Lucene search

CVE-2016-10571

🗓️ 31 May 2018 20:02:29Reported by hackeroneType

bkjs-wand is imagemagick wand support for node.js and backendjs bkjs-wand versions lower than 0.3.2 download binary resources over HTTP, leaving it vulnerable to MITM attacks and possible remote code execution (RCE)

Reporter	Title	Published	Views	Family All 7
Github Security Blog	Downloads Resources over HTTP in bkjs-wand	18 Feb 201923:52	–	github
OSV	Downloads Resources over HTTP in bkjs-wand	18 Feb 201923:52	–	osv
NVD	CVE-2016-10571	31 May 201820:29	–	nvd
Node.js	Downloads Resources over HTTP	1 Dec 201616:02	–	nodejs
Cvelist	CVE-2016-10571	31 May 201820:00	–	cvelist
Prion	Remote code execution	31 May 201820:29	–	prion
Veracode	Man In The Middle (MitM)	20 Dec 201605:08	–	veracode

Nvd

Vulners

Node

bkjs-wand_project bkjs-wandRange<0.3.2node.js

[
  {
    "product": "bkjs-wand node module",
    "vendor": "HackerOne",
    "versions": [
      {
        "status": "affected",
        "version": "<0.3.2"
      }
    ]
  }
]

Source	Link
nodesecurity	www.nodesecurity.io/advisories/220

Transform Your Security Services

Elevate your offerings with Vulners' advanced Vulnerability Intelligence. Contact us for a demo and discover the difference comprehensive, actionable intelligence can make in your security strategy.

Book a live demo

31 May 2018 20:29Current

8.3High risk

Vulners AI Score8.3

CVSS29.3

CVSS38.1

EPSS0.00606