deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2018-5526
Published: 2018-06-01
Description: Under certain conditions, on F5 BIG-IP ASM 13.1.0-13.1.0.5, Behavioral DOS (BADOS) protection may fail during an attack.
CVSS Score: 6.5 (MEDIUM)
References: http://www.securityfocus.com/bid/104470; http://www.securitytracker.com/id/1041019; https://support.f5.com/csp/article/K62201098
CVE: CVE-2018-7949
Published: 2018-06-01
Description: The iBMC (Intelligent Baseboard Management Controller) of some Huawei servers have a privilege escalation vulnerability. A remote attacker may send some specially crafted login messages to the affected products. Due to improper authentication design, successful exploit enables low privileged users to get or modify passwords of highly privileged users.
CVSS Score: 8.8 (HIGH)
CWE: CWE-287
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20180530-03-server-en; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20180530-03-server-en
CVE: CVE-2018-7950
Published: 2018-06-01
Description: The iBMC (Intelligent Baseboard Management Controller) of some Huawei servers have a JSON injection vulnerability due to insufficient input validation. An authenticated, remote attacker can launch a JSON injection to modify the password of administrator. Successful exploit may allow attackers to obtain the management privilege of the system.
CVSS Score: 8.8 (HIGH)
CWE: CWE-94
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20180530-02-server-en; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20180530-02-server-en
CVE: CVE-2018-7951
Published: 2018-06-01
Description: The iBMC (Intelligent Baseboard Management Controller) of some Huawei servers have a JSON injection vulnerability due to insufficient input validation. An authenticated, remote attacker can launch a JSON injection to modify the password of administrator. Successful exploit may allow attackers to obtain the management privilege of the system.
CVSS Score: 8.8 (HIGH)
CWE: CWE-94
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20180530-02-server-en; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20180530-02-server-en
CVE: CVE-2018-7976
Published: 2018-06-01
Description: There is a stored cross-site scripting (XSS) vulnerability in Huawei eSpace Desktop V300R001C00 and V300R001C50 version. Due to the insufficient validation of the input, an authenticated, remote attacker could exploit this vulnerability to send abnormal messages to the system and perform a XSS attack. A successful exploit could cause the eSpace Desktop to hang up, and the function will restore to normal after restarting the eSpace Desktop.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20180530-01-xss-en; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20180530-01-xss-en
CVE: CVE-2017-2852
Published: 2018-06-01
Description: An exploitable denial-of-service vulnerability exists in the unserialization of lists functionality of Natus Xltek NeuroWorks 8. A specially crafted network packet can cause an out-of-bounds read, resulting in a denial of service. An attacker can send a malicious packet to trigger this vulnerability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: http://www.securityfocus.com/bid/104490; https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0354; http://www.securityfocus.com/bid/104490
CVE: CVE-2017-2858
Published: 2018-06-01
Description: An exploitable denial-of-service vulnerability exists in the traversal of lists functionality of Natus Xltek NeuroWorks 8. A specially crafted network packet can cause an out-of-bounds read, resulting in a denial of service. An attacker can send a malicious packet to trigger this vulnerability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: http://www.securityfocus.com/bid/104490; https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0362; http://www.securityfocus.com/bid/104490
CVE: CVE-2017-2860
Published: 2018-06-01
Description: An exploitable denial-of-service vulnerability exists in the lookup entry functionality of KeyTrees in Natus Xltek NeuroWorks 8. A specially crafted network packet can cause an out-of-bounds read, resulting in a denial of service. An attacker can send a malicious packet to trigger this vulnerability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: http://www.securityfocus.com/bid/104490; https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0364; http://www.securityfocus.com/bid/104490
CVE: CVE-2018-11485
Published: 2018-06-01
Description: The MULTIDOTS WooCommerce Quick Reports plugin 1.0.6 and earlier for WordPress is vulnerable to Stored XSS. It allows an attacker to inject malicious JavaScript code on the WooCommerce -> Orders admin page. The attack is possible by modifying the "referral_site" cookie to have an XSS payload, and placing an order.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://labs.threatpress.com/stored-cross-site-scripting-xss-in-woocommerce-quick-reports-plugin/; http://labs.threatpress.com/stored-cross-site-scripting-xss-in-woocommerce-quick-reports-plugin/
CVE: CVE-2018-11486
Published: 2018-06-01
Description: An issue was discovered in the MULTIDOTS Advance Search for WooCommerce plugin 1.0.9 and earlier for WordPress. This plugin is vulnerable to a stored Cross-site scripting (XSS) vulnerability. A non-authenticated user can save the plugin settings and inject malicious JavaScript code in the Custom CSS textarea field, which will be loaded on every site page.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://labs.threatpress.com/stored-cross-site-scripting-xss-in-advance-search-for-woocommerce-plugin/; http://labs.threatpress.com/stored-cross-site-scripting-xss-in-advance-search-for-woocommerce-plugin/
CVE: CVE-2018-11628
Published: 2018-06-01
Description: Data input into EMS Master Calendar before 8.0.0.201805210 via URL parameters is not properly sanitized, allowing malicious attackers to send a crafted URL for XSS.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/104428; https://docs.emssoftware.com/Content/V44.1_ReleaseNotes.htm; https://gist.github.com/barrett092/c70752ca6960b8b9616a03006f291a28
CVE: CVE-2018-11652
Published: 2018-06-01
Description: CSV Injection vulnerability in Nikto 2.1.6 and earlier allows remote attackers to inject arbitrary OS commands via the Server field in an HTTP response header, which is directly injected into a CSV report.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-1236
References: https://github.com/sullo/nikto/commit/e759b3300aace5314fe3d30800c8bd83c81c29f7; https://www.exploit-db.com/exploits/44899/; https://github.com/sullo/nikto/commit/e759b3300aace5314fe3d30800c8bd83c81c29f7
CVE: CVE-2018-11655
Published: 2018-06-01
Description: In ImageMagick 7.0.7-20 Q16 x86_64, a memory leak vulnerability was found in the function GetImagePixelCache in MagickCore/cache.c, which allows attackers to cause a denial of service via a crafted CALS image file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-772
References: https://github.com/ImageMagick/ImageMagick/issues/930; https://usn.ubuntu.com/3681-1/; https://github.com/ImageMagick/ImageMagick/issues/930
CVE: CVE-2018-11656
Published: 2018-06-01
Description: In ImageMagick 7.0.7-20 Q16 x86_64, a memory leak vulnerability was found in the function ReadDCMImage in coders/dcm.c, which allows attackers to cause a denial of service via a crafted DCM image file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-772
References: https://github.com/ImageMagick/ImageMagick/issues/931; https://usn.ubuntu.com/3681-1/; https://github.com/ImageMagick/ImageMagick/issues/931
CVE: CVE-2018-11657
Published: 2018-06-01
Description: ngiflib.c in MiniUPnP ngiflib 0.4 has an infinite loop in DecodeGifImg and LoadGif.
CVSS Score: 7.5 (HIGH)
CWE: CWE-835
References: https://github.com/miniupnp/ngiflib/issues/7; https://github.com/miniupnp/ngiflib/issues/7
CVE: CVE-2018-10382
Published: 2018-06-01
Description: MODX Revolution 2.6.3 has XSS.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/modxcms/revolution/pull/13887; https://github.com/modxcms/revolution/pull/13887/commits/3241473d8213e9551cef4ed0e8ac4645cfbd10c4; https://github.com/modxcms/revolution/pull/13887
CVE: CVE-2018-11551
Published: 2018-06-01
Description: AXON PBX 2.02 contains a DLL hijacking vulnerability that could allow an unauthenticated, remote attacker to execute arbitrary code on a targeted system. The vulnerability exists because a DLL file is loaded by 'pbxsetup.exe' improperly.
CVSS Score: 7.8 (HIGH)
CWE: CWE-426
References: http://seclists.org/fulldisclosure/2018/May/69; http://seclists.org/fulldisclosure/2018/May/69
CVE: CVE-2018-11552
Published: 2018-06-01
Description: There is a reflected XSS vulnerability in AXON PBX 2.02 via the "AXON->Auto-Dialer->Agents->Name" field. The vulnerability exists due to insufficient filtration of user-supplied data. A remote attacker can execute arbitrary HTML and script code in a browser in the context of the vulnerable application.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://seclists.org/fulldisclosure/2018/May/70; http://seclists.org/fulldisclosure/2018/May/70
CVE: CVE-2018-11581
Published: 2018-06-01
Description: Cross-site scripting (XSS) vulnerability on Brother HL series printers allows remote attackers to inject arbitrary web script or HTML via the url parameter to etc/loginerror.html.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://support.brother.com/g/b/faqend.aspx?c=us_ot&lang=en&prod=group2&ftype3=100033&faqid=faq00100530_000; https://www.exploit-db.com/exploits/44839/; https://support.brother.com/g/b/faqend.aspx?c=us_ot&lang=en&prod=group2&ftype3=100033&faqid=faq00100530_000
CVE: CVE-2018-11670
Published: 2018-06-01
Description: An issue was discovered in GreenCMS v2.3.0603. There is a CSRF vulnerability that allows attackers to execute arbitrary PHP code via the content parameter to index.php?m=admin&c=media&a=fileconnect.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/GreenCMS/GreenCMS/issues/108; https://www.exploit-db.com/exploits/44825/; https://github.com/GreenCMS/GreenCMS/issues/108
CVE: CVE-2018-11671
Published: 2018-06-01
Description: An issue was discovered in GreenCMS v2.3.0603. There is a CSRF vulnerability that can add an admin account via index.php?m=admin&c=access&a=adduserhandle.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/GreenCMS/GreenCMS/issues/109; https://www.exploit-db.com/exploits/44826/; https://github.com/GreenCMS/GreenCMS/issues/109
CVE: CVE-2018-3742
Published: 2018-06-01
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2018-3745.  Reason: This candidate is a reservation duplicate of CVE-2018-3745.  Notes: All CVE users should reference CVE-2018-3745 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2018-3743
Published: 2018-06-01
Description: Open redirect in hekto <=0.2.3 when target domain name is used as html filename on server.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601, CWE-601
References: https://hackerone.com/reports/320693; https://hackerone.com/reports/320693
CVE: CVE-2018-3746
Published: 2018-06-01
Description: The pdfinfojs NPM module versions <= 0.3.6 has a command injection vulnerability that allows an attacker to execute arbitrary commands on the victim's machine.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77, CWE-78
References: https://hackerone.com/reports/330957; https://hackerone.com/reports/330957
CVE: CVE-2018-3755
Published: 2018-06-01
Description: XSS in sexstatic <=0.6.2 causes HTML injection in directory name(s) leads to Stored XSS when malicious file is embed with <iframe> element used in directory name.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://hackerone.com/reports/328210; https://hackerone.com/reports/328210
CVE: CVE-2016-10574
Published: 2018-06-01
Description: apk-parser3 is a module to extract Android Manifest info from an APK file. apk-parser3 versions before 0.1.3 download binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.
CVSS Score: 8.1 (HIGH)
CWE: CWE-311, CWE-310
References: https://nodesecurity.io/advisories/245; https://nodesecurity.io/advisories/245
CVE: CVE-2016-10575
Published: 2018-06-01
Description: Kindlegen is a simple Node.js wrapper of the official kindlegen program. Kindlegen versions before 1.1.0 download binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.
CVSS Score: 8.1 (HIGH)
CWE: CWE-311, CWE-310
References: https://nodesecurity.io/advisories/251; https://nodesecurity.io/advisories/251
CVE: CVE-2016-10576
Published: 2018-06-01
Description: Fuseki server wrapper and management API in fuseki before 1.0.1 downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attacker controlled copy if the attacker is on the network or positioned in between the user and the remote server.
CVSS Score: 8.1 (HIGH)
CWE: CWE-311, CWE-310
References: https://nodesecurity.io/advisories/278; https://nodesecurity.io/advisories/278
CVE: CVE-2016-10579
Published: 2018-06-01
Description: Chromedriver is an NPM wrapper for selenium ChromeDriver. Chromedriver before 2.26.1 downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.
CVSS Score: 8.1 (HIGH)
CWE: CWE-311, CWE-310
References: https://nodesecurity.io/advisories/160; https://nodesecurity.io/advisories/160
CVE: CVE-2016-10580
Published: 2018-06-01
Description: nodewebkit is an installer for node-webkit. nodewebkit downloads zipped resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested zip file with an attacker controlled zip file if the attacker is on the network or positioned in between the user and the remote server.
CVSS Score: 8.1 (HIGH)
CWE: CWE-311, CWE-310
References: https://nodesecurity.io/advisories/173; https://nodesecurity.io/advisories/173
CVE: CVE-2016-10581
Published: 2018-06-01
Description: Steroids is PhoneGap on Steroids, providing native UI elements, multiple WebViews and enhancements for better developer productivity. steroids downloads zipped resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested tarball with an attacker controlled tarball if the attacker is on the network or positioned in between the user and the remote server.
CVSS Score: 8.1 (HIGH)
CWE: CWE-311, CWE-310
References: https://nodesecurity.io/advisories/168; https://nodesecurity.io/advisories/168
CVE: CVE-2016-10582
Published: 2018-06-01
Description: closurecompiler is a Closure Compiler for node.js. closurecompiler downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.
CVSS Score: 8.1 (HIGH)
CWE: CWE-311, CWE-310
References: https://nodesecurity.io/advisories/169; https://nodesecurity.io/advisories/169
CVE: CVE-2016-10583
Published: 2018-06-01
Description: closure-utils is Utilities for Closure Library based projects. closure-utils downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.
CVSS Score: 8.1 (HIGH)
CWE: CWE-310
References: https://nodesecurity.io/advisories/165; https://nodesecurity.io/advisories/165
CVE: CVE-2016-10585
Published: 2018-06-01
Description: libxl provides Node bindings for the libxl library for reading and writing excel (XLS and XLSX) spreadsheets. libxl downloads zipped resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested zip file with an attacker controlled zip file if the attacker is on the network or positioned in between the user and the remote server.
CVSS Score: 8.1 (HIGH)
CWE: CWE-311, CWE-310
References: https://nodesecurity.io/advisories/178; https://nodesecurity.io/advisories/178
CVE: CVE-2016-10587
Published: 2018-06-01
Description: wasdk is a toolkit for creating WebAssembly modules. wasdk downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.
CVSS Score: 8.1 (HIGH)
CWE: CWE-311, CWE-310
References: https://nodesecurity.io/advisories/179; https://nodesecurity.io/advisories/179
CVE: CVE-2016-10588
Published: 2018-06-01
Description: nw is an installer for nw.js. nw downloads zipped resources over HTTP, It may be possible to cause remote code execution (RCE) by swapping out the requested zip file with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.
CVSS Score: 8.1 (HIGH)
CWE: CWE-311, CWE-310
References: https://nodesecurity.io/advisories/166; https://nodesecurity.io/advisories/166
CVE: CVE-2016-10592
Published: 2018-06-01
Description: jser-stat is a JSer.info stat library. jser-stat downloads data resources over HTTP, which leaves it vulnerable to MITM attacks.
CVSS Score: 8.1 (HIGH)
CWE: CWE-311, CWE-310
References: https://github.com/jser/stat-js/blob/master/data/url-mapping.js; https://nodesecurity.io/advisories/188; https://github.com/jser/stat-js/blob/master/data/url-mapping.js
CVE: CVE-2016-10594
Published: 2018-06-01
Description: ipip is a Node.js module to query geolocation information for an IP or domain, based on database by ipip.net. ipip downloads data resources over HTTP, which leaves it vulnerable to MITM attacks.
CVSS Score: 8.1 (HIGH)
CWE: CWE-311, CWE-310
References: https://nodesecurity.io/advisories/184; https://nodesecurity.io/advisories/184
CVE: CVE-2016-10595
Published: 2018-06-01
Description: jdf-sass is a fork from node-sass, jdf use only. jdf-sass downloads executable resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested file with an attacker controlled file if the attacker is on the network or positioned in between the user and the remote server.
CVSS Score: 8.1 (HIGH)
CWE: CWE-311, CWE-310
References: https://nodesecurity.io/advisories/198; https://nodesecurity.io/advisories/198
CVE: CVE-2016-10596
Published: 2018-06-01
Description: imageoptim is a Node.js wrapper for some images compression algorithms. imageoptim downloads zipped resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested tarball with an attacker controlled tarball if the attacker is on the network or positioned in between the user and the remote server.
CVSS Score: 8.1 (HIGH)
CWE: CWE-311, CWE-310
References: https://nodesecurity.io/advisories/194; https://nodesecurity.io/advisories/194
CVE: CVE-2016-10597
Published: 2018-06-01
Description: cobalt-cli downloads resources over HTTP, which leaves it vulnerable to MITM attacks.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-311, CWE-311
References: https://nodesecurity.io/advisories/197; https://nodesecurity.io/advisories/197
CVE: CVE-2016-10598
Published: 2018-06-01
Description: arrayfire-js is a module for ArrayFire for the Node.js platform. arrayfire-js downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.
CVSS Score: 7.5 (HIGH)
CWE: CWE-311, CWE-310
References: https://nodesecurity.io/advisories/192; https://nodesecurity.io/advisories/192
CVE: CVE-2016-10599
Published: 2018-06-01
Description: sauce-connect is a Node.js wrapper over the SauceLabs SauceConnect.jar program for establishing a secure tunnel for intranet testing. sauce-connect downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.
CVSS Score: 8.1 (HIGH)
CWE: CWE-311, CWE-310
References: https://nodesecurity.io/advisories/186; https://nodesecurity.io/advisories/186
CVE: CVE-2016-10600
Published: 2018-06-01
Description: webrtc-native uses WebRTC from chromium project. webrtc-native downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.
CVSS Score: 8.1 (HIGH)
CWE: CWE-311, CWE-310
References: https://nodesecurity.io/advisories/176; https://nodesecurity.io/advisories/176
CVE: CVE-2016-10602
Published: 2018-06-01
Description: haxe is a cross-platform toolkit haxe downloads zipped resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested zip file with an attacker controlled zip file if the attacker is on the network or positioned in between the user and the remote server.
CVSS Score: 8.1 (HIGH)
CWE: CWE-311, CWE-310
References: https://nodesecurity.io/advisories/177; https://nodesecurity.io/advisories/177
CVE: CVE-2016-10603
Published: 2018-06-01
Description: air-sdk is a NPM wrapper for the Adobe AIR SDK. air-sdk downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.
CVSS Score: 8.1 (HIGH)
CWE: CWE-311, CWE-310
References: https://nodesecurity.io/advisories/200; https://nodesecurity.io/advisories/200
CVE: CVE-2016-10604
Published: 2018-06-01
Description: dalek-browser-chrome is Google Chrome bindings for DalekJS. dalek-browser-chrome downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.
CVSS Score: 8.1 (HIGH)
CWE: CWE-311, CWE-310
References: https://nodesecurity.io/advisories/199; https://nodesecurity.io/advisories/199
CVE: CVE-2016-10605
Published: 2018-06-01
Description: dalek-browser-ie is Internet Explorer bindings for DalekJS. dalek-browser-ie downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.
CVSS Score: 8.1 (HIGH)
CWE: CWE-311, CWE-310
References: https://nodesecurity.io/advisories/209; https://nodesecurity.io/advisories/209