CVE-2016-10618

node-browser is vulnerable to MITM because it downloads resources over HTTP, allowing an attacker on a privileged network to modify or read resources and potentially achieve remote code execution. The advisories note no patch is available and recommend avoiding the package or limiting use on publ...

CVE-2016-10616

The CVE-2016-10616 entry concerns openframe-image, an Openframe extension for images that downloads resources over HTTP. The root cause is insecure HTTP downloads, which enables MITM-style manipulation or interception of resources by an attacker with network access. Documented impacts range from ...

CVE-2016-10606

grunt-webdriver-qunit is a grunt plugin to run qunit with webdriver in grunt grunt-webdriver-qunit downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested binary with an attacker controll...

CVE-2016-10610

unicode-json is a unicode lookup table. unicode-json before 2.0.0 downloads data resources over HTTP, which leaves it vulnerable to MITM attacks...

CVE-2016-10615

curses is bindings for the native curses library, a full featured console IO library. curses downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested binary with an attacker controlled...

CVE-2016-10576

The CVE-2016-10576 entry affects the Fuseki server wrapper and management API in Fuseki prior to 1.0.1. The issue arises because it downloads binary resources over HTTP, making it susceptible to MITM attacks. An attacker on the network or positioned between the user and the remote server could sw...

CVE-2016-10579

Chromedriver (the NPM wrapper for selenium ChromeDriver) before version 2.26.1 downloads binary resources over HTTP, enabling MitM modification or interception of the downloaded binary. This can potentially lead to remote code execution if an attacker on the network swaps the binary with a malici...

CVE-2016-10600

The CVE-2016-10600 entry concerns the webrtc-native component, which uses WebRTC from the Chromium project. The vulnerability arises because webrtc-native downloads binary resources over HTTP, enabling a man‑in‑the‑middle attacker to intercept or replace the binary and potentially achieve remote ...

CVE-2016-10598

arrayfire-js is a module for ArrayFire for the Node.js platform. arrayfire-js downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested binary with an attacker controlled binary if the...

CVE-2016-10596

imageoptim is a Node.js wrapper for some images compression algorithms. imageoptim downloads zipped resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested tarball with an attacker controlled tarball if t...

CVE-2016-10603

air-sdk is a NPM wrapper for the Adobe AIR SDK. air-sdk downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested binary with an attacker controlled binary if the attacker is on the network...

CVE-2016-10575

CVE-2016-10575 affects the kindlegen Node.js wrapper. Versions before 1.1.0 download binary resources over HTTP, which makes them vulnerable to man‑in‑the‑middle attacks. An attacker on the network or between the user and the remote server could swap the requested binary with a malicious one, pot...

CVE-2016-10629

nw-with-arm is a NW Installer including ARM-Build. nw-with-arm downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested binary with an attacker controlled binary if the attacker is on the...

CVE-2016-10630

CVE-2016-10630 affects the install-g-test package, where resources are downloaded over HTTP, enabling man-in-the-middle interception. The available connected documents consistently describe MITM risk and, in several advisories, note that no patch is currently available; mitigation is to avoid the...

CVE-2016-10632

apk-parser2 is a module which extracts Android Manifest info from an APK file. apk-parser2 downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested binary with an attacker controlled binar...

CVE-2016-10633

CVE-2016-10633 affects dwebp-bin, a Node.js wrapper for dwebp that converts WebP to PNG. The vulnerability arises because it downloads binary resources over HTTP, enabling MITM tampering. An attacker on the network could swap the requested binary with a malicious one, potentially triggering remot...

CVE-2016-10621

CVE-2016-10621 affects fibjs, a JavaScript runtime built on Google V8. The vulnerability arises when fibjs downloads binary resources over HTTP, enabling potential MitM interference. If an attacker positioned on the network intercepts the unencrypted response, they could swap the requested binary...

CVE-2016-10623

CVE-2016-10623 affects the Node.js wrapper macaca-chromedriver-zxa. The component downloads binary resources over HTTP, creating a MITM risk where an attacker on the network could replace the binary and cause remote code execution. Mitigation from advisories: force HTTPS by setting CHROMEDRIVER_C...

CVE-2016-10624

Summary: The CVE concerns selenium-chromedriver, which downloads the Selenium WebDriver for Google Chrome over HTTP, making it vulnerable to MITM manipulation. In such a scenario, an attacker on the network could replace the binary with a malicious one, potentially enabling remote code execution ...

CVE-2016-10574

apk-parser3 before 0.1.3 downloads binary resources over HTTP, enabling MITM tampering and potential remote code execution if an attacker can swap the binary between the user and the server. Affected component: apk-parser3 (Android Manifest extraction feature). Impact per sources: code execution ...