Downloads Resources over HTTP in nw

Affected versions of nw insecurely download an executable over an unencrypted HTTP connection. In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system...

Code injection

Security keys used by the terminal and NW for a session could be leaked in snapdragon mobile in versions MDM9650, MDM9655, SD 835, SDA660...

CVE-2017-18321

Security keys used by the terminal and NW for a session could be leaked in snapdragon mobile in versions MDM9650, MDM9655, SD 835, SDA660...

PT-2019-8274

Name of the Vulnerable Software and Affected Versions Snapdragon Mobile versions MDM9650, MDM9655, SD 835, SDA660 Description A security issue affects the terminal and NW for a session, potentially leading to the leakage of security keys in Snapdragon Mobile. Recommendations For versions MDM9650,...

PT-2018-14060

Name of the Vulnerable Software and Affected Versions ViaBTC Exchange Server versions prior to 2018-08-21 Description The issue is related to an integer overflow in the network/nw buf.c file, which can lead to memory corruption. Recommendations For versions prior to 2018-08-21, update to a versio...

Man-in-the-Middle (MitM)

nw-with-arm is vulnerable to man-in-the-middle MitM attack. This is possible because it does not prevent downloading of executables via HTTP if the attacker is on the network or positioned in between the user and the remote server. Consequently, it may potentially cause remote code execution RCE ...

CVE-2016-10629

nw-with-arm is a NW Installer including ARM-Build. nw-with-arm downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested binary with an attacker controlled binary if the attacker is on the...

CVE-2016-10588

nw is an installer for nw.js. nw downloads zipped resources over HTTP, It may be possible to cause remote code execution RCE by swapping out the requested zip file with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server...

Remote code execution

nw-with-arm is a NW Installer including ARM-Build. nw-with-arm downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested binary with an attacker controlled binary if the attacker is on the...

CVE-2016-10588

nw is an installer for nw.js. nw downloads zipped resources over HTTP, It may be possible to cause remote code execution RCE by swapping out the requested zip file with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server...

CVE-2016-10629

nw-with-arm is a NW Installer including ARM-Build. nw-with-arm downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested binary with an attacker controlled binary if the attacker is on the...

CVE-2016-10629

The CVE-2016-10629 entry corresponds to nw-with-arm (NW Installer including ARM-Build), which insecurely downloads resources over HTTP. The root cause is unencrypted HTTP retrieval of executables, enabling an attacker with a privileged network position to intercept and replace the binary, potenti...

CVE-2016-10629

nw-with-arm is a NW Installer including ARM-Build. nw-with-arm downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested binary with an attacker controlled binary if the attacker is on the...

CVE-2016-10629: Missing Encryption of Sensitive Data

nw-with-arm is a NW Installer including ARM-Build. nw-with-arm downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested binary with an attacker controlled binary if the attacker is on the...

PT-2018-4766

Name of the Vulnerable Software and Affected Versions nw versions prior to 0.23.6-1 Description The issue allows for potential remote code execution RCE by swapping out the requested zip file with an attacker-controlled binary if the attacker is on the network or positioned in between the user an...

PT-2018-4807

Name of the Vulnerable Software and Affected Versions nw-with-arm affected versions not specified Description The issue concerns the insecure download of binary resources over HTTP, making it susceptible to man-in-the-middle MITM attacks. This could potentially lead to remote code execution RCE i...

CVE-2016-10588: Missing Encryption of Sensitive Data

nw is an installer for nw.js. nw downloads zipped resources over HTTP, It may be possible to cause remote code execution RCE by swapping out the requested zip file with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server...

install-nw code execution vulnerability (CNVD-2018-10902)

install-nw is a tool for installing and caching NW.j modules. A security vulnerability exists in versions prior to install-nw 1.1.5, which originates when a program downloads JavaScript resources over the HTTP protocol. A remote attacker can exploit the vulnerability by replacing the requested...

install-nw code execution vulnerability

install-nw is a tool for installing and caching NW.j modules. A security vulnerability exists in versions prior to install-nw 1.1.5, which originates when the program downloads binary resources over the HTTP protocol. A remote attacker can exploit the vulnerability by replacing the requested bina...

CVE-2016-10566

install-nw is a module which quickly and robustly installs and caches NW.js. install-nw versions below 1.1.5 download binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested binary with an attacker...