fuzz.com/testcase?key=4855756386729984 Project: immer Fuzzing Engine: libFuzzer Fuzz Target: flex-vector-gc Job Type: libfuzzerasanimmer Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x000180453daf Crash...