GHSA-5PQ8-2Q24-MJ3P Downloads Resources over HTTP in fis-parser-sass-bin

Affected versions of fis-parser-sass-bin insecurely download an executable over an unencrypted HTTP connection. In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution o...

GHSA-VCFP-PPQW-MF23 fis-sass-all downloads Resources over HTTP

Affected versions of fis-sass-all insecurely download an executable over an unencrypted HTTP connection. In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the...

fis-sass-all downloads Resources over HTTP

Affected versions of fis-sass-all insecurely download an executable over an unencrypted HTTP connection. In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the...

Critical: Red Hat Security Advisory: Red Hat FIS 2.0 on Fuse 6.3.0 R7 security and bug fix update

An update is now available for Red Hat Fuse Integration Services. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE...

fis-parser-sass-bin remote code execution vulnerability

fis-parser-sass-bin is a fis-based plugin for compiling sass using node-sass-binaries. A security vulnerability exists in fis-parser-sass-bin, which originates when a program downloads an executable file over an unencrypted HTTP connection. A remote attacker could exploit the vulnerability by...

Unspecified vulnerability in fis-sass-all

fis-sass-all is a package for implementing Sass compilation in Node.js. A security vulnerability exists in fis-sass-all, which originates when a program downloads an executable file over an unencrypted HTTP connection. A remote attacker could exploit the vulnerability by intercepting the response...

Man-in-the-Middle (MitM)

fis-sass-all is vulnerable to man-in-the-middle MitM attacks. This is because it downloads binary resources via HTTP, allowing MitM attacks. Also, it may potentially cause remote code execution RCE by swapping out the requested binary with an attacker controlled binary if the attacker is on the...

Man-in-the-Middle (MitM)

fis-parser-sass-bin is susceptible to man-in-the-middle MitM attacks. The attacker can download binary resources via HTTP, allowing MitM attacks. Since the attacker can replace the requested binary with its controlled binary if the attacker is on the network or positioned in between the user and...

CVE-2016-10686

fis-sass-all is another libsass wrapper for node. fis-sass-all downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested resources with an attacker controlled copy if the attacker is on the...

CVE-2016-10660

fis-parser-sass-bin a plugin for fis to compile sass using node-sass-binaries. fis-parser-sass-bin downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested resources with an attacker...

Remote code execution

fis-parser-sass-bin a plugin for fis to compile sass using node-sass-binaries. fis-parser-sass-bin downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested resources with an attacker...

CVE-2016-10660

CVE-2016-10660 affects the fis-parser-sass-bin plugin used to compile Sass via node-sass-binaries. The vulnerability arises because the plugin downloads binary resources over HTTP, allowing a network-positioned attacker to perform a MITM interception and replace the requested binary with a malici...

CVE-2016-10686

CVE-2016-10686 affects the node wrapper fis-sass-all for libsass, where binary resources are downloaded over HTTP. The underlying issue enables a man-in-the-middle scenario: an attacker with network position can intercept the HTTP response and replace the requested executable with a malicious cop...

PT-2018-4838

Name of the Vulnerable Software and Affected Versions fis-parser-sass-bin affected versions not specified Description The issue arises from fis-parser-sass-bin downloading binary resources over HTTP, making it susceptible to man-in-the-middle MITM attacks. This could potentially lead to remote co...

PT-2018-4864

Name of the Vulnerable Software and Affected Versions fis-sass-all affected versions not specified Description The issue concerns the insecure download of binary resources over HTTP, making it susceptible to man-in-the-middle MITM attacks. This could potentially lead to remote code execution RCE ...

CVE-2016-10660: Missing Encryption of Sensitive Data

fis-parser-sass-bin a plugin for fis to compile sass using node-sass-binaries. fis-parser-sass-bin downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested resources with an attacker...

CVE-2016-10686: Missing Encryption of Sensitive Data

fis-sass-all is another libsass wrapper for node. fis-sass-all downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested resources with an attacker controlled copy if the attacker is on the...

data.fis-ski.com XSS vulnerability

Open Bug Bounty ID: OBB-283772 Description| Value ---|--- Affected Website:| data.fis-ski.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Downloads Resources over HTTP

Overview Affected versions of fis-parser-sass-bin insecurely download an executable over an unencrypted HTTP connection. In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code...

Fis-ski mobile & live timing - External URLs, Suspicious files vulnerabilities

HackApp vulnerability scanner discovered that application Fis-ski mobile & live timing published at the 'play' market has multiple vulnerabilities...