CVE-2016-10689

CVE-2016-10689 affects the windows-iedriver module, which downloads the iedriverserver.exe binary over HTTP. This enables a man-in-the-middle attacker on the network path to intercept the response and swap the binary, potentially leading to remote code execution on the host running the driver. Th...

CVE-2016-10692

haxeshim haxe shim to deal with coexisting versions. haxeshim downloads resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested resources with an attacker controlled copy if the attacker is on the network...

CVE-2016-10639

CVE-2016-10639 affects the npm wrapper redis-srvr , which downloads binary resources over HTTP. The underlying issue is unencrypted HTTP downloads that allow a network-positioned attacker to intercept and swap the requested binary, potentially enabling remote code execution on the host running re...

CVE-2016-10654

SFML downloads resources over HTTP, enabling MITM-style manipulation or disclosure of downloaded resources when an attacker has network visibility. Several connected sources (GitHub advisory GHSA-5Q5W-MF87-57X4, OSV, CNVD, Veracode) describe that the impact ranges from information leakage to remo...

CVE-2016-10649

The CVE-2016-10649 entry concerns the frames-compiler project, where binary resources are downloaded over HTTP. The associated disclosures describe that an attacker with privileged network position can intercept the HTTP response and swap the requested binary with a malicious one, potentially lea...

CVE-2016-10672

cloudpub-redis is a module for CloudPub: Redis Backend cloudpub-redis downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested resources with an attacker controlled copy if the attacker is...

CVE-2016-10637

haxe-dev is a cross-platform toolkit. haxe-dev downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or...

CVE-2016-10637

CVE-2016-10637 affects haxe-dev, a cross-platform toolkit. The vulnerability arises when haxe-dev downloads binary resources over HTTP, allowing a network-adjacent attacker to perform a MITM and swap the requested binary with an attacker-controlled one, potentially leading to remote code executio...

CVE-2016-10657

co-cli-installer downloads the co-cli module as part of the install process, but does so over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested resources with an attacker controlled copy if the attacker is on the...

CVE-2016-10693

pm2-kafka is a PM2 module that installs and runs a kafka server pm2-kafka downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested resources with an attacker controlled copy if the attacke...

CVE-2016-10657

CVE-2016-10657 concerns the co-cli-installer, which downloads the co-cli module over HTTP. The underlying issue is unencrypted HTTP delivery of a binary/executable, enabling a man-in-the-middle attack where an attacker on the network could swap the downloaded resource, potentially leading to remo...

CVE-2016-10656

The provided documents confirm that qbs vulnerably downloads binary resources over HTTP, enabling a potential MITM attacker on the network to swap the requested binary with a malicious one and possibly execute code on the host. The risk is described as remote code execution under network-position...

CVE-2016-10652

CVE-2016-10652 affects the NodeJS module prebuild-lwip , which insecurely downloads resources over HTTP. The underlying issue permits a network-position attacker to perform a MITM attack by modifying or reading downloaded resources, with potential consequences ranging from information disclosure ...

CVE-2016-10640

node-thulac, a Node binding for thulac, downloads binary resources over HTTP, making it vulnerable to MITM attacks. The available sources (NVD/NPM advisory/GHSA/OSV) describe potential remote code execution if an attacker on the network swaps the requested binary with a malicious one. Affected ve...

CVE-2016-10663

wixtoolset is a Node module wrapper around the wixtoolset binaries wixtoolset downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested resources with an attacker controlled copy if the...

CVE-2016-10694

The CVE-2016-10694 entry concerns the alto-saxophone module used to install and launch Chromedriver on Mac, Linux, or Windows. Versions below 2.25.1 download binary resources over HTTP, allowing MITM manipulation of the binary and potentially enabling remote code execution if an attacker on the n...

CVE-2016-10685

pk-app-wonderbox is an integration with wonderbox pk-app-wonderbox downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested resources with an attacker controlled copy if the attacker is on...

CVE-2016-10651

CVE-2016-10651 affects the Node.js Selenium Webdriver Launcher, webdriver-launcher, which downloads binary resources over HTTP. This enables MITM attacks where an attacker on the network can swap the binary, potentially leading to remote code execution on the user’s system. Public references cons...

CVE-2016-10641

node-bsdiff-android downloads resources over HTTP, which leaves it vulnerable to MITM attacks...

CVE-2016-10643

CVE-2016-10643 affects jstestdriver, a wrapper for Google's jstestdriver. The vulnerability arises because it downloads binary resources over HTTP, enabling a MitM attacker on the network to swap the binary with a malicious one and potentially achieve remote code execution. Affected versions are ...