Description

math.js before 3.17.0 had an arbitrary code execution in the JavaScript engine. Creating a typed function with JavaScript code in the name could result arbitrary execution.

Remediation

References

CVE-2017-1001002

Related Vulnerabilities

WordPress Plugin Ninja Forms Contact Form-The Drag and Drop Form Builder for WordPress SQL Injection (2.9.55.1)

WordPress Plugin SendGrid Security Bypass (1.11.8)

Internet Information Services Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2002-0422)

WordPress Plugin WP Activity Log Cross-Site Request Forgery (4.1.3.2)

Apache Tomcat version older than 7.0.21

Severity

Critical

Classification

CVE-2017-1001002 CWE-94 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Missing Update Known Vulnerabilities