CVE-2016-10598

CVE-2016-10598 affects the Node.js module arrayfire-js . The vulnerability arises because it downloads binary resources over HTTP, enabling MitM interception. If an attacker on the network can swap the requested binary with a malicious one, remote code execution (RCE) may be possible on the host ...

CVE-2016-10618

node-browser is a wrapper webdriver by nodejs. node-browser downloads resources over HTTP, which leaves it vulnerable to MITM attacks...

CVE-2016-10619

CVE-2016-10619 concerns pennyworth, a natural language templating engine that downloads data resources over HTTP, making it vulnerable to MITM attacks. The connected advisories confirm that insecure HTTP resource loading can allow an attacker with a privileged network position to modify/read reso...

CVE-2016-10621

fibjs is a runtime for javascript applictions built on google v8 JS. fibjs downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested binary with an attacker controlled binary if the attacke...

CVE-2016-10610

unicode-json before 2.0.0 downloads data resources over HTTP, enabling potential MitM manipulation/read of resources and, in some advisories, remote code execution risks. The affected component is the unicode-json package (pre-2.0.0) and the remediation advised across sources is to upgrade to ver...

CVE-2016-10608

robot-js is a module for native system automation for node.js. robot-js downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested binary with an attacker controlled binary if the attacker i...

CVE-2016-10614

The CVE-2016-10614 entry concerns httpsync, a Node.js port of libcurl. The vulnerability arises because httpsync downloads binary resources over HTTP, enabling MITM attackers to swap the downloaded binary with a malicious one and potentially trigger remote code execution if the attacker is on the...

CVE-2016-10612

dalek-browser-ie-canary downloads binary resources over HTTP, enabling MitM and potential remote code execution if an attacker on the network intercepts and replaces the binary. Affected: dalek-browser-ie-canary (Internet Explorer bindings for DalekJS). Root cause: unencrypted HTTP delivery of ex...

CVE-2016-10597

The CVE-2016-10597 issue affects cobalt-cli, where resources are downloaded over HTTP. This insecure practice enables MITM manipulation of downloaded executables, potentially leading to remote code execution if an attacker on the network intercepts the response. Public advisories and aggregations...

CVE-2016-10632

apk-parser2 is a module which extracts Android Manifest info from an APK file. apk-parser2 downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested binary with an attacker controlled binar...

CVE-2016-10633

CVE-2016-10633 affects dwebp-bin, a Node.js wrapper for dwebp that converts WebP to PNG. The vulnerability arises because it downloads binary resources over HTTP, enabling MITM tampering. An attacker on the network could swap the requested binary with a malicious one, potentially triggering remot...

CVE-2016-10625

CVE-2016-10625 affects headless-browser-lite, a minimal npm installer for phantomjs/slimerjs. The vulnerability arises from downloading binary resources over HTTP, enabling an attacker on the network to perform a MITM swap of the requested binary, potentially leading to remote code execution on t...

CVE-2016-10624

Summary: The CVE concerns selenium-chromedriver, which downloads the Selenium WebDriver for Google Chrome over HTTP, making it vulnerable to MITM manipulation. In such a scenario, an attacker on the network could replace the binary with a malicious one, potentially enabling remote code execution ...

CVE-2016-10630

CVE-2016-10630 affects the install-g-test package, where resources are downloaded over HTTP, enabling man-in-the-middle interception. The available connected documents consistently describe MITM risk and, in several advisories, note that no patch is currently available; mitigation is to avoid the...

CVE-2016-10623

CVE-2016-10623 affects the Node.js wrapper macaca-chromedriver-zxa. The component downloads binary resources over HTTP, creating a MITM risk where an attacker on the network could replace the binary and cause remote code execution. Mitigation from advisories: force HTTPS by setting CHROMEDRIVER_C...

CVE-2016-10629

nw-with-arm is a NW Installer including ARM-Build. nw-with-arm downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested binary with an attacker controlled binary if the attacker is on the...

CVE-2016-10579

Chromedriver (the NPM wrapper for selenium ChromeDriver) before version 2.26.1 downloads binary resources over HTTP, enabling MitM modification or interception of the downloaded binary. This can potentially lead to remote code execution if an attacker on the network swaps the binary with a malici...

CVE-2016-10576

The CVE-2016-10576 entry affects the Fuseki server wrapper and management API in Fuseki prior to 1.0.1. The issue arises because it downloads binary resources over HTTP, making it susceptible to MITM attacks. An attacker on the network or positioned between the user and the remote server could sw...

CVE-2016-10582

Closurecompiler (Node.js) is affected by a vulnerability where it downloads binary resources over HTTP, enabling MITM interference and potentially remote code execution if an attacker can replace the binary in transit. On the connected advisories, the issue is described for closurecompiler with t...

CVE-2016-10581

CVE-2016-10581 concerns the Steroids library (PhoneGap on Steroids), which downloads zipped resources over HTTP. The description states this makes it vulnerable to MITM attacks and, if an attacker can position themselves between the user and the server, may allow remote code execution by swapping...