CVE-2016-10673: Missing Encryption of Sensitive Data

ipip-coffee queries geolocation information from IP ipip-coffee downloads geolocation resources over HTTP, which leaves it vulnerable to MITM attacks. This could impact the integrity and availability of the data being used to make geolocation decisions by an application...

PT-2018-4822

Name of the Vulnerable Software and Affected Versions slimerjs-edge versions affected versions not specified Description The issue allows for a man-in-the-middle MITM attack due to the insecure download of binary resources over HTTP. This could potentially lead to remote code execution RCE if an...

PT-2018-4863

Name of the Vulnerable Software and Affected Versions pk-app-wonderbox affected versions not specified Description The issue allows for potential man-in-the-middle MITM attacks due to the insecure download of binary resources over HTTP. This could lead to remote code execution RCE if an attacker...

CVE-2016-10690: Missing Encryption of Sensitive Data

openframe-ascii-image module is an openframe plugin which adds support for ascii images via fim. openframe-ascii-image downloads resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested resources with an...

PT-2018-4853

Name of the Vulnerable Software and Affected Versions libsbmlsim affected versions not specified Description The issue arises from libsbmlsim downloading binary resources over HTTP, making it susceptible to man-in-the-middle MITM attacks. This could potentially lead to remote code execution RCE i...

PT-2018-4864

Name of the Vulnerable Software and Affected Versions fis-sass-all affected versions not specified Description The issue concerns the insecure download of binary resources over HTTP, making it susceptible to man-in-the-middle MITM attacks. This could potentially lead to remote code execution RCE ...

PT-2018-4831

Name of the Vulnerable Software and Affected Versions xd-testing versions affected versions not specified Description The issue concerns the insecure download of binary resources over HTTP, making it susceptible to man-in-the-middle MITM attacks. This could potentially lead to remote code executi...

CVE-2016-10678: Missing Encryption of Sensitive Data

serc.js is a Selenium RC process wrapper serc.js downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested resources with an attacker controlled copy if the attacker is on the network or...

CVE-2017-16035: Missing Encryption of Sensitive Data

The hubl-server module is a wrapper for the HubL Development Server. During installation hubl-server downloads a set of dependencies from api.hubapi.com. It appears in the code that these files are downloaded over HTTPS however the api.hubapi.com endpoint redirects to a HTTP url. Because of this...

CVE-2016-10651: Missing Encryption of Sensitive Data

webdriver-launcher is a Node.js Selenium Webdriver Launcher. webdriver-launcher downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested binary with an attacker controlled binary if the...

CVE-2016-10661: Missing Encryption of Sensitive Data

phantomjs-cheniu is a Headless WebKit with JS API phantomjs-cheniu downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested resources with an attacker controlled copy if the attacker is on...

CVE-2017-16041: Missing Encryption of Sensitive Data

ikst versions before 1.1.2 download resources over HTTP, which leaves it vulnerable to MITM attacks...

CVE-2017-16040: Missing Encryption of Sensitive Data

gfe-sass is a library for promises CommonJS/Promises/A,B,D gfe-sass downloads resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested resources with an attacker controlled copy if the attacker is on the...

PT-2018-4865

Name of the Vulnerable Software and Affected Versions windows-selenium-chromedriver affected versions not specified Description The issue allows for potential man-in-the-middle MITM attacks due to the insecure download of binary resources over HTTP. This could lead to remote code execution RCE if...

PT-2018-4819

Name of the Vulnerable Software and Affected Versions node-bsdiff-android versions affected versions not specified Description The issue allows for man-in-the-middle MITM attacks due to insecure resource downloads over HTTP. In scenarios where an attacker has a privileged network position, they c...

PT-2018-4825

Name of the Vulnerable Software and Affected Versions node-air-sdk versions affected versions not specified Description The issue concerns the insecure download of binary resources over HTTP, making it susceptible to man-in-the-middle MITM attacks. This could potentially lead to remote code...

PT-2018-4816

Name of the Vulnerable Software and Affected Versions js-given versions prior to 0.0.18 Description The issue concerns the insecure download of binary resources over HTTP, making it susceptible to man-in-the-middle MITM attacks. If an attacker is positioned on the network or between the user and...

PT-2018-4872

Name of the Vulnerable Software and Affected Versions alto-saxophone versions prior to 2.25.1 Description The issue concerns the insecure download of binary resources over HTTP, making it susceptible to man-in-the-middle MITM attacks. An attacker with a privileged network position could intercept...

PT-2018-4826

Name of the Vulnerable Software and Affected Versions marionette-socket-host affected versions not specified Description The issue allows for potential man-in-the-middle MITM attacks due to the insecure download of binary resources over HTTP. This could lead to remote code execution RCE if an...

PT-2018-4866

Name of the Vulnerable Software and Affected Versions haxe3 affected versions not specified Description The issue allows for man-in-the-middle MITM attacks due to the use of HTTP for downloading resources. This could potentially lead to remote code execution RCE if an attacker intercepts and alte...