@dequelabs/amaze-tdd (>=0.2.9, <=0.3.2), @holisticon/angularjs-common (>=0.2.0-23, <=0.5.3) +15 more potentially affected by CVE-2016-10579 via chromedriver (>=2.10.0, <=2.25.1)

chromedriver NPM version =2.10.0, =0.2.9, =0.2.0-23, =0.2.6, =0.0.5, =0.0.10, =1.3.2, =0.0.1, =0.1.0, =1.0.0, =1.3.9, =0.0.1, =1.4.23, =4.0.0 - testarmada-performance-reporter 1.1.1 and more Source cves: CVE-2016-10579 Source advisory: OSV:GHSA-JH5W-6964-X5CF...

chromedriver Downloads Resources over HTTP

Affected versions of chromedriver insecurely download resources over HTTP. In scenarios where an attacker has a privileged network position, they can modify or read such resources at will. This may result in arbitrary code execution if an attacker intercepts and modifies the downloaded binary fil...

GHSA-JH5W-6964-X5CF chromedriver Downloads Resources over HTTP

Affected versions of chromedriver insecurely download resources over HTTP. In scenarios where an attacker has a privileged network position, they can modify or read such resources at will. This may result in arbitrary code execution if an attacker intercepts and modifies the downloaded binary fil...

GHSA-3C87-R9F7-QFGQ Downloads Resources over HTTP in macaca-chromedriver-zxa

Affected versions of macaca-chromedriver-zxa insecurely download an executable over an unencrypted HTTP connection. In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code executi...

Downloads Resources over HTTP in macaca-chromedriver-zxa

Affected versions of macaca-chromedriver-zxa insecurely download an executable over an unencrypted HTTP connection. In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code executi...

GHSA-769C-QPHH-G3WM Downloads Resources over HTTP in macaca-chromedriver

Affected versions of macaca-chromedriver insecurely download an executable over an unencrypted HTTP connection. In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution o...

macaca-android-dingtalk (1.0.30) potentially affected by CVE-2016-10586 via macaca-chromedriver (1.0.15)

macaca-chromedriver NPM version 1.0.15 is affected by a known vulnerability. The following packages have a transitive dependency on macaca-chromedriver and may be impacted: - macaca-android-dingtalk 1.0.30 Source cves: CVE-2016-10586 Source advisory: OSV:GHSA-769C-QPHH-G3WM...

Downloads Resources over HTTP in macaca-chromedriver

Affected versions of macaca-chromedriver insecurely download an executable over an unencrypted HTTP connection. In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution o...

GHSA-7P6H-3FMW-539Q selenium-chromedriver Downloads Resources over HTTP

Affected versions of selenium-chromedriver insecurely download an executable over an unencrypted HTTP connection. In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution...

selenium-chromedriver Downloads Resources over HTTP

Affected versions of selenium-chromedriver insecurely download an executable over an unencrypted HTTP connection. In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution...

GHSA-HC94-2WFR-4PWF appium-chromedriver downloads Resources over HTTP

Affected versions of appium-chromedriver insecurely download resources over HTTP. In scenarios where an attacker has a privileged network position, they can modify or read items send over HTTP at will. In this case, that includes the chromedriver binary, which may result in remote code execution ...

appium-chromedriver downloads Resources over HTTP

Affected versions of appium-chromedriver insecurely download resources over HTTP. In scenarios where an attacker has a privileged network position, they can modify or read items send over HTTP at will. In this case, that includes the chromedriver binary, which may result in remote code execution ...

windows-selenium-chromedriver remote code execution vulnerability

windows-selenium-chromedriver is a package for downloading and installing the chromedriver server. A security vulnerability exists in windows-selenium-chromedriver, which originates when the program downloads an executable file over an unencrypted HTTP connection. A remote attacker could exploit...

windows-latestchromedriver code execution vulnerability

windows-latestchromedriver is a module for downloading and installing the latest version of Chormedriver. A security vulnerability exists in windows-latestchromedriver that originates when the program downloads a binary file over an unencrypted HTTP connection. A remote attacker can exploit the...

CVE-2016-10624

selenium-chromedriver is a simple utility for downloading the Selenium Webdriver for Google Chrome selenium-chromedriver downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested binary wit...

Man-in-the-Middle (MitM)

windows-selenium-chromedriver is susceptible to man-in-the-middle MitM attacks. The attacker can download binary resources via HTTP, allowing MitM attacks. Since the attacker can replace the requested binary with its controlled binary if the attacker is on the network or positioned in between the...

Remote code execution

windows-latestchromedriver downloads the latest version of chromedriver.exe. windows-latestchromedriver downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested resources with an attacker...

CVE-2016-10696

windows-latestchromedriver downloads the latest version of chromedriver.exe. windows-latestchromedriver downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested resources with an attacker...

CVE-2016-10696

windows-latestchromedriver downloads the latest version of chromedriver.exe. windows-latestchromedriver downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested resources with an attacker...

CVE-2016-10696

windows-latestchromedriver downloads the latest version of chromedriver.exe. windows-latestchromedriver downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested resources with an attacker...