Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2017-1000479 State: PUBLISHED Published: 2018-01-03T18:00:00 Last Updated: 2024-08-05T22:00:41.563Z Vendors: n/a Products: n/a Problem Types: n/a Description: pfSense versions 2.4.1 and lower are vulnerable to clickjacking attacks in the CSRF error page resulting in privileged execution of arbitrary code, because the error detection occurs before an X-Frame-Options header is set. This is fixed in 2.4.2-RELEASE. OPNsense, a 2015 fork of pfSense, was not vulnerable since version 16.1.16 released on June 06, 2016. The unprotected web form was removed from the code during an internal security audit under "possibly insecure" suspicions. Additional Analyst Notes: - CVE Program Containe
during an internal security audit under "possibly insecure" suspicions. Additional Analyst Notes: - CVE Program Container: References: - https://doc.pfsense.org/index.php/2.4.2_New_Features_and_Changes - https://www.netgate.com/blog/pfsense-2-4-2-release-p1-and-2-3-5-release-p1-now-available.html - https://github.com/opnsense/core/commit/d218b225 - https://www.securify.nl/en/advisory/SFY20171101/clickjacking-vulnerability-in-csrf-error-page-pfsense.html - https://github.com/pfsense/pfsense/commit/386d89b07 - http://www.openwall.com/lists/oss-security/2017/11/22/7
CVE ID: CVE-2017-1000480 State: PUBLISHED Published: 2018-01-03T18:00:00 Last Updated: 2024-08-05T22:00:41.503Z Vendors: n/a Products: n/a Problem Types: n/a Description: Smarty 3 before 3.1.32 is vulnerable to a PHP code injection when calling fetch() or display() functions on custom resources that does not sanitize template name. Additional Analyst Notes: - CVE Program Container: References: - https://www.debian.org/security/2018/dsa-4094 - https://github.com/smarty-php/smarty/blob/master/change_log.txt - https://lists.debian.org/debian-lts-announce/2018/01/msg00023.html - https://lists.debian.org/debian-lts-announce/2018/02/msg00000.html
CVE ID: CVE-2017-1000481 State: PUBLISHED Published: 2018-01-03T18:00:00Z Last Updated: 2024-09-17T01:35:36.029Z Vendors: n/a Products: n/a Problem Types: n/a Description: When you visit a page where you need to login, Plone 2.5-5.1rc1 sends you to the login form with a 'came_from' parameter set to the previous url. After you login, you get redirected to the page you tried to view before. An attacker might try to abuse this by letting you click on a specially crafted link. You would login, and get redirected to the site of the attacker, letting you think that you are still on the original Plone site. Or some javascript of the attacker could be executed. Most of these types of attacks are alr
on the original Plone site. Or some javascript of the attacker could be executed. Most of these types of attacks are already blocked by Plone, using the `isURLInPortal` check to make sure we only redirect to a page on the same Plone site. But a few more ways of tricking Plone into accepting a malicious link were discovered, and fixed with this hotfix. Additional Analyst Notes: - CVE Program Container: References: - https://plone.org/security/hotfix/20171128/open-redirection-on-login-form
CVE ID: CVE-2017-1000482 State: PUBLISHED Published: 2018-01-03T18:00:00Z Last Updated: 2024-09-16T23:16:28.984Z Vendors: n/a Products: n/a Problem Types: n/a Description: A member of the Plone 2.5-5.1rc1 site could set javascript in the home_page property of his profile, and have this executed when a visitor click the home page link on the author page. Additional Analyst Notes: - CVE Program Container: References: - https://plone.org/security/hotfix/20171128/xss-using-the-home_page-member-property
CVE ID: CVE-2017-1000483 State: PUBLISHED Published: 2018-01-03T18:00:00Z Last Updated: 2024-09-17T04:15:16.308Z Vendors: n/a Products: n/a Problem Types: n/a Description: Accessing private content via str.format in through-the-web templates and scripts in Plone 2.5-5.1rc1. This improves an earlier hotfix. Since the format method was introduced in Python 2.6, this part of the hotfix is only relevant for Plone 4 and 5. Additional Analyst Notes: - CVE Program Container: References: - https://plone.org/security/hotfix/20171128/sandbox-escape
CVE ID: CVE-2017-1000484 State: PUBLISHED Published: 2018-01-03T20:00:00Z Last Updated: 2024-09-16T19:52:21.255Z Vendors: n/a Products: n/a Problem Types: n/a Description: By linking to a specific url in Plone 2.5-5.1rc1 with a parameter, an attacker could send you to his own website. On its own this is not so bad: the attacker could more easily link directly to his own website instead. But in combination with another attack, you could be sent to the Plone login form and login, then get redirected to the specific url, and then get a second redirect to the attacker website. (The specific url can be seen by inspecting the hotfix code, but we don't want to make it too easy for attackers by spel
(The specific url can be seen by inspecting the hotfix code, but we don't want to make it too easy for attackers by spelling it out here.) Additional Analyst Notes: - CVE Program Container: References: - https://plone.org/security/hotfix/20171128/an-open-redirection-when-calling-a-specific-url
CVE ID: CVE-2017-1000485 State: PUBLISHED Published: 2018-01-03T20:00:00Z Last Updated: 2024-09-16T21:02:31.246Z Vendors: n/a Products: n/a Problem Types: n/a Description: Nylas Mail Lives 2.2.2 uses 0755 permissions for $HOME/.nylas-mail, which allows local users to obtain sensitive authentication information via standard filesystem operations. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/nylas-mail-lives/nylas-mail/issues/181
CVE ID: CVE-2017-1000486 State: PUBLISHED Published: 2018-01-03T20:00:00.000Z Last Updated: 2025-10-21T23:45:57.153Z Vendors: n/a Products: n/a Problem Types: n/a Description: Primetek Primefaces 5.x is vulnerable to a weak encryption flaw resulting in remote code execution Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/primefaces/primefaces/issues/1152 - https://cryptosense.com/weak-encryption-flaw-in-primefaces/ - http://blog.mindedsecurity.com/2016/02/rce-in-oracle-netbeans-opensource.html - https://www.exploit-db.com/exploits/43733/
CVE ID: CVE-2017-1000487 State: PUBLISHED Published: 2018-01-03T20:00:00 Last Updated: 2024-08-05T22:00:41.635Z Vendors: n/a Products: n/a Problem Types: n/a Description: Plexus-utils before 3.0.16 is vulnerable to command injection because it does not correctly process the contents of double quoted strings. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2018:1322 - https://lists.debian.org/debian-lts-announce/2018/01/msg00011.html - https://snyk.io/vuln/SNYK-JAVA-ORGCODEHAUSPLEXUS-31522 - https://www.debian.org/security/2018/dsa-4149 - https://www.debian.org/security/2018/dsa-4146 - https://github.com/codehaus-plexus/plexus-utils/commi
ty/2018/dsa-4149 - https://www.debian.org/security/2018/dsa-4146 - https://github.com/codehaus-plexus/plexus-utils/commit/b38a1b3a4352303e4312b2bb601a0d7ec6e28f41 - https://lists.debian.org/debian-lts-announce/2018/01/msg00010.html - https://lists.apache.org/thread.html/9317fd092b257a0815434b116a8af8daea6e920b6673f4fd5583d5fe%40%3Ccommits.druid.apache.org%3E - https://lists.apache.org/thread.html/r2e94f72f53df432302d359fd66cfa9e9efb8d42633d54579a4377e62%40%3Cdev.avro.apache.org%3E - https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26%40%3Ccommits.pulsar.apache.org%3E - https://lists.apache.org/thread.html/r9584c4304c888f651d214341a939bd264ed30c9e3d0
26%40%3Ccommits.pulsar.apache.org%3E - https://lists.apache.org/thread.html/r9584c4304c888f651d214341a939bd264ed30c9e3d0d30fe85097ecf%40%3Ccommits.pulsar.apache.org%3E
CVE ID: CVE-2017-1000488 State: PUBLISHED Published: 2018-01-03T16:00:00Z Last Updated: 2024-09-16T23:46:50.151Z Vendors: n/a Products: n/a Problem Types: n/a Description: Mautic version 2.1.0 - 2.11.0 is vulnerable to an inline JS XSS attack when using Mautic forms on a Mautic landing page using GET parameters to pre-populate the form. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/mautic/mautic/releases/tag/2.12.0
CVE ID: CVE-2017-1000489 State: PUBLISHED Published: 2018-01-03T17:00:00Z Last Updated: 2024-09-17T00:42:20.126Z Vendors: n/a Products: n/a Problem Types: n/a Description: Mautic versions 2.0.0 - 2.11.0 with a SSO plugin installed could allow a disabled user to still login using email address Additional Analyst Notes: - CVE Program Container: References: - https://github.com/mautic/mautic/releases/tag/2.12.0
CVE ID: CVE-2017-1000490 State: PUBLISHED Published: 2018-01-03T17:00:00Z Last Updated: 2024-09-16T16:47:37.561Z Vendors: n/a Products: n/a Problem Types: n/a Description: Mautic versions 1.0.0 - 2.11.0 are vulnerable to allowing any authorized Mautic user session (must be logged into Mautic) to use the Filemanager to download any file from the server that the web user has access to. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/mautic/mautic/releases/tag/2.12.0
CVE ID: CVE-2017-1000491 State: PUBLISHED Published: 2018-01-03T01:00:00Z Last Updated: 2024-09-16T17:15:29.687Z Vendors: n/a Products: n/a Problem Types: n/a Description: Shiba markdown live preview app version 1.1.0 is vulnerable to XSS which leads to code execution due to enabled node integration. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/rhysd/Shiba/issues/42 - https://github.com/rhysd/Shiba/commit/e8a65b0f81eb04903eedd29500d7e1bedf249eab
CVE ID: CVE-2017-1000492 State: PUBLISHED Published: 2018-01-03T01:00:00Z Last Updated: 2024-09-16T16:57:51.148Z Vendors: n/a Products: n/a Problem Types: n/a Description: Leanote-desktop version v2.5 is vulnerable to a XSS which leads to code execution due to enabled node integration Additional Analyst Notes: - CVE Program Container: References: - https://github.com/leanote/leanote/issues/695 - https://github.com/leanote/desktop-app/commit/a2ed226637f8e66c9b089784b5e58eccf2e2fb30
CVE ID: CVE-2017-1000493 State: PUBLISHED Published: 2018-01-03T01:00:00 Last Updated: 2024-08-05T22:00:41.572Z Vendors: n/a Products: n/a Problem Types: n/a Description: Rocket.Chat Server version 0.59 and prior is vulnerable to a NoSQL injection leading to administrator account takeover Additional Analyst Notes: - CVE Program Container: References: - http://blog.sbarbeau.fr/2018/03/nosql-injection-leading-to.html - https://github.com/RocketChat/Rocket.Chat/pull/8408
CVE ID: CVE-2017-1000494 State: PUBLISHED Published: 2018-01-03T14:00:00 Last Updated: 2024-08-05T22:00:41.614Z Vendors: n/a Products: n/a Problem Types: n/a Description: Uninitialized stack variable vulnerability in NameValueParserEndElt (upnpreplyparse.c) in miniupnpd < 2.0 allows an attacker to cause Denial of Service (Segmentation fault and Memory Corruption) or possibly have unspecified other impact Additional Analyst Notes: - CVE Program Container: References: - https://github.com/miniupnp/miniupnp/commit/7aeb624b44f86d335841242ff427433190e7168a - https://usn.ubuntu.com/3562-1/ - https://github.com/miniupnp/miniupnp/issues/268 - https://lists.debian.org/debian-lts-announce/2019/05/msg0
om/3562-1/ - https://github.com/miniupnp/miniupnp/issues/268 - https://lists.debian.org/debian-lts-announce/2019/05/msg00045.html
CVE ID: CVE-2017-1000495 State: PUBLISHED Published: 2018-01-03T14:00:00Z Last Updated: 2024-09-16T18:24:38.000Z Vendors: n/a Products: n/a Problem Types: n/a Description: QuickApps CMS version 2.0.0 is vulnerable to Stored Cross-site Scripting in the user's real name field resulting in denial of service and performing unauthorised actions with an administrator user's account Additional Analyst Notes: - CVE Program Container: References: - https://github.com/quickapps/cms/issues/183
CVE ID: CVE-2017-1000496 State: PUBLISHED Published: 2018-01-03T14:00:00Z Last Updated: 2024-09-17T01:51:40.909Z Vendors: n/a Products: n/a Problem Types: n/a Description: Commsy version 9.0.0 is vulnerable to XXE attacks in the configuration import functionality resulting in denial of service and possibly remote execution of code. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/commsy/commsy/issues/2
CVE ID: CVE-2017-1000497 State: PUBLISHED Published: 2018-01-03T14:00:00Z Last Updated: 2024-09-16T17:23:52.896Z Vendors: n/a Products: n/a Problem Types: n/a Description: Pepperminty-Wiki version 0.15 is vulnerable to XXE attacks in the getsvgsize function resulting in denial of service and possibly remote code execution Additional Analyst Notes: - CVE Program Container: References: - https://github.com/sbrl/Pepperminty-Wiki/issues/152
CVE ID: CVE-2017-1000498 State: PUBLISHED Published: 2018-01-03T14:00:00Z Last Updated: 2024-09-16T16:13:29.547Z Vendors: n/a Products: n/a Problem Types: n/a Description: AndroidSVG version 1.2.2 is vulnerable to XXE attacks in the SVG parsing component resulting in denial of service and possibly remote code execution Additional Analyst Notes: - CVE Program Container: References: - https://github.com/BigBadaboom/androidsvg/issues/122
CVE ID: CVE-2017-1000499 State: PUBLISHED Published: 2018-01-03T14:00:00 Last Updated: 2024-08-05T22:00:41.653Z Vendors: n/a Products: n/a Problem Types: n/a Description: phpMyAdmin versions 4.7.x (prior to 4.7.6.1/4.7.7) are vulnerable to a CSRF weakness. By deceiving a user to click on a crafted URL, it is possible to perform harmful database operations such as deleting records, dropping/truncating tables etc. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1040163 - http://cyberworldmirror.com/vulnerability-phpmyadmin-lets-attacker-perform-drop-table-single-click/ - https://www.exploit-db.com/exploits/45284/ - https://www.phpmyadmin.net/s
ts-attacker-perform-drop-table-single-click/ - https://www.exploit-db.com/exploits/45284/ - https://www.phpmyadmin.net/security/PMASA-2017-9/
CVE ID: CVE-2017-1000500 State: REJECTED Published: 2018-01-03T15:00:00 Last Updated: 2018-12-10T13:57:01 Description: No description available.
CVE ID: CVE-2017-1000501 State: PUBLISHED Published: 2018-01-03T15:00:00 Last Updated: 2024-08-05T22:00:41.596Z Vendors: n/a Products: n/a Problem Types: n/a Description: Awstats version 7.6 and earlier is vulnerable to a path traversal flaw in the handling of the "config" and "migrate" parameters resulting in unauthenticated remote code execution. Additional Analyst Notes: - CVE Program Container: References: - https://www.debian.org/security/2018/dsa-4092 - https://lists.debian.org/debian-lts-announce/2018/01/msg00012.html - https://github.com/eldy/awstats/commit/06c0ab29c1e5059d9e0279c6b64d573d619e1651 - http://www.awstats.org/ - https://github.com/eldy/awstats/commit/cf219843a74c951bf598
c1e5059d9e0279c6b64d573d619e1651 - http://www.awstats.org/ - https://github.com/eldy/awstats/commit/cf219843a74c951bf5986f3a7fffa3dcf99c3899 - https://security.gentoo.org/glsa/202007-37
CVE ID: CVE-2017-1000502 State: PUBLISHED Published: 2018-01-24T23:00:00Z Last Updated: 2024-09-16T23:51:29.286Z Vendors: n/a Products: n/a Problem Types: n/a Description: Users with permission to create or configure agents in Jenkins 1.37 and earlier could configure an EC2 agent to run arbitrary shell commands on the master node whenever the agent was supposed to be launched. Configuration of these agents now requires the 'Run Scripts' permission typically only granted to administrators. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2017-12-06/
CVE ID: CVE-2017-1000503 State: PUBLISHED Published: 2018-01-24T23:00:00Z Last Updated: 2024-09-16T17:23:22.695Z Vendors: n/a Products: n/a Problem Types: n/a Description: A race condition during Jenkins 2.81 through 2.94 (inclusive); 2.89.1 startup could result in the wrong order of execution of commands during initialization. This could in rare cases result in failure to initialize the setup wizard on the first startup. This resulted in multiple security-related settings not being set to their usual strict default. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2017-12-14/
CVE ID: CVE-2017-1000504 State: PUBLISHED Published: 2018-01-24T23:00:00 Last Updated: 2024-08-05T22:00:41.623Z Vendors: n/a Products: n/a Problem Types: n/a Description: A race condition during Jenkins 2.94 and earlier; 2.89.1 and earlier startup could result in the wrong order of execution of commands during initialization. There is a very short window of time after startup during which Jenkins may no longer show the 'Please wait while Jenkins is getting ready to work' message but Cross-Site Request Forgery (CSRF) protection may not yet be effective. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2017-12-14/
CVE ID: CVE-2017-1000505 State: PUBLISHED Published: 2018-01-25T18:00:00Z Last Updated: 2024-09-16T17:08:44.858Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Jenkins Script Security Plugin version 1.36 and earlier, users with the ability to configure sandboxed Groovy scripts are able to use a type coercion feature in Groovy to create new `File` objects from strings. This allowed reading arbitrary files on the Jenkins master file system. Such a type coercion is now subject to sandbox protection and considered to be a call to the `new File(String)` constructor for the purpose of in-process script approval. Additional Analyst Notes: - CVE Program Container: References: - https:
r for the purpose of in-process script approval. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2017-12-11/
CVE ID: CVE-2017-1000506 State: PUBLISHED Published: 2018-02-09T23:00:00 Last Updated: 2024-08-05T22:00:41.665Z Vendors: n/a Products: n/a Problem Types: n/a Description: Mautic version 2.11.0 and earlier contains a Cross Site Scripting (XSS) vulnerability in Company's name that can result in denial of service and execution of javascript code. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/mautic/mautic/issues/5222
CVE ID: CVE-2017-1000507 State: PUBLISHED Published: 2018-02-09T23:00:00 Last Updated: 2024-08-05T22:00:41.579Z Vendors: n/a Products: n/a Problem Types: n/a Description: Canvs Canvas version 3.4.2 contains a Cross Site Scripting (XSS) vulnerability in User's details that can result in denial of service and execution of javascript code. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/cnvs/canvas/issues/359
CVE ID: CVE-2017-1000508 State: PUBLISHED Published: 2018-02-09T23:00:00 Last Updated: 2024-08-05T22:00:41.546Z Vendors: n/a Products: n/a Problem Types: n/a Description: Invoice Plane version 1.5.4 and earlier contains a Cross Site Scripting (XSS) vulnerability in Client's details that can result in execution of javascript code . This vulnerability appears to have been fixed in 1.5.5 and later. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/InvoicePlane/InvoicePlane/pull/557/commits/3fc256ccef403f5be9982f02ef340d9e01daabb2 - https://github.com/InvoicePlane/InvoicePlane/pull/557
CVE ID: CVE-2017-1000509 State: PUBLISHED Published: 2018-02-09T23:00:00 Last Updated: 2024-08-05T22:00:41.602Z Vendors: n/a Products: n/a Problem Types: n/a Description: Dolibarr version 6.0.2 contains a Cross Site Scripting (XSS) vulnerability in Product details that can result in execution of javascript code. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Dolibarr/dolibarr/issues/7727
CVE ID: CVE-2017-1000510 State: PUBLISHED Published: 2018-02-09T23:00:00 Last Updated: 2024-08-05T22:00:41.658Z Vendors: n/a Products: n/a Problem Types: n/a Description: Croogo version 2.3.1-17-g6f82e6c contains a Cross Site Scripting (XSS) vulnerability in Page name that can result in execution of javascript code. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/croogo/croogo/issues/847
CVE ID: CVE-2017-1000600 State: PUBLISHED Published: 2018-09-06T12:00:00 Last Updated: 2024-08-05T22:00:41.609Z Vendors: n/a Products: n/a Problem Types: n/a Description: WordPress version <4.9 contains a CWE-20 Input Validation vulnerability in thumbnail processing that can result in remote code execution. This attack appears to be exploitable via thumbnail upload by an authenticated user and may require additional plugins in order to be exploited however this has not been confirmed at this time. This issue appears to have been partially, but not completely fixed in WordPress 4.9 Additional Analyst Notes: - CVE Program Container: References: - https://youtu.be/GePBmsNJw6Y?t=1763 - https://w
ess 4.9 Additional Analyst Notes: - CVE Program Container: References: - https://youtu.be/GePBmsNJw6Y?t=1763 - https://www.theregister.co.uk/2018/08/20/php_unserialisation_wordpress_vuln/ - http://www.securityfocus.com/bid/105305
CVE ID: CVE-2017-1001000 State: PUBLISHED Published: 2017-04-03T01:00:00 Last Updated: 2024-08-05T22:00:41.671Z Vendors: n/a Products: n/a Problem Types: n/a Description: The register_routes function in wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php in the REST API in WordPress 4.7.x before 4.7.2 does not require an integer identifier, which allows remote attackers to modify arbitrary pages via a request for wp-json/wp/v2/posts followed by a numeric value and a non-numeric value, as demonstrated by the wp-json/wp/v2/posts/123?id=123helloworld URI. Additional Analyst Notes: - CVE Program Container: References: - https://codex.wordpress.org/Version_4.7.2 - https://make.wordp
nal Analyst Notes: - CVE Program Container: References: - https://codex.wordpress.org/Version_4.7.2 - https://make.wordpress.org/core/2017/02/01/disclosure-of-additional-security-fix-in-wordpress-4-7-2/ - https://blogs.akamai.com/2017/02/wordpress-web-api-vulnerability.html - https://gist.github.com/leonjza/2244eb15510a0687ed93160c623762ab - https://blog.sucuri.net/2017/02/content-injection-vulnerability-wordpress-rest-api.html - https://github.com/WordPress/WordPress/commit/e357195ce303017d517aff944644a7a1232926f7 - https://wordpress.org/news/2017/01/wordpress-4-7-2-security-release/ - http://www.openwall.com/lists/oss-security/2017/02/10/16 - http://www.securitytracker.com/id/1037731
CVE ID: CVE-2017-1001001 State: PUBLISHED Published: 2017-11-01T17:00:00Z Last Updated: 2024-09-16T23:11:37.230Z Vendors: PluXml Products: PluXml Problem Types: XSS Description: PluXml version 5.6 is vulnerable to stored cross-site scripting vulnerability, within the article creation page, which can result in escalation of privileges. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/pluxml/PluXml/issues/253
CVE ID: CVE-2017-1001002 State: PUBLISHED Published: 2017-11-27T14:00:00Z Last Updated: 2024-09-16T16:59:06.220Z Vendors: math.js Products: math.js Problem Types: CWE-94 Description: math.js before 3.17.0 had an arbitrary code execution in the JavaScript engine. Creating a typed function with JavaScript code in the name could result arbitrary execution. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/josdejong/mathjs/blob/master/HISTORY.md#2017-11-18-version-3170 - https://github.com/josdejong/mathjs/commit/8d2d48d81b3c233fb64eb2ec1d7a9e1cf6a55a90
CVE ID: CVE-2017-1001003 State: PUBLISHED Published: 2017-11-27T14:00:00Z Last Updated: 2024-09-17T03:18:21.144Z Vendors: math.js Products: math.js Problem Types: CWE-88 Description: math.js before 3.17.0 had an issue where private properties such as a constructor could be replaced by using unicode characters when creating an object. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/josdejong/mathjs/blob/master/HISTORY.md#2017-11-18-version-3170 - https://github.com/josdejong/mathjs/commit/a60f3c8d9dd714244aed7a5569c3dccaa3a4e761