CVE-2016-10679

CVE-2016-10679 affects selenium-standalone-painful, where the tool downloads binaries over HTTP. This insecure download path enables a network-positioned attacker to MITM and swap the binary with a malicious copy, potentially achieving remote code execution on the host running selenium-standalone...

CVE-2016-10559

selenium-download downloads the latest versions of the selenium standalone server and the chromedriver. selenium-download before 2.0.7 downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the...

nightwatch-commands (>=1.8.0, <=2.0.0) potentially affected by CVE-2016-10559 via selenium-download (2.0.6)

selenium-download NPM version 2.0.6 is affected by a known vulnerability. The following packages have a transitive dependency on selenium-download and may be impacted: - nightwatch-commands =1.8.0, =2.0.0 Source cves: CVE-2016-10559 Source advisory: MEND:CVE-2016-10559...

coba (>=1.0.8, <=1.0.9), frames-selenium (>=1.0.34, <=1.1.7) +6 more potentially affected by CVE-2016-10589 via selenium-binaries (>=0.1.6, <=0.13.11)

selenium-binaries NPM version =0.1.6, =1.0.8, =1.0.34, =1.0.0, =1.0.0, =0.8.0, =0.1.0, =0.13.0, =1.0.1 Source cves: CVE-2016-10589 Source advisory: MEND:CVE-2016-10589...

CVE-2016-10601

CVE-2016-10601 affects the npm package webdrvr (Selenium Webdriver wrapper). The vulnerability arises because webdrvr downloads binary resources over HTTP, enabling an attacker on the network path to perform a MITM and replace the requested binary with a malicious one, potentially leading to remo...

CVE-2016-10589

Summary: The CVE-2016-10589 issue affects the npm package selenium-binaries, which downloads Selenium binaries over HTTP. The underlying vulnerability is a MITM risk that can lead to remote code execution if a malicious binary is swapped during transmission. The connected advisories consistently ...

CVE-2016-10559

CVE-2016-10559 affects selenium-download (prior to 2.0.7), where binaries (selenium server and chromedriver) are downloaded over HTTP. An attacker on a privileged network position can MITM the download and swap the binary, potentially leading to remote code execution when the user runs the compro...

CVE-2016-10679

selenium-standalone-painful installs a start-selenium command line to start a standalone selenium server with chrome-driver. selenium-standalone-painful downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by...

CVE-2016-10679

selenium-standalone-painful installs a start-selenium command line to start a standalone selenium server with chrome-driver. selenium-standalone-painful downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by...

CVE-2016-10559

selenium-download downloads the latest versions of the selenium standalone server and the chromedriver. selenium-download before 2.0.7 downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the...

CVE-2016-10586

macaca-chromedriver is a Node.js wrapper for the selenium chromedriver. macaca-chromedriver before 1.0.29 downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested binary with an attacker...

CVE-2016-10589: Missing Encryption of Sensitive Data

selenium-binaries downloads Selenium related binaries for your OS. selenium-binaries downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested binary with an attacker controlled binary if t...

PT-2018-4767

Name of the Vulnerable Software and Affected Versions selenium-binaries versions prior to 0.15.0 Description The issue concerns the insecure download of binary resources over HTTP, making it susceptible to man-in-the-middle MITM attacks. This could potentially lead to remote code execution RCE if...

PT-2018-4857

Name of the Vulnerable Software and Affected Versions selenium-standalone-painful affected versions not specified Description The issue allows for a man-in-the-middle MITM attack due to the download of binary resources over HTTP. This could potentially lead to remote code execution RCE if an...

CVE-2016-10679: Missing Encryption of Sensitive Data

selenium-standalone-painful installs a start-selenium command line to start a standalone selenium server with chrome-driver. selenium-standalone-painful downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by...

CVE-2016-10573: Missing Encryption of Sensitive Data

baryton-saxophone is a module to install and launch Selenium Server for Mac, Linux and Windows. baryton-saxophone versions below 3.0.1 download binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the request...

CVE-2016-10559: Missing Encryption of Sensitive Data

selenium-download downloads the latest versions of the selenium standalone server and the chromedriver. selenium-download before 2.0.7 downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the...

PT-2018-4737

Name of the Vulnerable Software and Affected Versions selenium-download versions prior to 2.0.7 Description The issue allows for a man-in-the-middle MITM attack due to the download of binary resources over HTTP. This could potentially lead to remote code execution RCE if an attacker intercepts th...

Real-Time Two-Factor Phishing Tool: ReelPhish

2FA adds an extra layer of authentication on top of the typical username and password. Two common 2FA implementations are one-time passwords and push notifications. One-time passwords are generated by a secondary device, such as a hard token, and tied to a specific user. These passwords typically...

Mercury - A Hacking Tool Used To Collect Information And Use The Information To Further Hurt The Target

Mercury is a hacking tool used to collect information and use the information to further hurt the target. Installation Requires Python2 Linux apt-get install python2 git clone https://www.github.com/MetaChar/Mercury pip install -r requirements.txt Features BruteForce Mercury uses Selenium to...