CVE-2016-10655

The clang-extra module installs LLVM's clang-extra tools. clang-extra downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested resources with an attacker controlled copy if the attacker is...

CVE-2016-10673

ipip-coffee is vulnerable to MITM attacks because it downloads geolocation resources over HTTP. The root cause is unencrypted HTTP resource retrieval, which can allow an attacker with a privileged network position to modify or read resources, impacting the integrity and availability of geolocatio...

CVE-2016-10683

arcanist downloads resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested resources with an attacker controlled copy if the attacker is on the network or positioned in between the user and the remote...

CVE-2016-10654

SFML downloads resources over HTTP, enabling MITM-style manipulation or disclosure of downloaded resources when an attacker has network visibility. Several connected sources (GitHub advisory GHSA-5Q5W-MF87-57X4, OSV, CNVD, Veracode) describe that the impact ranges from information leakage to remo...

CVE-2016-10654

sfml downloads resources over HTTP, which leaves it vulnerable to MITM attacks...

CVE-2016-10692

CVE-2016-10692 concerns the haxeshim Haxe shim. Multiple connected sources confirm the affected component is haxeshim, which downloads resources over HTTP. The underlying vulnerability is exposure to man-in-the-middle (MITM) attacks, enabling an attacker on the network to swap requested resources...

CVE-2016-10692

haxeshim haxe shim to deal with coexisting versions. haxeshim downloads resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested resources with an attacker controlled copy if the attacker is on the network...

CVE-2016-10668

libsbml is a module that installs Linux binaries for libSBML libsbml downloads resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested resources with an attacker controlled copy if the attacker is on the...

CVE-2016-10667

selenium-portal is a Selenium Testing Framework selenium-portal downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested resources with an attacker controlled copy if the attacker is on th...

CVE-2016-10673

ipip-coffee queries geolocation information from IP ipip-coffee downloads geolocation resources over HTTP, which leaves it vulnerable to MITM attacks. This could impact the integrity and availability of the data being used to make geolocation decisions by an application...

CVE-2016-10672

cloudpub-redis is a module for CloudPub: Redis Backend cloudpub-redis downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested resources with an attacker controlled copy if the attacker is...

CVE-2016-10675

libsbmlsim is a module that installs linux binaries for libsbmlsim libsbmlsim downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested resources with an attacker controlled copy if the...

CVE-2016-10671

mystem-wrapper is a Yandex mystem app wrapper module. mystem-wrapper downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested resources with an attacker controlled copy if the attacker is ...

CVE-2016-10685

pk-app-wonderbox is an integration with wonderbox pk-app-wonderbox downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested resources with an attacker controlled copy if the attacker is on...

CVE-2016-10657

co-cli-installer downloads the co-cli module as part of the install process, but does so over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested resources with an attacker controlled copy if the attacker is on the...

CVE-2016-10677

The CVE-2016-10677 issue affects the Node.js wrapper package google-closure-tools-latest, which downloads Google Closure tools over HTTP. The core risk is MITM interception of binary resources, allowing an attacker on the network to swap the requested executable with a malicious copy, potentially...

CVE-2016-10676

The CVE refers to rs-brightcove, a wrapper around Brightcove’s web API. The issue is that rs-brightcove downloads resources over HTTP and can be manipulated by an attacker with a privileged network position, potentially replacing a downloaded executable and causing remote code execution on the ho...

CVE-2016-10671

The CVE-2016-10671 issue affects the mystem-wrapper; the wrapper downloads binary resources over HTTP, exposing it to MITM attacks. A malicious actor on the network could swap the requested resources with a attacker-controlled copy, potentially enabling remote code execution on the host running m...

CVE-2016-10669

CVE-2016-10669 describes a vulnerability in the soci library where binaries are downloaded over HTTP, enabling a man-in-the-middle to swap resources and potentially execute code remotely if the attacker is on the network or between the user and the server. Connected sources (GHSA and npm advisory...

CVE-2016-10691

CVE-2016-10691 affects the windows-seleniumjar package, which downloads the Selenium Jar over HTTP. The underlying issue is insecure binary/resource retrieval that can be intercepted in a privileged network position, enabling an attacker to swap the downloaded binary and potentially achieve remot...