CVE-2016-10566

install-nw is a module which quickly and robustly installs and caches NW.js. install-nw versions below 1.1.5 download binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested binary with an attacker...

Remote code execution

install-nw is a module which quickly and robustly installs and caches NW.js. install-nw versions below 1.1.5 download binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested binary with an attacker...

CVE-2016-10566

The CVE-2016-10566 entry concerns install-nw, a tool for installing NW.js. Versions before 1.1.5 download binary resources over HTTP, enabling MITM interference. An attacker on the network could swap the requested binary with a malicious one, potentially causing remote code execution on the user’...

nw-spb.ru XSS vulnerability

Open Bug Bounty ID: OBB-561506 Description| Value ---|--- Affected Website:| nw-spb.ru Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Man In The Middle (MitM)

install-nw is vulnerable to man-in-the-middle MitM attacks. This is because the library downloads binary resources via HTTP, allowing MitM attacks. It may also cause remote code execution RCE by swapping out the requested binary with an attacker controlled binary if the attacker is on the network...

Downloads Resources over HTTP

Overview Affected versions of install-nw insecurely download an executable over an unencrypted HTTP connection. In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution o...

Downloads Resources over HTTP

Overview Affected versions of nw insecurely download an executable over an unencrypted HTTP connection. In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the...

NW ePaper für Bielefeld & OWL - Customized SSL, Redefined SSL Common Names verifier, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application NW ePaper für Bielefeld & OWL published at the 'play' market has multiple vulnerabilities...

CVE-2014-6776

The CVE-2014-6776 entry covers the Android app United Advantage NW Federal Cr (com.myappengine.uanwfcu) version 1.7, where the client fails to verify X.509 certificates from SSL servers. This root cause enables man-in-the-middle attackers to spoof servers and obtain sensitive information via craf...