Man-in-the-Middle (MitM)

jdf-sass is vulnerable to man-in-the-middle MitM attacks via downloading resources over HTTP. It may also be possible to cause remote code execution RCE by swapping out the requested resources with an attacker controlled copy if the attacker is on the network or positioned in between the user and...

PT-2018-4848

Name of the Vulnerable Software and Affected Versions windows-seleniumjar-mirror affected versions not specified Description The issue allows for potential remote code execution RCE due to the insecure download of binary resources over HTTP, making it vulnerable to man-in-the-middle MITM attacks...

PT-2018-4874

Name of the Vulnerable Software and Affected Versions windows-latestchromedriver affected versions not specified Description The issue concerns the insecure download of binary resources over HTTP, making it susceptible to man-in-the-middle MITM attacks. This could potentially lead to remote code...

CVE-2016-10653: Missing Encryption of Sensitive Data

xd-testing is a testing library for cross-device XD web applications. xd-testing downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested binary with an attacker controlled binary if the...

CVE-2016-10631

jvminstall is a module for downloading and unpacking jvm to local system. jvminstall downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested binary with an attacker controlled binary if t...

CVE-2016-10626

mystem3 is a NodeJS wrapper for the Yandex MyStem 3. mystem3 downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested binary with an attacker controlled binary if the attacker is on the...

CVE-2016-10613

bionode-sra is a Node.js wrapper for SRA Toolkit. bionode-sra downloads data resources over HTTP, which leaves it vulnerable to MITM attacks...

CVE-2016-10608

robot-js is a module for native system automation for node.js. robot-js downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested binary with an attacker controlled binary if the attacker i...

Information disclosure

ipip is a Node.js module to query geolocation information for an IP or domain, based on database by ipip.net. ipip downloads data resources over HTTP, which leaves it vulnerable to MITM attacks...

Design/Logic Flaw

openframe-image is an Openframe extension which adds support for images via fbi. openframe-image downloads data resources over HTTP, which leaves it vulnerable to MITM attacks...

Remote code execution

curses is bindings for the native curses library, a full featured console IO library. curses downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested binary with an attacker controlled...

Remote code execution

mystem3 is a NodeJS wrapper for the Yandex MyStem 3. mystem3 downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested binary with an attacker controlled binary if the attacker is on the...

CVE-2016-10574

apk-parser3 is a module to extract Android Manifest info from an APK file. apk-parser3 versions before 0.1.3 download binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested binary with an attacker...

CVE-2016-10595

jdf-sass is a fork from node-sass, jdf use only. jdf-sass downloads executable resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested file with an attacker controlled file if the attacker is on the netwo...

CVE-2016-10608

robot-js is a module for native system automation for node.js. robot-js downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested binary with an attacker controlled binary if the attacker i...

PT-2018-4795

Name of the Vulnerable Software and Affected Versions box2d-native affected versions not specified Description The issue allows for potential remote code execution RCE due to the insecure download of binary resources over HTTP, making it susceptible to man-in-the-middle MITM attacks. If an attack...

CVE-2016-10594: Missing Encryption of Sensitive Data

ipip is a Node.js module to query geolocation information for an IP or domain, based on database by ipip.net. ipip downloads data resources over HTTP, which leaves it vulnerable to MITM attacks...

PT-2018-4783

Name of the Vulnerable Software and Affected Versions dalek-browser-ie affected versions not specified Description The issue allows for a man-in-the-middle MITM attack due to the insecure download of binary resources over HTTP. This could potentially lead to remote code execution RCE if an attack...

PT-2018-4787

Name of the Vulnerable Software and Affected Versions chromedriver126 version 1.26 Description The issue allows for a man-in-the-middle MITM attack due to the insecure download of binary resources over HTTP. This could potentially lead to remote code execution RCE if an attacker intercepts the...

CVE-2016-10634: Missing Encryption of Sensitive Data

scala-standalone-bin is a Binary wrapper for ScalaJS. scala-standalone-bin downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested binary with an attacker controlled binary if the attacke...