CVE-2016-10579: Missing Encryption of Sensitive Data

Chromedriver is an NPM wrapper for selenium ChromeDriver. Chromedriver before 2.26.1 downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested binary with an attacker controlled binary if t...

PT-2018-4759

Name of the Vulnerable Software and Affected Versions steroids versions affected versions not specified Description The issue allows for a man-in-the-middle MITM attack due to the insecure download of resources over HTTP. This could potentially lead to remote code execution RCE if an attacker...

PT-2018-4783

Name of the Vulnerable Software and Affected Versions dalek-browser-ie affected versions not specified Description The issue allows for a man-in-the-middle MITM attack due to the insecure download of binary resources over HTTP. This could potentially lead to remote code execution RCE if an attack...

CVE-2016-10600: Missing Encryption of Sensitive Data

webrtc-native uses WebRTC from chromium project. webrtc-native downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested binary with an attacker controlled binary if the attacker is on the...

CVE-2016-10585: Missing Encryption of Sensitive Data

libxl provides Node bindings for the libxl library for reading and writing excel XLS and XLSX spreadsheets. libxl downloads zipped resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested zip file with an...

CVE-2016-10602: Missing Encryption of Sensitive Data

haxe is a cross-platform toolkit haxe downloads zipped resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested zip file with an attacker controlled zip file if the attacker is on the network or positioned...

CVE-2016-10595: Missing Encryption of Sensitive Data

jdf-sass is a fork from node-sass, jdf use only. jdf-sass downloads executable resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested file with an attacker controlled file if the attacker is on the netwo...

PT-2018-4752

Name of the Vulnerable Software and Affected Versions apk-parser3 versions prior to 0.1.3 Description The issue allows for a man-in-the-middle MITM attack due to the insecure download of binary resources over HTTP. This could potentially lead to remote code execution RCE if an attacker intercepts...

PT-2018-4761

Name of the Vulnerable Software and Affected Versions closure-utils affected versions not specified Description The issue concerns the insecure download of binary resources over HTTP, making it susceptible to man-in-the-middle MITM attacks. This could potentially lead to remote code execution RCE...

PT-2018-4806

Name of the Vulnerable Software and Affected Versions selenium-wrapper versions affected versions not specified Description The issue concerns the insecure download of binary resources over HTTP, making it susceptible to man-in-the-middle MITM attacks. This could potentially lead to remote code...

PT-2018-4770

Name of the Vulnerable Software and Affected Versions jser-stat affected versions not specified Description The issue concerns the jser-stat library, which downloads data resources over HTTP, making it susceptible to Man-In-The-Middle MITM attacks. In a scenario where an attacker has a privileged...

PT-2018-4801

Name of the Vulnerable Software and Affected Versions macaca-chromedriver-zxa affected versions not specified Description The issue allows for a man-in-the-middle MITM attack due to the download of binary resources over HTTP. This could potentially lead to remote code execution RCE if an attacker...

CVE-2016-10616: Missing Encryption of Sensitive Data

openframe-image is an Openframe extension which adds support for images via fbi. openframe-image downloads data resources over HTTP, which leaves it vulnerable to MITM attacks...

CVE-2016-10605: Missing Encryption of Sensitive Data

dalek-browser-ie is Internet Explorer bindings for DalekJS. dalek-browser-ie downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested binary with an attacker controlled binary if the...

PT-2018-4800

Name of the Vulnerable Software and Affected Versions nodeschnaps versions prior to 1.0.3 Description The issue concerns the insecure download of binary resources over HTTP, making it susceptible to man-in-the-middle MITM attacks. If an attacker is positioned on the network or between the user an...

PT-2018-4754

Name of the Vulnerable Software and Affected Versions fuseki versions prior to 1.0.1 Description The issue concerns the insecure download of binary resources over HTTP, making it susceptible to man-in-the-middle MITM attacks. If an attacker is on the network or positioned between the user and the...

PT-2018-4808

Name of the Vulnerable Software and Affected Versions install-g-test versions affected versions not specified Description The issue concerns the insecure download of resources over HTTP, making it susceptible to Man-In-The-Middle MITM attacks. In such attacks, an adversary with a privileged netwo...

PT-2018-4781

Name of the Vulnerable Software and Affected Versions air-sdk versions affected versions not specified Description The issue concerns the air-sdk, which is a NPM wrapper for the Adobe AIR SDK. It downloads binary resources over HTTP, making it susceptible to man-in-the-middle MITM attacks. This...

PT-2018-4790

Name of the Vulnerable Software and Affected Versions dalek-browser-ie-canary affected versions not specified Description The issue allows for a man-in-the-middle MITM attack due to the insecure download of binary resources over HTTP. This could potentially lead to remote code execution RCE if an...

PT-2018-4810

Name of the Vulnerable Software and Affected Versions apk-parser2 versions prior to the latest version, as no specific fixed version is mentioned and the package has not been updated since 2014. Description The issue concerns the insecure download of binary resources over HTTP, making it...