HackerOne
Page 4 of 5 — HackerOne CVEs from a corpus of 470, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2016-10647 | High | 8.1 | 2018-06-04 | node-air-sdk is an AIR SDK for nodejs. node-air-sdk downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cau… |
CVE-2016-10646 | High | 8.1 | 2018-06-04 | resourcehacker is a Node wrapper of Resource Hacker (windows executable resource editor). resourcehacker downloads binary resources over HTTP, which leaves it… |
CVE-2016-10645 | High | 8.1 | 2018-06-04 | grunt-images is a grunt plugin for processing images. grunt-images downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be… |
CVE-2016-10644 | High | 8.1 | 2018-06-04 | slimerjs-edge is a npm wrapper for installing the bleeding edge version of slimerjs. slimerjs-edge downloads binary resources over HTTP, which leaves it vulner… |
CVE-2016-10643 | High | 8.1 | 2018-06-04 | jstestdriver is a wrapper for Google's jstestdriver. jstestdriver downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be p… |
CVE-2016-10642 | High | 8.1 | 2018-06-04 | cmake installs the cmake x86 linux binaries. cmake downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to caus… |
CVE-2016-10641 | High | 8.1 | 2018-06-04 | node-bsdiff-android downloads resources over HTTP, which leaves it vulnerable to MITM attacks. |
CVE-2016-10640 | High | 8.1 | 2018-06-04 | node-thulac is a node binding for thulac. node-thulac downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to c… |
CVE-2016-10639 | High | 8.1 | 2018-06-04 | redis-srvr is a npm wrapper for redis-server. redis-srvr downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible t… |
CVE-2016-10638 | High | 8.1 | 2018-06-04 | js-given is a JavaScript frontend to jgiven. js-given downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to c… |
CVE-2016-10637 | High | 8.1 | 2018-06-04 | haxe-dev is a cross-platform toolkit. haxe-dev downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause re… |
CVE-2016-10636 | High | 8.1 | 2018-06-04 | grunt-ccompiler is a Closure Compiler Grunt Plugin. grunt-ccompiler downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be… |
CVE-2016-10634 | High | 8.1 | 2018-06-01 | scala-standalone-bin is a Binary wrapper for ScalaJS. scala-standalone-bin downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It… |
CVE-2016-10633 | High | 8.1 | 2018-06-01 | dwebp-bin is a dwebp node.js wrapper that convert WebP into PNG. dwebp-bin downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It… |
CVE-2016-10632 | High | 8.1 | 2018-06-01 | apk-parser2 is a module which extracts Android Manifest info from an APK file. apk-parser2 downloads binary resources over HTTP, which leaves it vulnerable to… |
CVE-2016-10631 | High | 8.1 | 2018-06-01 | jvminstall is a module for downloading and unpacking jvm to local system. jvminstall downloads binary resources over HTTP, which leaves it vulnerable to MITM a… |
CVE-2016-10630 | Medium | 5.9 | 2018-06-01 | install-g-test downloads resources over HTTP, which leaves it vulnerable to MITM attacks. |
CVE-2016-10629 | High | 8.1 | 2018-06-01 | nw-with-arm is a NW Installer including ARM-Build. nw-with-arm downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be poss… |
CVE-2016-10628 | High | 8.1 | 2018-06-01 | selenium-wrapper is a selenium server wrapper, including installation and chrome webdriver. selenium-wrapper downloads binary resources over HTTP, which leaves… |
CVE-2016-10626 | High | 8.1 | 2018-06-01 | mystem3 is a NodeJS wrapper for the Yandex MyStem 3. mystem3 downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possib… |
CVE-2016-10625 | High | 8.1 | 2018-06-01 | headless-browser-lite is a minimal npm installer for phantomjs and slimerjs with no external dependencies. headless-browser-lite downloads binary resources ove… |
CVE-2016-10624 | High | 8.1 | 2018-06-01 | selenium-chromedriver is a simple utility for downloading the Selenium Webdriver for Google Chrome selenium-chromedriver downloads binary resources over HTTP… |
CVE-2016-10623 | High | 8.1 | 2018-06-01 | macaca-chromedriver-zxa is a Node.js wrapper for the selenium chromedriver. macaca-chromedriver-zxa downloads binary resources over HTTP, which leaves it vulne… |
CVE-2016-10622 | High | 8.1 | 2018-06-01 | nodeschnaps is a NodeJS compatibility layer for Java (Rhino). nodeschnaps downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It… |
CVE-2016-10621 | High | 8.1 | 2018-06-01 | fibjs is a runtime for javascript applictions built on google v8 JS. fibjs downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It… |
CVE-2016-10620 | High | 8.1 | 2018-06-01 | atom-node-module-installer installs node modules for atom-shell applications. atom-node-module-installer binary resources over HTTP, which leaves it vulnerable… |
CVE-2016-10619 | High | 8.1 | 2018-06-01 | pennyworth is a natural language templating engine. pennyworth downloads data resources over HTTP, which leaves it vulnerable to MITM attacks. |
CVE-2016-10618 | High | 8.1 | 2018-06-01 | node-browser is a wrapper webdriver by nodejs. node-browser downloads resources over HTTP, which leaves it vulnerable to MITM attacks. |
CVE-2016-10617 | High | 8.1 | 2018-06-01 | box2d-native downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapp… |
CVE-2016-10616 | High | 8.1 | 2018-06-01 | openframe-image is an Openframe extension which adds support for images via fbi. openframe-image downloads data resources over HTTP, which leaves it vulnerable… |
CVE-2016-10615 | High | 8.1 | 2018-06-01 | curses is bindings for the native curses library, a full featured console IO library. curses downloads binary resources over HTTP, which leaves it vulnerable t… |
CVE-2016-10614 | High | 8.1 | 2018-06-01 | httpsync is a port of libcurl to node.js. httpsync downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to caus… |
CVE-2016-10613 | Medium | 5.9 | 2018-06-01 | bionode-sra is a Node.js wrapper for SRA Toolkit. bionode-sra downloads data resources over HTTP, which leaves it vulnerable to MITM attacks. |
CVE-2016-10612 | High | 8.1 | 2018-06-01 | dalek-browser-ie-canary is Internet Explorer bindings for DalekJS. dalek-browser-ie-canary downloads binary resources over HTTP, which leaves it vulnerable to… |
CVE-2016-10610 | High | 8.1 | 2018-06-01 | unicode-json is a unicode lookup table. unicode-json before 2.0.0 downloads data resources over HTTP, which leaves it vulnerable to MITM attacks. |
CVE-2016-10609 | High | 8.1 | 2018-06-01 | chromedriver126 is chromedriver version 1.26 for linux OS. chromedriver126 downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It… |
CVE-2016-10608 | High | 7.5 | 2018-06-01 | robot-js is a module for native system automation for node.js. robot-js downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It ma… |
CVE-2016-10607 | High | 8.1 | 2018-06-01 | openframe-glsviewer is a Openframe extension which adds support for shaders via glslViewer. openframe-glsviewer downloads binary resources over HTTP, which lea… |
CVE-2016-10606 | High | 8.1 | 2018-06-01 | grunt-webdriver-qunit is a grunt plugin to run qunit with webdriver in grunt grunt-webdriver-qunit downloads binary resources over HTTP, which leaves it vulner… |
CVE-2016-10605 | High | 8.1 | 2018-06-01 | dalek-browser-ie is Internet Explorer bindings for DalekJS. dalek-browser-ie downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks… |
CVE-2016-10604 | High | 8.1 | 2018-06-01 | dalek-browser-chrome is Google Chrome bindings for DalekJS. dalek-browser-chrome downloads binary resources over HTTP, which leaves it vulnerable to MITM attac… |
CVE-2016-10603 | High | 8.1 | 2018-06-01 | air-sdk is a NPM wrapper for the Adobe AIR SDK. air-sdk downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to… |
CVE-2016-10602 | High | 8.1 | 2018-06-01 | haxe is a cross-platform toolkit haxe downloads zipped resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code… |
CVE-2016-10600 | High | 8.1 | 2018-06-01 | webrtc-native uses WebRTC from chromium project. webrtc-native downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be poss… |
CVE-2016-10599 | High | 8.1 | 2018-06-01 | sauce-connect is a Node.js wrapper over the SauceLabs SauceConnect.jar program for establishing a secure tunnel for intranet testing. sauce-connect downloads b… |
CVE-2016-10598 | High | 7.5 | 2018-06-01 | arrayfire-js is a module for ArrayFire for the Node.js platform. arrayfire-js downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks… |
CVE-2016-10597 | Medium | 5.9 | 2018-06-01 | cobalt-cli downloads resources over HTTP, which leaves it vulnerable to MITM attacks. |
CVE-2016-10596 | High | 8.1 | 2018-06-01 | imageoptim is a Node.js wrapper for some images compression algorithms. imageoptim downloads zipped resources over HTTP, which leaves it vulnerable to MITM att… |
CVE-2016-10595 | High | 8.1 | 2018-06-01 | jdf-sass is a fork from node-sass, jdf use only. jdf-sass downloads executable resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possi… |
CVE-2016-10594 | High | 8.1 | 2018-06-01 | ipip is a Node.js module to query geolocation information for an IP or domain, based on database by ipip.net. ipip downloads data resources over HTTP, which le… |
CVE-2016-10592 | High | 8.1 | 2018-06-01 | jser-stat is a JSer.info stat library. jser-stat downloads data resources over HTTP, which leaves it vulnerable to MITM attacks. |
CVE-2016-10588 | High | 8.1 | 2018-06-01 | nw is an installer for nw.js. nw downloads zipped resources over HTTP, It may be possible to cause remote code execution (RCE) by swapping out the requested zi… |
CVE-2016-10587 | High | 8.1 | 2018-06-01 | wasdk is a toolkit for creating WebAssembly modules. wasdk downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible… |
CVE-2016-10585 | High | 8.1 | 2018-06-01 | libxl provides Node bindings for the libxl library for reading and writing excel (XLS and XLSX) spreadsheets. libxl downloads zipped resources over HTTP, which… |
CVE-2016-10582 | High | 8.1 | 2018-06-01 | closurecompiler is a Closure Compiler for node.js. closurecompiler downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be… |
CVE-2016-10581 | High | 8.1 | 2018-06-01 | Steroids is PhoneGap on Steroids, providing native UI elements, multiple WebViews and enhancements for better developer productivity. steroids downloads zipped… |
CVE-2016-10580 | High | 8.1 | 2018-06-01 | nodewebkit is an installer for node-webkit. nodewebkit downloads zipped resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to… |
CVE-2016-10579 | High | 8.1 | 2018-06-01 | Chromedriver is an NPM wrapper for selenium ChromeDriver. Chromedriver before 2.26.1 downloads binary resources over HTTP, which leaves it vulnerable to MITM a… |
CVE-2016-10576 | High | 8.1 | 2018-06-01 | Fuseki server wrapper and management API in fuseki before 1.0.1 downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be pos… |
CVE-2016-10575 | High | 8.1 | 2018-06-01 | Kindlegen is a simple Node.js wrapper of the official kindlegen program. Kindlegen versions before 1.1.0 download binary resources over HTTP, which leaves it v… |
CVE-2016-10574 | High | 8.1 | 2018-06-01 | apk-parser3 is a module to extract Android Manifest info from an APK file. apk-parser3 versions before 0.1.3 download binary resources over HTTP, which leaves… |
CVE-2018-3755 | Medium | 6.1 | 2018-06-01 | XSS in sexstatic <=0.6.2 causes HTML injection in directory name(s) leads to Stored XSS when malicious file is embed with <iframe> element used in directory na… |
CVE-2018-3746 | Critical | 9.8 | 2018-06-01 | The pdfinfojs NPM module versions <= 0.3.6 has a command injection vulnerability that allows an attacker to execute arbitrary commands on the victim's machine. |
CVE-2018-3743 | Medium | 6.1 | 2018-06-01 | Open redirect in hekto <=0.2.3 when target domain name is used as html filename on server. |
CVE-2016-10572 | High | 8.1 | 2018-05-31 | mongodb-instance before 0.0.3 installs mongodb locally. mongodb-instance downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It m… |
CVE-2016-10571 | High | 8.1 | 2018-05-31 | bkjs-wand is imagemagick wand support for node.js and backendjs bkjs-wand versions lower than 0.3.2 download binary resources over HTTP, which leaves it vulner… |
CVE-2016-10569 | High | 8.1 | 2018-05-31 | embedza is a module to create HTML snippets/embeds from URLs using info from oEmbed, Open Graph, meta tags. embedza versions below 1.2.4 download JavaScript re… |
CVE-2016-10565 | High | 8.1 | 2018-05-31 | operadriver is a Opera Driver for Selenium. operadriver versions below 0.2.3 download binary resources over HTTP, which leaves it vulnerable to MITM attacks. I… |
CVE-2016-10564 | High | 8.1 | 2018-05-31 | apk-parser is a tool to extract Android Manifest info from an APK file. apk-parser versions below 0.1.6 download binary resources over HTTP, which leaves it vu… |
CVE-2016-10563 | High | 8.1 | 2018-05-31 | During the installation process, the go-ipfs-deps module before 0.4.4 insecurely downloads resources over HTTP. This allows for a MITM attack to compromise the… |
CVE-2016-10562 | High | 8.1 | 2018-05-31 | iedriver is an NPM wrapper for Selenium IEDriver. iedriver versions below 3.0.0 download binary resources over HTTP, which leaves the module vulnerable to MITM… |
CVE-2016-10561 | Medium | 5.3 | 2018-05-31 | Bitty is a development web server tool that functions similar to `python -m SimpleHTTPServer`. Version 0.2.10 has a directory traversal vulnerability that is e… |
CVE-2016-10560 | High | 8.1 | 2018-05-31 | galenframework-cli is the node wrapper for the Galen Framework. galenframework-cli below 2.3.1 download binary resources over HTTP, which leaves it vulnerable… |
CVE-2016-10557 | High | 8.1 | 2018-05-31 | appium-chromedriver is a Node.js wrapper around Chromedriver. Versions below 2.9.4 download binary resources over HTTP, which leaves the module vulnerable to M… |
CVE-2016-10555 | Medium | 6.5 | 2018-05-31 | Since "algorithm" isn't enforced in jwt.decode()in jwt-simple 0.3.0 and earlier, a malicious user could choose what algorithm is sent sent to the server. If th… |
CVE-2016-10554 | Critical | 9.8 | 2018-05-31 | sequelize is an Object-relational mapping, or a middleman to convert things from Postgres, MySQL, MariaDB, SQLite and Microsoft SQL Server into usable data for… |
CVE-2016-10553 | Critical | 9.8 | 2018-05-31 | sequelize is an Object-relational mapping, or a middleman to convert things from Postgres, MySQL, MariaDB, SQLite and Microsoft SQL Server into usable data for… |
CVE-2016-10552 | High | 7.4 | 2018-05-31 | igniteui 0.0.5 and earlier downloads JavaScript and CSS resources over insecure protocol. |
CVE-2016-10550 | Critical | 9.8 | 2018-05-31 | sequelize is an Object-relational mapping, or a middleman to convert things from Postgres, MySQL, MariaDB, SQLite and Microsoft SQL Server into usable data for… |
CVE-2016-10549 | Medium | 4.4 | 2018-05-31 | Sails is an MVC style framework for building realtime web applications. Version 0.12.7 and lower have an issue with the CORS configuration where the value of t… |
CVE-2016-10548 | Medium | 6.1 | 2018-05-31 | Arbitrary code execution is possible in reduce-css-calc node module <=1.2.4 through crafted css. This makes cross sites scripting (XSS) possible on the client… |
CVE-2016-10547 | Medium | 6.1 | 2018-05-31 | Nunjucks is a full featured templating engine for JavaScript. Versions 2.4.2 and lower have a cross site scripting (XSS) vulnerability in autoescape mode. In a… |
CVE-2016-10546 | Critical | 9.8 | 2018-05-31 | An arbitrary code injection vector was found in PouchDB 6.0.4 and lesser via the map/reduce functions used in PouchDB temporary views and design documents. The… |
CVE-2016-10544 | Medium | 5.9 | 2018-05-31 | uws is a WebSocket server library. By sending a 256mb websocket message to a uws server instance with permessage-deflate enabled, there is a possibility used c… |
CVE-2016-10543 | Medium | 5.3 | 2018-05-31 | call is an HTTP router that is primarily used by the hapi framework. There exists a bug in call versions 2.0.1-3.0.1 that does not validate empty parameters, w… |
CVE-2016-10542 | High | 7.5 | 2018-05-31 | ws is a "simple to use, blazing fast and thoroughly tested websocket client, server and console for node.js, up-to-date against RFC-6455". By sending an overly… |
CVE-2016-10541 | Critical | 9.8 | 2018-05-31 | The npm module "shell-quote" 1.6.0 and earlier cannot correctly escape ">" and "<" operator used for redirection in shell. Applications that depend on shell-qu… |
CVE-2016-10540 | High | 7.5 | 2018-05-31 | Minimatch is a minimal matching utility that works by converting glob expressions into JavaScript `RegExp` objects. The primary function, `minimatch(path, patt… |
CVE-2016-10539 | High | 7.5 | 2018-05-31 | negotiator is an HTTP content negotiator for Node.js and is used by many modules and frameworks including Express and Koa. The header for "Accept-Language", wh… |
CVE-2016-10538 | Low | 3.5 | 2018-05-31 | The package `node-cli` before 1.0.0 insecurely uses the lock_file and log_file. Both of these are temporary, but it allows the starting user to overwrite any f… |
CVE-2016-10537 | Medium | 5.4 | 2018-05-31 | backbone is a module that adds in structure to a JavaScript heavy application through key-value pairs and custom events connecting to your RESTful API through… |
CVE-2016-10536 | Medium | 5.9 | 2018-05-31 | engine.io-client is the client for engine.io, the implementation of a transport-based cross-browser/cross-device bi-directional communication layer for Socket… |
CVE-2016-10535 | Medium | 5.9 | 2018-05-31 | csrf-lite is a cross-site request forgery protection library for framework-less node sites. csrf-lite uses `===`, a fail first string comparison, instead of a… |
CVE-2016-10534 | Medium | 5.9 | 2018-05-31 | electron-packager is a command line tool that packages Electron source code into `.app` and `.exe` packages. along with Electron. The `--strict-ssl` command li… |
CVE-2016-10533 | High | 8.8 | 2018-05-31 | express-restify-mongoose is a module to easily create a flexible REST interface for mongoose models. express-restify-mongoose 2.4.2 and earlier and 3.0.X throu… |
CVE-2016-10532 | Critical | 9.8 | 2018-05-31 | console-io is a module that allows users to implement a web console in their application. A malicious user could bypass the authentication and execute any comm… |
CVE-2016-10531 | Medium | 6.1 | 2018-05-31 | marked is an application that is meant to parse and compile markdown. Due to the way that marked 0.3.5 and earlier parses input, specifically HTML entities, it… |
CVE-2016-10530 | Medium | 5.9 | 2018-05-31 | The airbrake module 0.3.8 and earlier defaults to sending environment variables over HTTP. Environment variables can often times contain secret keys and other… |
CVE-2016-10529 | High | 8.8 | 2018-05-31 | Droppy versions <3.5.0 does not perform any verification for cross-domain websocket requests. An attacker is able to make a specially crafted page that can sen… |
CVE-2016-10528 | Medium | 4.9 | 2018-05-31 | restafary is a REpresentful State Transfer API for Creating, Reading, Using, Deleting files on a server from the web. Restafary before 1.6.1 is able to set up… |