grunt-air-sdk (>=0.1.0, <=0.1.1) potentially affected by CVE-2016-10603 via air-sdk (16.0.0-272-9)

air-sdk NPM version 16.0.0-272-9 is affected by a known vulnerability. The following packages have a transitive dependency on air-sdk and may be impacted: - grunt-air-sdk =0.1.0, =0.1.1 Source cves: CVE-2016-10603 Source advisory: GHSA-6JX3-RQCX-G3WW...

autotest-engine (>=1.0.0, <=1.3.9), grunt-newman (1.0.7) +11 more potentially affected by CVE-2016-2515 via hawk (>=3.1.0, <=3.1.2)

hawk NPM version =3.1.0, =1.0.0, =1.0.0, =0.1.6, =1.2.25, =0.0.1, =0.0.6-prealpha.1, =1.0.0, =4.0.3, =1.0.0, =2.1.2, =2.2.0 Source cves: CVE-2016-2515 Source advisory: GHSA-JCPV-G9RR-QXRC...

grunt-http (>=2.0.0, <=2.2.0) potentially affected by CVE-2016-2515 via hawk (4.0.1)

hawk NPM version 4.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on hawk and may be impacted: - grunt-http =2.0.0, =2.2.0 Source cves: CVE-2016-2515 Source advisory: GHSA-JCPV-G9RR-QXRC...

grunt-http (>=2.0.0, <=2.2.0) potentially affected by CVE-2016-2515 via hawk (4.0.1)

hawk NPM version 4.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on hawk and may be impacted: - grunt-http =2.0.0, =2.2.0 Source cves: CVE-2016-2515 Source advisory: OSV:GHSA-JCPV-G9RR-QXRC...

browsertime (>=1.0.0-alpha.0, <=1.0.0-beta.17), gome-sitespeed.io (>=1.0.0, <=1.2.3) +6 more potentially affected by CVE-2016-10694 via alto-saxophone (>=2.21.0, <=2.25.0)

alto-saxophone NPM version =2.21.0, =1.0.0-alpha.0, =1.0.0, =1.0.0, =4.0.0-alpha.1, =0.2.0, =0.1.0, =0.1.3 Source cves: CVE-2016-10694 Source advisory: GHSA-2P69-GXPM-5469...

clam-util (>=0.0.5, <=0.1.20), generator-clam (>=0.1.68, <=0.1.86) +2 more potentially affected by CVE-2018-3719 via mixin-deep (1.0.1)

mixin-deep NPM version 1.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on mixin-deep and may be impacted: - clam-util =0.0.5, =0.1.68, =0.3.0-alpha.2, =0.4.12 - grunt-formatdata 0.1.1 Source cves: CVE-2018-3719 Source advisory: OSV:GHSA-3MPR-HQ3P-49...

clam-util (>=0.0.5, <=0.1.20), generator-clam (>=0.1.68, <=0.1.86) +2 more potentially affected by CVE-2018-3719 via mixin-deep (1.0.1)

mixin-deep NPM version 1.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on mixin-deep and may be impacted: - clam-util =0.0.5, =0.1.68, =0.3.0-alpha.2, =0.4.12 - grunt-formatdata 0.1.1 Source cves: CVE-2018-3719 Source advisory: GHSA-3MPR-HQ3P-49H9...

grunt-images remote code execution vulnerability

grunt-images is a grunt plugin for working with images. A security vulnerability exists in grunt-images that originates when the program downloads binary resources over the HTTP protocol. A remote attacker could exploit the vulnerability by replacing the requested binary with an attacker-controll...

grunt-ccompiler Man-in-the-Middle Attack Vulnerability

grunt-ccompiler is a Grunt plugin for compiling Closure. A security vulnerability exists in grunt-ccompiler that originates when the program downloads binary resources over the HTTP protocol. A remote attacker could exploit the vulnerability by replacing the requested binary with an...

Man-in-the-Middle(MitM)

Grunt-Images is susceptible to man-in-the-middle MitM attacks. The attacker can download binary resources via HTTP, allowing MitM attacks. Since the attacker can replace the requested binary with its controlled binary if the attacker is on the network or positioned in between the user and the...

CVE-2016-10636

grunt-ccompiler is a Closure Compiler Grunt Plugin. grunt-ccompiler downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested binary with an attacker controlled binary if the attacker is on...

CVE-2016-10645

grunt-images is a grunt plugin for processing images. grunt-images downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested binary with an attacker controlled binary if the attacker is on...

CVE-2016-10645

grunt-images is a grunt plugin for processing images. grunt-images downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested binary with an attacker controlled binary if the attacker is on...

CVE-2016-10636

grunt-ccompiler is a Closure Compiler Grunt Plugin. grunt-ccompiler downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested binary with an attacker controlled binary if the attacker is on...

CVE-2016-10645

grunt-images is affected by a vulnerability where it downloads binary resources over HTTP, enabling a man-in-the-middle attacker with network access to swap the binary and potentially trigger remote code execution. The issue is due to insecure HTTP download of executables, with high impact for co...

CVE-2016-10636

** grunt-ccompiler** is a Closure Compiler Grunt Plugin that insecurely downloads executables over HTTP. An attacker with a privileged network position can intercept the response and replace the binary with a malicious one, potentially causing remote code execution on the system running grunt-cco...

CVE-2016-10645

grunt-images is a grunt plugin for processing images. grunt-images downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested binary with an attacker controlled binary if the attacker is on...

CVE-2016-10636: Missing Encryption of Sensitive Data

grunt-ccompiler is a Closure Compiler Grunt Plugin. grunt-ccompiler downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested binary with an attacker controlled binary if the attacker is on...

PT-2018-4814

Name of the Vulnerable Software and Affected Versions grunt-ccompiler versions affected versions not specified Description The issue concerns the insecure download of binary resources over HTTP, making it susceptible to man-in-the-middle MITM attacks. This could potentially lead to remote code...

CVE-2016-10645: Missing Encryption of Sensitive Data

grunt-images is a grunt plugin for processing images. grunt-images downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested binary with an attacker controlled binary if the attacker is on...