grunt-air-sdk (>=0.1.0, <=0.1.1) potentially affected by CVE-2016-10603 via air-sdk (16.0.0-272-9)

air-sdk NPM version 16.0.0-272-9 is affected by a known vulnerability. The following packages have a transitive dependency on air-sdk and may be impacted: - grunt-air-sdk =0.1.0, =0.1.1 Source cves: CVE-2016-10603 Source advisory: OSV:GHSA-6JX3-RQCX-G3WW...

CVE-2016-10603

air-sdk is a NPM wrapper for the Adobe AIR SDK. air-sdk downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested binary with an attacker controlled binary if the attacker is on the network...

CVE-2016-10603

CVE-2016-10603 affects the npm package air-sdk (a wrapper for the Adobe AIR SDK). The vulnerability arises because air-sdk downloads binary resources over HTTP rather than HTTPS, enabling a man-in-the-middle (MITM) position to intercept the response and swap the requested binary with a malicious ...

CVE-2016-10603

air-sdk is a NPM wrapper for the Adobe AIR SDK. air-sdk downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested binary with an attacker controlled binary if the attacker is on the network...