GHSA-MPWW-J7XJ-CJ35 Downloads Resources over HTTP in native-opencv

Affected versions of native-opencv insecurely download an executable over an unencrypted HTTP connection. In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the...

native-opencv file download vulnerability

native-opencv is an open source computer vision library with multi-platform support. A security vulnerability exists in native-opencv that originates when a program downloads an executable file over an unencrypted HTTP connection. A remote attacker can exploit the vulnerability by intercepting th...

CVE-2016-10658

The CVE-2016-10658 entry concerns the native-opencv npm package, which downloads binary resources over HTTP. This insecure download path allows a network-positioned attacker to MITM and replace the requested binary with a malicious version, potentially leading to remote code execution on the host...