CVE-2016-10681: Missing Encryption of Sensitive Data

roslib-socketio - The standard ROS Javascript Library fork for add support to socket.io roslib-socketio downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested resources with an attacker...

CVE-2016-10590: Missing Encryption of Sensitive Data

cue-sdk-node is a Corsair Cue SDK wrapper for node.js. cue-sdk-node downloads zipped resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested zip file with an attacker controlled zip file if the attacker i...

CVE-2016-10584: Missing Encryption of Sensitive Data

dalek-browser-chrome-canary provides Google Chrome bindings for DalekJS. dalek-browser-chrome-canary downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested binary with an attacker...

CVE-2016-10567: Missing Encryption of Sensitive Data

product-monitor is a HTML/JavaScript template for monitoring a product by encouraging product developers to gather all the information about the status of a product, including live monitoring, statistics, endpoints, and test results into one place. product-monitor versions below 2.2.5 download...

CVE-2016-10698: Missing Encryption of Sensitive Data

mystem-fix is a node.js wrapper for MyStem morphology text analyzer by Yandex.ru mystem-fix downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested resources with an attacker controlled...

CVE-2016-10682: Missing Encryption of Sensitive Data

massif is a Phantomjs fork massif downloads resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested resources with an attacker controlled copy if the attacker is on the network or positioned in between th...

CVE-2016-10680: Missing Encryption of Sensitive Data

adamvr-geoip-lite is a light weight native JavaScript implementation of GeoIP API from MaxMind adamvr-geoip-lite downloads geoip resources over HTTP, which leaves it vulnerable to MITM attacks. This impacts the integrity and availability of this geoip data that may alter the decisions made by an...

CVE-2016-10650: Missing Encryption of Sensitive Data

ntfserver is a Network Testing Framework Server. ntfserver downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested binary with an attacker controlled binary if the attacker is on the...

CVE-2016-10568: Missing Encryption of Sensitive Data

geoip-lite-country is a stripped down version of geoip-lite, supporting only country lookup. geoip-lite-country before 1.1.4 downloads data resources over HTTP, which leaves it vulnerable to MITM attacks...

CVE-2016-10559: Missing Encryption of Sensitive Data

selenium-download downloads the latest versions of the selenium standalone server and the chromedriver. selenium-download before 2.0.7 downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the...

CVE-2016-10558: Missing Encryption of Sensitive Data

aerospike is an Aerospike add-on module for Node.js. aerospike versions below 2.4.2 download binary resources over HTTP, which leaves the module vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested binary with an attacker controlled binar...

PT-2018-4858

Name of the Vulnerable Software and Affected Versions adamvr-geoip-lite versions affected versions not specified Description The issue affects the integrity and availability of geoip data, which may alter the decisions made by an application using this data. This is due to the package downloading...

PT-2018-4769

Name of the Vulnerable Software and Affected Versions prince versions prior to 1.4.6 Description The issue allows for a man-in-the-middle MITM attack due to the insecure download of zipped resources over HTTP. This could potentially lead to remote code execution RCE if an attacker intercepts the...

CVE-2016-10591: Missing Encryption of Sensitive Data

Prince is a Node API for executing XML/HTML to PDF renderer PrinceXML via prince1 CLI. prince downloads zipped resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested tarball with an attacker controlled...

PT-2018-4762

Name of the Vulnerable Software and Affected Versions dalek-browser-chrome-canary affected versions not specified Description The issue allows for a man-in-the-middle MITM attack due to the insecure download of binary resources over HTTP. This could potentially lead to remote code execution RCE i...

PT-2018-4746

Name of the Vulnerable Software and Affected Versions geoip-lite-country versions prior to 1.1.4 Description The issue concerns the insecure download of data resources over HTTP, making it susceptible to man-in-the-middle MITM attacks. In scenarios where an attacker has a privileged network...

CVE-2016-10566: Missing Encryption of Sensitive Data

install-nw is a module which quickly and robustly installs and caches NW.js. install-nw versions below 1.1.5 download binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested binary with an attacker...

CVE-2016-10589: Missing Encryption of Sensitive Data

selenium-binaries downloads Selenium related binaries for your OS. selenium-binaries downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested binary with an attacker controlled binary if t...

CVE-2016-10578: Missing Encryption of Sensitive Data

unicode loads unicode data downloaded from unicode.org into nodejs. Unicode before 9.0.0 downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks...

PT-2018-4745

Name of the Vulnerable Software and Affected Versions product-monitor versions prior to 2.2.5 Description The issue allows for a man-in-the-middle MITM attack due to the insecure download of JavaScript resources over HTTP. This could potentially lead to remote code execution RCE if an attacker...