CVE-2016-10603: Missing Encryption of Sensitive Data

air-sdk is a NPM wrapper for the Adobe AIR SDK. air-sdk downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested binary with an attacker controlled binary if the attacker is on the network...

Remote code execution

bkjs-wand is imagemagick wand support for node.js and backendjs bkjs-wand versions lower than 0.3.2 download binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested binary with an attacker controll...

selenium-download code execution vulnerability

selenium-download is a tool for downloading the latest versions of the selenium standalone server and chromedriver. A security vulnerability exists in selenium-download versions prior to 2.0.7, which arises when the program downloads binary resources over the HTTP protocol. A remote attacker can...

macaca-chromedriver code execution vulnerability

macaca-chromedriver is a package for installing selenium chromedriver. A security vulnerability exists in macaca-chromedriver versions prior to 1.0.29, which originates when the program downloads binary resources over the HTTP protocol. A remote attacker can exploit the vulnerability by replacing...

CVE-2016-10564: Missing Encryption of Sensitive Data

apk-parser is a tool to extract Android Manifest info from an APK file. apk-parser versions below 0.1.6 download binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested binary with an attacker...

CVE-2016-10562: Missing Encryption of Sensitive Data

iedriver is an NPM wrapper for Selenium IEDriver. iedriver versions below 3.0.0 download binary resources over HTTP, which leaves the module vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested binary with an attacker controlled binary if...

ibm_db Code Execution Vulnerability

ibmdb is an asynchronous/synchronous interface linking node.js and IBM DB2. A security vulnerability exists in ibmdb versions prior to 1.0.2 that originates when a program downloads binary resources over the HTTP protocol. A remote attacker could exploit the vulnerability by replacing the request...

CVE-2016-10565: Missing Encryption of Sensitive Data

operadriver is a Opera Driver for Selenium. operadriver versions below 0.2.3 download binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested binary with an attacker controlled binary if the attack...

Man In The Middle (MitM)

strider-sauce is vulnerable to man-in-the-middleMitM attack. The vulnerability exists because it allows downloading of requested executable files via HTTP if the attacker's network position is between the remote server and client. It can subsequently open up a loophole for remote code execution...

CVE-2016-10584

dalek-browser-chrome-canary provides Google Chrome bindings for DalekJS. dalek-browser-chrome-canary downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested binary with an attacker...

CVE-2016-10570

pngcrush-installer is an installer for Pngcrush. pngcrush-installer versions below 1.8.10 download binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested binary with an attacker controlled binary ...

Remote code execution

cue-sdk-node is a Corsair Cue SDK wrapper for node.js. cue-sdk-node downloads zipped resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested zip file with an attacker controlled zip file if the attacker i...

CVE-2016-10567

product-monitor is a HTML/JavaScript template for monitoring a product by encouraging product developers to gather all the information about the status of a product, including live monitoring, statistics, endpoints, and test results into one place. product-monitor versions below 2.2.5 download...

CVE-2016-10611

CVE-2016-10611 affects the strider-sauce package (Sauce Labs / Selenium support for Strider). The issue stems from downloading zipped resources over HTTP, enabling MITM manipulation; an attacker on the network could swap the requested zip with a malicious one to trigger remote code execution. Pub...

CVE-2016-10591

CVE-2016-10591 affects Prince (Node API for executing PrinceXML via the prince(1) CLI). The vulnerability arises because Prince downloads zipped resources over HTTP, making it susceptible to Man-in-the-Middle attacks that could swap the requested tarball/executable with a malicious one. In networ...

CVE-2016-10601: Missing Encryption of Sensitive Data

webdrvr is a npm wrapper for Selenium Webdriver including Chromedriver / IEDriver / IOSDriver / Ghostdriver. webdrvr downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested binary with an...

CVE-2016-10570: Missing Encryption of Sensitive Data

pngcrush-installer is an installer for Pngcrush. pngcrush-installer versions below 1.8.10 download binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested binary with an attacker controlled binary ...

PT-2018-4767

Name of the Vulnerable Software and Affected Versions selenium-binaries versions prior to 0.15.0 Description The issue concerns the insecure download of binary resources over HTTP, making it susceptible to man-in-the-middle MITM attacks. This could potentially lead to remote code execution RCE if...

CVE-2017-16003: Missing Encryption of Sensitive Data

windows-build-tools is a module for installing C++ Build Tools for Windows using npm. windows-build-tools versions below 1.0.0 download resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested resources wi...

CVE-2016-10567: Missing Encryption of Sensitive Data

product-monitor is a HTML/JavaScript template for monitoring a product by encouraging product developers to gather all the information about the status of a product, including live monitoring, statistics, endpoints, and test results into one place. product-monitor versions below 2.2.5 download...