deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2016-10660
Published: 2018-06-04
Description: fis-parser-sass-bin a plugin for fis to compile sass using node-sass-binaries. fis-parser-sass-bin downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attacker controlled copy if the attacker is on the network or positioned in between the user and the remote server.
CVSS Score: 8.1 (HIGH)
CWE: CWE-311, CWE-310
References: https://nodesecurity.io/advisories/269; https://nodesecurity.io/advisories/269
CVE: CVE-2016-10661
Published: 2018-06-04
Description: phantomjs-cheniu is a Headless WebKit with JS API phantomjs-cheniu downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attacker controlled copy if the attacker is on the network or positioned in between the user and the remote server.
CVSS Score: 8.1 (HIGH)
CWE: CWE-311, CWE-310
References: https://nodesecurity.io/advisories/262; https://nodesecurity.io/advisories/262
CVE: CVE-2016-10662
Published: 2018-06-04
Description: tomita is a node wrapper for Yandex Tomita Parser tomita downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attacker controlled copy if the attacker is on the network or positioned in between the user and the remote server.
CVSS Score: 8.1 (HIGH)
CWE: CWE-311, CWE-310
References: https://nodesecurity.io/advisories/267; https://nodesecurity.io/advisories/267
CVE: CVE-2016-10663
Published: 2018-06-04
Description: wixtoolset is a Node module wrapper around the wixtoolset binaries wixtoolset downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attacker controlled copy if the attacker is on the network or positioned in between the user and the remote server.
CVSS Score: 8.1 (HIGH)
CWE: CWE-311, CWE-311
References: https://github.com/wixtoolset/issues/issues/6187; https://nodesecurity.io/advisories/264; https://github.com/wixtoolset/issues/issues/6187
CVE: CVE-2016-10664
Published: 2018-06-04
Description: mystem is a Node.js wrapper for MyStem morphology text analyzer by Yandex.ru mystem downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.
CVSS Score: 8.1 (HIGH)
CWE: CWE-311, CWE-310
References: https://nodesecurity.io/advisories/259; https://nodesecurity.io/advisories/259
CVE: CVE-2016-10665
Published: 2018-06-04
Description: herbivore is a packet sniffing and crafting library. Built on libtins herbivore 0.0.3 and below download binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attacker controlled copy if the attacker is on the network or positioned in between the user and the remote server.
CVSS Score: 8.1 (HIGH)
CWE: CWE-311, CWE-310
References: https://github.com/samatt/Herbivore/commit/0a041defc3463e99948e5d2064aef54b2128c5a3; https://nodesecurity.io/advisories/258; https://github.com/samatt/Herbivore/commit/0a041defc3463e99948e5d2064aef54b2128c5a3
CVE: CVE-2016-10667
Published: 2018-06-04
Description: selenium-portal is a Selenium Testing Framework selenium-portal downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attacker controlled copy if the attacker is on the network or positioned in between the user and the remote server.
CVSS Score: 8.1 (HIGH)
CWE: CWE-311, CWE-310
References: https://nodesecurity.io/advisories/260; https://nodesecurity.io/advisories/260
CVE: CVE-2016-10668
Published: 2018-06-04
Description: libsbml is a module that installs Linux binaries for libSBML libsbml downloads resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attacker controlled copy if the attacker is on the network or positioned in between the user and the remote server.
CVSS Score: 8.1 (HIGH)
CWE: CWE-311, CWE-310
References: https://nodesecurity.io/advisories/272; https://nodesecurity.io/advisories/272
CVE: CVE-2016-10669
Published: 2018-06-04
Description: soci downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attacker controlled copy if the attacker is on the network or positioned in between the user and the remote server.
CVSS Score: 8.1 (HIGH)
CWE: CWE-311, CWE-310
References: https://nodesecurity.io/advisories/270; https://nodesecurity.io/advisories/270
CVE: CVE-2016-10670
Published: 2018-06-04
Description: windows-seleniumjar-mirror downloads the Selenium Jar file windows-seleniumjar-mirror downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attacker controlled copy if the attacker is on the network or positioned in between the user and the remote server.
CVSS Score: 8.1 (HIGH)
CWE: CWE-311, CWE-310
References: https://nodesecurity.io/advisories/281; https://nodesecurity.io/advisories/281
CVE: CVE-2016-10671
Published: 2018-06-04
Description: mystem-wrapper is a Yandex mystem app wrapper module. mystem-wrapper downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attacker controlled copy if the attacker is on the network or positioned in between the user and the remote server.
CVSS Score: 8.1 (HIGH)
CWE: CWE-311, CWE-310
References: https://nodesecurity.io/advisories/280; https://nodesecurity.io/advisories/280
CVE: CVE-2016-10672
Published: 2018-06-04
Description: cloudpub-redis is a module for CloudPub: Redis Backend cloudpub-redis downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attacker controlled copy if the attacker is on the network or positioned in between the user and the remote server.
CVSS Score: 8.1 (HIGH)
CWE: CWE-311, CWE-310
References: https://nodesecurity.io/advisories/282; https://nodesecurity.io/advisories/282
CVE: CVE-2016-10673
Published: 2018-06-04
Description: ipip-coffee queries geolocation information from IP ipip-coffee downloads geolocation resources over HTTP, which leaves it vulnerable to MITM attacks. This could impact the integrity and availability of the data being used to make geolocation decisions by an application.
CVSS Score: 8.1 (HIGH)
CWE: CWE-311, CWE-310
References: https://nodesecurity.io/advisories/279; https://nodesecurity.io/advisories/279
CVE: CVE-2016-10675
Published: 2018-06-04
Description: libsbmlsim is a module that installs linux binaries for libsbmlsim libsbmlsim downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attacker controlled copy if the attacker is on the network or positioned in between the user and the remote server.
CVSS Score: 8.1 (HIGH)
CWE: CWE-311, CWE-310
References: https://nodesecurity.io/advisories/275; https://nodesecurity.io/advisories/275
CVE: CVE-2016-10676
Published: 2018-06-04
Description: rs-brightcove is a wrapper around brightcove's web api rs-brightcove downloads source file resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attacker controlled copy if the attacker is on the network or positioned in between the user and the remote server.
CVSS Score: 8.1 (HIGH)
CWE: CWE-311, CWE-310
References: https://nodesecurity.io/advisories/273; https://nodesecurity.io/advisories/273
CVE: CVE-2016-10677
Published: 2018-06-04
Description: google-closure-tools-latest is a Node.js module wrapper for downloading the latest version of the Google Closure tools google-closure-tools-latest downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attacker controlled copy if the attacker is on the network or positioned in between the user and the remote server.
CVSS Score: 8.1 (HIGH)
CWE: CWE-311, CWE-310
References: https://nodesecurity.io/advisories/274; https://nodesecurity.io/advisories/274
CVE: CVE-2016-10678
Published: 2018-06-04
Description: serc.js is a Selenium RC process wrapper serc.js downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attacker controlled copy if the attacker is on the network or positioned in between the user and the remote server.
CVSS Score: 8.1 (HIGH)
CWE: CWE-311, CWE-310
References: https://nodesecurity.io/advisories/277; https://nodesecurity.io/advisories/277
CVE: CVE-2016-10683
Published: 2018-06-04
Description: arcanist downloads resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attacker controlled copy if the attacker is on the network or positioned in between the user and the remote server.
CVSS Score: 8.1 (HIGH)
CWE: CWE-311, CWE-310
References: https://nodesecurity.io/advisories/286; https://nodesecurity.io/advisories/286
CVE: CVE-2016-10684
Published: 2018-06-04
Description: healthcenter - IBM Monitoring and Diagnostic Tools health Center agent healthcenter downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attacker controlled copy if the attacker is on the network or positioned in between the user and the remote server.
CVSS Score: 8.1 (HIGH)
CWE: CWE-311, CWE-310
References: https://nodesecurity.io/advisories/288; https://nodesecurity.io/advisories/288
CVE: CVE-2016-10685
Published: 2018-06-04
Description: pk-app-wonderbox is an integration with wonderbox pk-app-wonderbox downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attacker controlled copy if the attacker is on the network or positioned in between the user and the remote server.
CVSS Score: 8.1 (HIGH)
CWE: CWE-311, CWE-310
References: https://nodesecurity.io/advisories/289; https://nodesecurity.io/advisories/289
CVE: CVE-2016-10686
Published: 2018-06-04
Description: fis-sass-all is another libsass wrapper for node. fis-sass-all downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attacker controlled copy if the attacker is on the network or positioned in between the user and the remote server.
CVSS Score: 8.1 (HIGH)
CWE: CWE-311, CWE-310
References: https://nodesecurity.io/advisories/287; https://nodesecurity.io/advisories/287
CVE: CVE-2016-10687
Published: 2018-06-04
Description: windows-selenium-chromedriver is a module that downloads the Selenium Jar file. windows-selenium-chromedriver downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attacker controlled copy if the attacker is on the network or positioned in between the user and the remote server.
CVSS Score: 8.1 (HIGH)
CWE: CWE-311, CWE-310
References: https://nodesecurity.io/advisories/285; https://nodesecurity.io/advisories/285
CVE: CVE-2016-10688
Published: 2018-06-04
Description: Haxe 3 : The Cross-Platform Toolkit (a fork from David Mouton's damoebius/haxe-npm) haxe3 downloads resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attacker controlled copy if the attacker is on the network or positioned in between the user and the remote server.
CVSS Score: 8.1 (HIGH)
CWE: CWE-311, CWE-310
References: https://nodesecurity.io/advisories/294; https://nodesecurity.io/advisories/294
CVE: CVE-2016-10689
Published: 2018-06-04
Description: The windows-iedriver module downloads fixed version of iedriverserver.exe windows-iedriver downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attacker controlled copy if the attacker is on the network or positioned in between the user and the remote server.
CVSS Score: 8.1 (HIGH)
CWE: CWE-311, CWE-310
References: https://nodesecurity.io/advisories/293; https://nodesecurity.io/advisories/293
CVE: CVE-2016-10690
Published: 2018-06-04
Description: openframe-ascii-image module is an openframe plugin which adds support for ascii images via fim. openframe-ascii-image downloads resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attacker controlled copy if the attacker is on the network or positioned in between the user and the remote server.
CVSS Score: 8.1 (HIGH)
CWE: CWE-311, CWE-310
References: https://nodesecurity.io/advisories/298; https://nodesecurity.io/advisories/298
CVE: CVE-2016-10691
Published: 2018-06-04
Description: windows-seleniumjar is a module that downloads the Selenium Jar file windows-seleniumjar downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attacker controlled copy if the attacker is on the network or positioned in between the user and the remote server.
CVSS Score: 8.1 (HIGH)
CWE: CWE-311, CWE-310
References: https://nodesecurity.io/advisories/296; https://nodesecurity.io/advisories/296
CVE: CVE-2016-10692
Published: 2018-06-04
Description: haxeshim haxe shim to deal with coexisting versions. haxeshim downloads resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attacker controlled copy if the attacker is on the network or positioned in between the user and the remote server.
CVSS Score: 8.1 (HIGH)
CWE: CWE-310
References: https://nodesecurity.io/advisories/300; https://nodesecurity.io/advisories/300
CVE: CVE-2016-10693
Published: 2018-06-04
Description: pm2-kafka is a PM2 module that installs and runs a kafka server pm2-kafka downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attacker controlled copy if the attacker is on the network or positioned in between the user and the remote server.
CVSS Score: 8.1 (HIGH)
CWE: CWE-311, CWE-310
References: https://nodesecurity.io/advisories/299; https://nodesecurity.io/advisories/299
CVE: CVE-2016-10694
Published: 2018-06-04
Description: alto-saxophone is a module to install and launch Chromedriver for Mac, Linux or Windows. alto-saxophone versions below 2.25.1 download binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.
CVSS Score: 8.1 (HIGH)
CWE: CWE-311, CWE-310
References: https://nodesecurity.io/advisories/172; https://nodesecurity.io/advisories/172
CVE: CVE-2017-1748
Published: 2018-06-04
Description: IBM Connections 5.0, 5.5, and 6.0 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web site that would appear to be trusted. This could allow the attacker to obtain highly sensitive information or conduct further attacks against the victim. IBM X-Force ID: 135521.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-601
References: http://www.ibm.com/support/docview.wss?uid=swg22016698; https://exchange.xforce.ibmcloud.com/vulnerabilities/135521; http://www.ibm.com/support/docview.wss?uid=swg22016698
CVE: CVE-2018-11715
Published: 2018-06-04
Description: The Recent Threads plugin before 1.1 for MyBB allows XSS via a thread subject.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://community.mybb.com/mods.php?action=changelog&pid=842; https://www.exploit-db.com/exploits/44833/; https://community.mybb.com/mods.php?action=changelog&pid=842
CVE: CVE-2018-1600
Published: 2018-06-04
Description: IBM BigFix Platform 9.2 and 9.5 transmits sensitive or security-critical data in clear text in a communication channel that can be sniffed by unauthorized actors. IBM X-Force ID: 143745.
CVSS Score: 8.6 (HIGH)
CWE: CWE-319
References: http://www.ibm.com/support/docview.wss?uid=swg22015754; https://exchange.xforce.ibmcloud.com/vulnerabilities/143745; http://www.ibm.com/support/docview.wss?uid=swg22015754
CVE: CVE-2016-10695
Published: 2018-06-04
Description: The npm-test-sqlite3-trunk module provides asynchronous, non-blocking SQLite3 bindings. npm-test-sqlite3-trunk downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attacker controlled copy if the attacker is on the network or positioned in between the user and the remote server.
CVSS Score: 8.1 (HIGH)
CWE: CWE-311, CWE-310
References: https://nodesecurity.io/advisories/297; https://nodesecurity.io/advisories/297
CVE: CVE-2016-10696
Published: 2018-06-04
Description: windows-latestchromedriver downloads the latest version of chromedriver.exe. windows-latestchromedriver downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attacker controlled copy if the attacker is on the network or positioned in between the user and the remote server.
CVSS Score: 8.1 (HIGH)
CWE: CWE-311, CWE-310
References: https://nodesecurity.io/advisories/295; https://nodesecurity.io/advisories/295
CVE: CVE-2016-10697
Published: 2018-06-04
Description: react-native-baidu-voice-synthesizer is a baidu voice speech synthesizer for react native. react-native-baidu-voice-synthesizer downloads resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attacker controlled copy if the attacker is on the network or positioned in between the user and the remote server.
CVSS Score: 8.1 (HIGH)
CWE: CWE-311, CWE-310
References: https://nodesecurity.io/advisories/302; https://nodesecurity.io/advisories/302
CVE: CVE-2016-8390
Published: 2018-06-04
Description: An exploitable out of bounds write vulnerability exists in the parsing of ELF Section Headers of Hopper Disassembler 3.11.20. A specially crafted ELF file can cause attacker controlled pointer arithmetic resulting in a partially controlled out of bounds write. An attacker can craft an ELF file with specific section headers to trigger this vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: http://www.securityfocus.com/bid/93801; https://www.talosintelligence.com/vulnerability_reports/TALOS-2016-0222; http://www.securityfocus.com/bid/93801
CVE: CVE-2017-0928
Published: 2018-06-04
Description: html-janitor node module suffers from an External Control of Critical State Data vulnerability via user-control of the '_sanitized' variable causing sanitization to be bypassed.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-642, CWE-642
References: https://github.com/guardian/html-janitor/issues/35; https://hackerone.com/reports/308158; https://github.com/guardian/html-janitor/issues/35
CVE: CVE-2017-0930
Published: 2018-06-04
Description: augustine node module suffers from a Path Traversal vulnerability due to lack of validation of url, which allows a malicious user to read content of any file with known path.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22, CWE-22
References: https://hackerone.com/reports/296282; https://hackerone.com/reports/296282
CVE: CVE-2017-0931
Published: 2018-06-04
Description: html-janitor node module suffers from a Cross-Site Scripting (XSS) vulnerability via clean() accepting user-controlled values.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/guardian/html-janitor/issues/34; https://hackerone.com/reports/308155; https://github.com/guardian/html-janitor/issues/34
CVE: CVE-2017-16005
Published: 2018-06-04
Description: Http-signature is a "Reference implementation of Joyent's HTTP Signature Scheme". In versions <=0.9.11, http-signature signs only the header values, but not the header names. This makes http-signature vulnerable to header forgery. Thus, if an attacker can intercept a request, he can swap header names and change the meaning of the request without changing the signature.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20, CWE-347
References: https://github.com/joyent/node-http-signature/issues/10; https://nodesecurity.io/advisories/318; https://github.com/joyent/node-http-signature/issues/10
CVE: CVE-2017-16006
Published: 2018-06-04
Description: Remarkable is a markdown parser. In versions 1.6.2 and lower, remarkable allows the use of `data:` URIs in links and can therefore execute javascript.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/jonschlinkert/remarkable/issues/227; https://nodesecurity.io/advisories/319; https://github.com/jonschlinkert/remarkable/issues/227
CVE: CVE-2017-16007
Published: 2018-06-04
Description: node-jose is a JavaScript implementation of the JSON Object Signing and Encryption (JOSE) for current web browsers and node.js-based servers. node-jose earlier than version 0.9.3 is vulnerable to an invalid curve attack. This allows an attacker to recover the private secret key when JWE with Key Agreement with Elliptic Curve Diffie-Hellman Ephemeral Static (ECDH-ES) is used.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-200
References: http://blog.intothesymmetry.com/2017/03/critical-vulnerability-in-json-web.html; https://gist.github.com/asanso/fa[PII_REDACTED]1ef6a28d49aa0f27a4ae; https://github.com/cisco/node-jose
CVE: CVE-2017-16008
Published: 2018-06-04
Description: i18next is a language translation framework. Because of how the interpolation is implemented, making replacements from the dictionary one at a time, untrusted user input can use the name of one of the dictionary keys to inject script into the browser. This affects i18next <=1.10.2.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/i18next/i18next/pull/443; https://nodesecurity.io/advisories/325; https://github.com/i18next/i18next/pull/443
CVE: CVE-2017-16009
Published: 2018-06-04
Description: ag-grid is an advanced data grid that is library agnostic. ag-grid is vulnerable to Cross-site Scripting (XSS) via Angular Expressions, if AngularJS is used in combination with ag-grid.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/ceolter/ag-grid/issues/1287; https://nodesecurity.io/advisories/327; https://spring.io/blog/2016/01/28/angularjs-escaping-the-expression-sandbox-for-xss