rainbutterfly/cve_corpus huggingface dataset:
CVE-2016-10662 
tomita is a node wrapper for Yandex Tomita Parser tomita downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attacker controlled copy if the attacker is on the network or positioned in between the user and the remote server.
Problem types: cwe_id: CWE-311
description: Missing Encryption of Sensitive Data (CWE-311)
Affected products: vendor: HackerOne
product: tomita node module
Published: 2018-06-04T16:00:00.000Z
CVE-2016-10663 
wixtoolset is a Node module wrapper around the wixtoolset binaries wixtoolset downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attacker controlled copy if the attacker is on the network or positioned in between the user and the remote server.
Problem types: cwe_id: CWE-311
description: Missing Encryption of Sensitive Data (CWE-311)
Affected products: vendor: HackerOne
product: wixtoolset node module
Published: 2018-06-04T16:00:00.000Z
CVE-2016-10664 
mystem is a Node.js wrapper for MyStem morphology text analyzer by Yandex.ru mystem downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.
Problem types: cwe_id: CWE-311
description: Missing Encryption of Sensitive Data (CWE-311)
Affected products: vendor: HackerOne
product: mystem node module
Published: 2018-06-04T16:00:00.000Z
CVE-2016-10665 
herbivore is a packet sniffing and crafting library. Built on libtins herbivore 0.0.3 and below download binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attacker controlled copy if the attacker is on the network or positioned in between the user and the remote server.
Problem types: cwe_id: CWE-311
description: Missing Encryption of Sensitive Data (CWE-311)
Affected products: vendor: HackerOne
product: herbivore node module
Published: 2018-06-04T16:00:00.000Z
CVE-2016-10666 
tomita-parser is a Node wrapper for Yandex Tomita Parser tomita-parser downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attacker controlled copy if the attacker is on the network or positioned in between the user and the remote server.
Problem types: cwe_id: CWE-311
description: Missing Encryption of Sensitive Data (CWE-311)
Affected products: vendor: HackerOne
product: tomita-parser node module
Published: 2018-05-29T20:00:00.000Z
CVE-2016-10667 
selenium-portal is a Selenium Testing Framework selenium-portal downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attacker controlled copy if the attacker is on the network or positioned in between the user and the remote server.
Problem types: cwe_id: CWE-311
description: Missing Encryption of Sensitive Data (CWE-311)
Affected products: vendor: HackerOne
product: selenium-portal node module
Published: 2018-06-04T16:00:00.000Z
CVE-2016-10668 
libsbml is a module that installs Linux binaries for libSBML libsbml downloads resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attacker controlled copy if the attacker is on the network or positioned in between the user and the remote server.
Problem types: cwe_id: CWE-311
description: Missing Encryption of Sensitive Data (CWE-311)
Affected products: vendor: HackerOne
product: libsbml node module
Published: 2018-06-04T16:00:00.000Z
CVE-2016-10669 
soci downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attacker controlled copy if the attacker is on the network or positioned in between the user and the remote server.
Problem types: cwe_id: CWE-311
description: Missing Encryption of Sensitive Data (CWE-311)
Affected products: vendor: HackerOne
product: soci node module
Published: 2018-06-04T16:00:00.000Z
CVE-2016-10670 
windows-seleniumjar-mirror downloads the Selenium Jar file windows-seleniumjar-mirror downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attacker controlled copy if the attacker is on the network or positioned in between the user and the remote server.
Problem types: cwe_id: CWE-311
description: Missing Encryption of Sensitive Data (CWE-311)
Affected products: vendor: HackerOne
product: windows-seleniumjar-mirror node module
Published: 2018-06-04T16:00:00.000Z
CVE-2016-10671 
mystem-wrapper is a Yandex mystem app wrapper module. mystem-wrapper downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attacker controlled copy if the attacker is on the network or positioned in between the user and the remote server.
Problem types: cwe_id: CWE-311
description: Missing Encryption of Sensitive Data (CWE-311)
Affected products: vendor: HackerOne
product: mystem-wrapper node module
Published: 2018-06-04T16:00:00.000Z
CVE-2016-10672 
cloudpub-redis is a module for CloudPub: Redis Backend cloudpub-redis downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attacker controlled copy if the attacker is on the network or positioned in between the user and the remote server.
Problem types: cwe_id: CWE-311
description: Missing Encryption of Sensitive Data (CWE-311)
Affected products: vendor: HackerOne
product: cloudpub-redis node module
Published: 2018-06-04T16:00:00.000Z
CVE-2016-10673 
ipip-coffee queries geolocation information from IP ipip-coffee downloads geolocation resources over HTTP, which leaves it vulnerable to MITM attacks. This could impact the integrity and availability of the data being used to make geolocation decisions by an application.
Problem types: cwe_id: CWE-311
description: Missing Encryption of Sensitive Data (CWE-311)
Affected products: vendor: HackerOne
product: ipip-coffee node module
Published: 2018-06-04T16:00:00.000Z
CVE-2016-10674 
limbus-buildgen is a "build anywhere" build system. limbus-buildgen versions below 0.1.1 download binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attacker controlled copy if the attacker is on the network or positioned in between the user and the remote server.
Problem types: cwe_id: CWE-311
description: Missing Encryption of Sensitive Data (CWE-311)
Affected products: vendor: HackerOne
product: limbus-buildgen node module
Published: 2018-05-29T20:00:00.000Z
CVE-2016-10675 
libsbmlsim is a module that installs linux binaries for libsbmlsim libsbmlsim downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attacker controlled copy if the attacker is on the network or positioned in between the user and the remote server.
Problem types: cwe_id: CWE-311
description: Missing Encryption of Sensitive Data (CWE-311)
Affected products: vendor: HackerOne
product: libsbmlsim node module
Published: 2018-06-04T16:00:00.000Z
CVE-2016-10676 
rs-brightcove is a wrapper around brightcove's web api rs-brightcove downloads source file resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attacker controlled copy if the attacker is on the network or positioned in between the user and the remote server.
Problem types: cwe_id: CWE-311
description: Missing Encryption of Sensitive Data (CWE-311)
Affected products: vendor: HackerOne
product: rs-brightcove node module
Published: 2018-06-04T16:00:00.000Z
CVE-2016-10677 
google-closure-tools-latest is a Node.js module wrapper for downloading the latest version of the Google Closure tools google-closure-tools-latest downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attacker controlled copy if the attacker is on the network or positioned in between the user and the remote server.
Problem types: cwe_id: CWE-311
description: Missing Encryption of Sensitive Data (CWE-311)
Affected products: vendor: HackerOne
product: google-closure-tools-latest node module
Published: 2018-06-04T16:00:00.000Z
CVE-2016-10678 
serc.js is a Selenium RC process wrapper serc.js downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attacker controlled copy if the attacker is on the network or positioned in between the user and the remote server.
Problem types: cwe_id: CWE-311
description: Missing Encryption of Sensitive Data (CWE-311)
Affected products: vendor: HackerOne
product: serc.js node module
Published: 2018-06-04T16:00:00.000Z
CVE-2016-10679 
selenium-standalone-painful installs a start-selenium command line to start a standalone selenium server with chrome-driver. selenium-standalone-painful downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attacker controlled copy if the attacker is on the network or positioned in between the user and the remote server.
Problem types: cwe_id: CWE-311
description: Missing Encryption of Sensitive Data (CWE-311)
Affected products: vendor: HackerOne
product: selenium-standalone-painful node module
Published: 2018-05-29T20:00:00.000Z
CVE-2016-10680 
adamvr-geoip-lite is a light weight native JavaScript implementation of GeoIP API from MaxMind adamvr-geoip-lite downloads geoip resources over HTTP, which leaves it vulnerable to MITM attacks. This impacts the integrity and availability of this geoip data that may alter the decisions made by an application using this data.
Problem types: cwe_id: CWE-311
description: Missing Encryption of Sensitive Data (CWE-311)
Affected products: vendor: HackerOne
product: adamvr-geoip-lite node module
Published: 2018-05-29T20:00:00.000Z
CVE-2016-10681 
roslib-socketio - The standard ROS Javascript Library fork for add support to socket.io roslib-socketio downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attacker controlled copy if the attacker is on the network or positioned in between the user and the remote server.
Problem types: cwe_id: CWE-311
description: Missing Encryption of Sensitive Data (CWE-311)
Affected products: vendor: HackerOne
product: roslib-socketio node module
Published: 2018-05-29T20:00:00.000Z
CVE-2016-10682 
massif is a Phantomjs fork massif downloads resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attacker controlled copy if the attacker is on the network or positioned in between the user and the remote server.
Problem types: cwe_id: CWE-311
description: Missing Encryption of Sensitive Data (CWE-311)
Affected products: vendor: HackerOne
product: massif node module
Published: 2018-05-29T20:00:00.000Z
CVE-2016-10683 
arcanist downloads resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attacker controlled copy if the attacker is on the network or positioned in between the user and the remote server.
Problem types: cwe_id: CWE-311
description: Missing Encryption of Sensitive Data (CWE-311)
Affected products: vendor: HackerOne
product: arcanist node module
Published: 2018-06-04T16:00:00.000Z
CVE-2016-10684 
healthcenter - IBM Monitoring and Diagnostic Tools health Center agent healthcenter downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attacker controlled copy if the attacker is on the network or positioned in between the user and the remote server.
Problem types: cwe_id: CWE-311
description: Missing Encryption of Sensitive Data (CWE-311)
Affected products: vendor: HackerOne
product: healthcenter node module
Published: 2018-06-04T16:00:00.000Z
CVE-2016-10685 
pk-app-wonderbox is an integration with wonderbox pk-app-wonderbox downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attacker controlled copy if the attacker is on the network or positioned in between the user and the remote server.
Problem types: cwe_id: CWE-311
description: Missing Encryption of Sensitive Data (CWE-311)
Affected products: vendor: HackerOne
product: pk-app-wonderbox node module
Published: 2018-06-04T16:00:00.000Z
CVE-2016-10686 
fis-sass-all is another libsass wrapper for node. fis-sass-all downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attacker controlled copy if the attacker is on the network or positioned in between the user and the remote server.
Problem types: cwe_id: CWE-311
description: Missing Encryption of Sensitive Data (CWE-311)
Affected products: vendor: HackerOne
product: fis-sass-all node module
Published: 2018-06-04T16:00:00.000Z
CVE-2016-10687 
windows-selenium-chromedriver is a module that downloads the Selenium Jar file. windows-selenium-chromedriver downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attacker controlled copy if the attacker is on the network or positioned in between the user and the remote server.
Problem types: cwe_id: CWE-311
description: Missing Encryption of Sensitive Data (CWE-311)
Affected products: vendor: HackerOne
product: windows-selenium-chromedriver node module
Published: 2018-06-04T16:00:00.000Z
CVE-2016-10688 
Haxe 3 : The Cross-Platform Toolkit (a fork from David Mouton's damoebius/haxe-npm) haxe3 downloads resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attacker controlled copy if the attacker is on the network or positioned in between the user and the remote server.
Problem types: cwe_id: CWE-311
description: Missing Encryption of Sensitive Data (CWE-311)
Affected products: vendor: HackerOne
product: haxe3 node module
Published: 2018-06-04T16:00:00.000Z
CVE-2016-10689 
The windows-iedriver module downloads fixed version of iedriverserver.exe windows-iedriver downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attacker controlled copy if the attacker is on the network or positioned in between the user and the remote server.
Problem types: cwe_id: CWE-311
description: Missing Encryption of Sensitive Data (CWE-311)
Affected products: vendor: HackerOne
product: windows-iedriver node module
Published: 2018-06-04T16:00:00.000Z
CVE-2016-10690 
openframe-ascii-image module is an openframe plugin which adds support for ascii images via fim. openframe-ascii-image downloads resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attacker controlled copy if the attacker is on the network or positioned in between the user and the remote server.
Problem types: cwe_id: CWE-311
description: Missing Encryption of Sensitive Data (CWE-311)
Affected products: vendor: HackerOne
product: openframe-ascii-image node module
Published: 2018-06-04T16:00:00.000Z
CVE-2016-10691 
windows-seleniumjar is a module that downloads the Selenium Jar file windows-seleniumjar downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attacker controlled copy if the attacker is on the network or positioned in between the user and the remote server.
Problem types: cwe_id: CWE-311
description: Missing Encryption of Sensitive Data (CWE-311)
Affected products: vendor: HackerOne
product: windows-seleniumjar node module
Published: 2018-06-04T16:00:00.000Z
CVE-2016-10692 
haxeshim haxe shim to deal with coexisting versions. haxeshim downloads resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attacker controlled copy if the attacker is on the network or positioned in between the user and the remote server.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-06-04T16:00:00.000Z
CVE-2016-10693 
pm2-kafka is a PM2 module that installs and runs a kafka server pm2-kafka downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attacker controlled copy if the attacker is on the network or positioned in between the user and the remote server.
Problem types: cwe_id: CWE-311
description: Missing Encryption of Sensitive Data (CWE-311)
Affected products: vendor: HackerOne
product: pm2-kafka node module
Published: 2018-06-04T16:00:00.000Z
CVE-2016-10694 
alto-saxophone is a module to install and launch Chromedriver for Mac, Linux or Windows. alto-saxophone versions below 2.25.1 download binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.
Problem types: cwe_id: CWE-311
description: Missing Encryption of Sensitive Data (CWE-311)
Affected products: vendor: HackerOne
product: alto-saxophone node module
Published: 2018-06-04T16:00:00.000Z
CVE-2016-10695 
The npm-test-sqlite3-trunk module provides asynchronous, non-blocking SQLite3 bindings. npm-test-sqlite3-trunk downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attacker controlled copy if the attacker is on the network or positioned in between the user and the remote server.
Problem types: cwe_id: CWE-311
description: Missing Encryption of Sensitive Data (CWE-311)
Affected products: vendor: HackerOne
product: npm-test-sqlite3-trunk node module
Published: 2018-06-04T19:00:00.000Z
CVE-2016-10696 
windows-latestchromedriver downloads the latest version of chromedriver.exe. windows-latestchromedriver downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attacker controlled copy if the attacker is on the network or positioned in between the user and the remote server.
Problem types: cwe_id: CWE-311
description: Missing Encryption of Sensitive Data (CWE-311)
Affected products: vendor: HackerOne
product: windows-latestchromedriver node module
Published: 2018-06-04T19:00:00.000Z
CVE-2016-10697 
react-native-baidu-voice-synthesizer is a baidu voice speech synthesizer for react native. react-native-baidu-voice-synthesizer downloads resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attacker controlled copy if the attacker is on the network or positioned in between the user and the remote server.
Problem types: cwe_id: CWE-311
description: Missing Encryption of Sensitive Data (CWE-311)
Affected products: vendor: HackerOne
product: react-native-baidu-voice-synthesizer node module
Published: 2018-06-04T19:00:00.000Z
CVE-2016-10698 
mystem-fix is a node.js wrapper for MyStem morphology text analyzer by Yandex.ru mystem-fix downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attacker controlled copy if the attacker is on the network or positioned in between the user and the remote server.
Problem types: cwe_id: CWE-311
description: Missing Encryption of Sensitive Data (CWE-311)
Affected products: vendor: HackerOne
product: mystem-fix node module
Published: 2018-05-29T20:00:00.000Z
CVE-2016-10699 
D-Link DSL-2740E 1.00_BG_20150720 devices are prone to persistent XSS attacks in the username and password fields: a remote unauthenticated user may craft logins and passwords with script tags in them. Because there is no sanitization in the input fields, an unaware logged-in administrator may be a victim when checking the router logs.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-31T07:00:00.000Z
CVE-2016-10700 
auth_login.php in Cacti before 1.0.0 allows remote authenticated users who use web authentication to bypass intended access restrictions by logging in as a user not in the cacti database, because the guest user is not considered. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-2313.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-11-24T05:00:00.000Z
CVE-2016-10701 
In Hitachi Vantara Pentaho BA Platform through 8.0, a CSRF issue exists in the Business Analytics application.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-11-28T01:00:00.000Z
CVE-2016-10702 
Pebble Smartwatch devices through 4.3 mishandle UUID storage, which allows attackers to read an arbitrary application's flash storage, and access an arbitrary application's JavaScript instance, by modifying a UUID value within the header of a crafted application binary.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-11-28T07:00:00.000Z
CVE-2016-10703 
A regular expression Denial of Service (DoS) vulnerability in the file lib/ecstatic.js of the ecstatic npm package, before version 2.0.0, allows a remote attacker to overload and crash a server by passing a maliciously crafted string.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-14T19:00:00.000Z
CVE-2016-10704 
Magento Community Edition and Enterprise Edition before 2.0.10 and 2.1.x before 2.1.2 have XSS via e-mail templates that are mishandled during a preview, aka APPSEC-1503.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-30T21:00:00.000Z
CVE-2016-10705 
The Jetpack plugin before 4.0.4 for WordPress has XSS via the Likes module.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-12T19:00:00.000Z