2016 CVEs (page 10)
Page 10 of 94 — CVEs published in 2016, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2016-10625 | High | 8.1 | 2018-06-01 | headless-browser-lite is a minimal npm installer for phantomjs and slimerjs with no external dependencies. headless-browser-lite downloads binary resources ove… |
CVE-2016-10624 | High | 8.1 | 2018-06-01 | selenium-chromedriver is a simple utility for downloading the Selenium Webdriver for Google Chrome selenium-chromedriver downloads binary resources over HTTP… |
CVE-2016-10623 | High | 8.1 | 2018-06-01 | macaca-chromedriver-zxa is a Node.js wrapper for the selenium chromedriver. macaca-chromedriver-zxa downloads binary resources over HTTP, which leaves it vulne… |
CVE-2016-10622 | High | 8.1 | 2018-06-01 | nodeschnaps is a NodeJS compatibility layer for Java (Rhino). nodeschnaps downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It… |
CVE-2016-10621 | High | 8.1 | 2018-06-01 | fibjs is a runtime for javascript applictions built on google v8 JS. fibjs downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It… |
CVE-2016-10620 | High | 8.1 | 2018-06-01 | atom-node-module-installer installs node modules for atom-shell applications. atom-node-module-installer binary resources over HTTP, which leaves it vulnerable… |
CVE-2016-10619 | High | 8.1 | 2018-06-01 | pennyworth is a natural language templating engine. pennyworth downloads data resources over HTTP, which leaves it vulnerable to MITM attacks. |
CVE-2016-10618 | High | 8.1 | 2018-06-01 | node-browser is a wrapper webdriver by nodejs. node-browser downloads resources over HTTP, which leaves it vulnerable to MITM attacks. |
CVE-2016-10617 | High | 8.1 | 2018-06-01 | box2d-native downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapp… |
CVE-2016-10616 | High | 8.1 | 2018-06-01 | openframe-image is an Openframe extension which adds support for images via fbi. openframe-image downloads data resources over HTTP, which leaves it vulnerable… |
CVE-2016-10615 | High | 8.1 | 2018-06-01 | curses is bindings for the native curses library, a full featured console IO library. curses downloads binary resources over HTTP, which leaves it vulnerable t… |
CVE-2016-10614 | High | 8.1 | 2018-06-01 | httpsync is a port of libcurl to node.js. httpsync downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to caus… |
CVE-2016-10613 | Medium | 5.9 | 2018-06-01 | bionode-sra is a Node.js wrapper for SRA Toolkit. bionode-sra downloads data resources over HTTP, which leaves it vulnerable to MITM attacks. |
CVE-2016-10612 | High | 8.1 | 2018-06-01 | dalek-browser-ie-canary is Internet Explorer bindings for DalekJS. dalek-browser-ie-canary downloads binary resources over HTTP, which leaves it vulnerable to… |
CVE-2016-10610 | High | 8.1 | 2018-06-01 | unicode-json is a unicode lookup table. unicode-json before 2.0.0 downloads data resources over HTTP, which leaves it vulnerable to MITM attacks. |
CVE-2016-10609 | High | 8.1 | 2018-06-01 | chromedriver126 is chromedriver version 1.26 for linux OS. chromedriver126 downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It… |
CVE-2016-10608 | High | 7.5 | 2018-06-01 | robot-js is a module for native system automation for node.js. robot-js downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It ma… |
CVE-2016-10607 | High | 8.1 | 2018-06-01 | openframe-glsviewer is a Openframe extension which adds support for shaders via glslViewer. openframe-glsviewer downloads binary resources over HTTP, which lea… |
CVE-2016-10606 | High | 8.1 | 2018-06-01 | grunt-webdriver-qunit is a grunt plugin to run qunit with webdriver in grunt grunt-webdriver-qunit downloads binary resources over HTTP, which leaves it vulner… |
CVE-2016-10605 | High | 8.1 | 2018-06-01 | dalek-browser-ie is Internet Explorer bindings for DalekJS. dalek-browser-ie downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks… |
CVE-2016-10604 | High | 8.1 | 2018-06-01 | dalek-browser-chrome is Google Chrome bindings for DalekJS. dalek-browser-chrome downloads binary resources over HTTP, which leaves it vulnerable to MITM attac… |
CVE-2016-10603 | High | 8.1 | 2018-06-01 | air-sdk is a NPM wrapper for the Adobe AIR SDK. air-sdk downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to… |
CVE-2016-10602 | High | 8.1 | 2018-06-01 | haxe is a cross-platform toolkit haxe downloads zipped resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code… |
CVE-2016-10600 | High | 8.1 | 2018-06-01 | webrtc-native uses WebRTC from chromium project. webrtc-native downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be poss… |
CVE-2016-10599 | High | 8.1 | 2018-06-01 | sauce-connect is a Node.js wrapper over the SauceLabs SauceConnect.jar program for establishing a secure tunnel for intranet testing. sauce-connect downloads b… |
CVE-2016-10598 | High | 7.5 | 2018-06-01 | arrayfire-js is a module for ArrayFire for the Node.js platform. arrayfire-js downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks… |
CVE-2016-10597 | Medium | 5.9 | 2018-06-01 | cobalt-cli downloads resources over HTTP, which leaves it vulnerable to MITM attacks. |
CVE-2016-10596 | High | 8.1 | 2018-06-01 | imageoptim is a Node.js wrapper for some images compression algorithms. imageoptim downloads zipped resources over HTTP, which leaves it vulnerable to MITM att… |
CVE-2016-10595 | High | 8.1 | 2018-06-01 | jdf-sass is a fork from node-sass, jdf use only. jdf-sass downloads executable resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possi… |
CVE-2016-10594 | High | 8.1 | 2018-06-01 | ipip is a Node.js module to query geolocation information for an IP or domain, based on database by ipip.net. ipip downloads data resources over HTTP, which le… |
CVE-2016-10592 | High | 8.1 | 2018-06-01 | jser-stat is a JSer.info stat library. jser-stat downloads data resources over HTTP, which leaves it vulnerable to MITM attacks. |
CVE-2016-10588 | High | 8.1 | 2018-06-01 | nw is an installer for nw.js. nw downloads zipped resources over HTTP, It may be possible to cause remote code execution (RCE) by swapping out the requested zi… |
CVE-2016-10587 | High | 8.1 | 2018-06-01 | wasdk is a toolkit for creating WebAssembly modules. wasdk downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible… |
CVE-2016-10585 | High | 8.1 | 2018-06-01 | libxl provides Node bindings for the libxl library for reading and writing excel (XLS and XLSX) spreadsheets. libxl downloads zipped resources over HTTP, which… |
CVE-2016-10583 | High | 8.1 | 2018-06-01 | closure-utils is Utilities for Closure Library based projects. closure-utils downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks… |
CVE-2016-10582 | High | 8.1 | 2018-06-01 | closurecompiler is a Closure Compiler for node.js. closurecompiler downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be… |
CVE-2016-10581 | High | 8.1 | 2018-06-01 | Steroids is PhoneGap on Steroids, providing native UI elements, multiple WebViews and enhancements for better developer productivity. steroids downloads zipped… |
CVE-2016-10580 | High | 8.1 | 2018-06-01 | nodewebkit is an installer for node-webkit. nodewebkit downloads zipped resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to… |
CVE-2016-10579 | High | 8.1 | 2018-06-01 | Chromedriver is an NPM wrapper for selenium ChromeDriver. Chromedriver before 2.26.1 downloads binary resources over HTTP, which leaves it vulnerable to MITM a… |
CVE-2016-10576 | High | 8.1 | 2018-06-01 | Fuseki server wrapper and management API in fuseki before 1.0.1 downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be pos… |
CVE-2016-10575 | High | 8.1 | 2018-06-01 | Kindlegen is a simple Node.js wrapper of the official kindlegen program. Kindlegen versions before 1.1.0 download binary resources over HTTP, which leaves it v… |
CVE-2016-10574 | High | 8.1 | 2018-06-01 | apk-parser3 is a module to extract Android Manifest info from an APK file. apk-parser3 versions before 0.1.3 download binary resources over HTTP, which leaves… |
CVE-2016-10572 | High | 8.1 | 2018-05-31 | mongodb-instance before 0.0.3 installs mongodb locally. mongodb-instance downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It m… |
CVE-2016-10571 | High | 8.1 | 2018-05-31 | bkjs-wand is imagemagick wand support for node.js and backendjs bkjs-wand versions lower than 0.3.2 download binary resources over HTTP, which leaves it vulner… |
CVE-2016-10569 | High | 8.1 | 2018-05-31 | embedza is a module to create HTML snippets/embeds from URLs using info from oEmbed, Open Graph, meta tags. embedza versions below 1.2.4 download JavaScript re… |
CVE-2016-10565 | High | 8.1 | 2018-05-31 | operadriver is a Opera Driver for Selenium. operadriver versions below 0.2.3 download binary resources over HTTP, which leaves it vulnerable to MITM attacks. I… |
CVE-2016-10564 | High | 8.1 | 2018-05-31 | apk-parser is a tool to extract Android Manifest info from an APK file. apk-parser versions below 0.1.6 download binary resources over HTTP, which leaves it vu… |
CVE-2016-10563 | High | 8.1 | 2018-05-31 | During the installation process, the go-ipfs-deps module before 0.4.4 insecurely downloads resources over HTTP. This allows for a MITM attack to compromise the… |
CVE-2016-10562 | High | 8.1 | 2018-05-31 | iedriver is an NPM wrapper for Selenium IEDriver. iedriver versions below 3.0.0 download binary resources over HTTP, which leaves the module vulnerable to MITM… |
CVE-2016-10561 | Medium | 5.3 | 2018-05-31 | Bitty is a development web server tool that functions similar to `python -m SimpleHTTPServer`. Version 0.2.10 has a directory traversal vulnerability that is e… |
CVE-2016-10560 | High | 8.1 | 2018-05-31 | galenframework-cli is the node wrapper for the Galen Framework. galenframework-cli below 2.3.1 download binary resources over HTTP, which leaves it vulnerable… |
CVE-2016-10557 | High | 8.1 | 2018-05-31 | appium-chromedriver is a Node.js wrapper around Chromedriver. Versions below 2.9.4 download binary resources over HTTP, which leaves the module vulnerable to M… |
CVE-2016-10555 | Medium | 6.5 | 2018-05-31 | Since "algorithm" isn't enforced in jwt.decode()in jwt-simple 0.3.0 and earlier, a malicious user could choose what algorithm is sent sent to the server. If th… |
CVE-2016-10554 | Critical | 9.8 | 2018-05-31 | sequelize is an Object-relational mapping, or a middleman to convert things from Postgres, MySQL, MariaDB, SQLite and Microsoft SQL Server into usable data for… |
CVE-2016-10553 | Critical | 9.8 | 2018-05-31 | sequelize is an Object-relational mapping, or a middleman to convert things from Postgres, MySQL, MariaDB, SQLite and Microsoft SQL Server into usable data for… |
CVE-2016-10552 | High | 7.4 | 2018-05-31 | igniteui 0.0.5 and earlier downloads JavaScript and CSS resources over insecure protocol. |
CVE-2016-10550 | Critical | 9.8 | 2018-05-31 | sequelize is an Object-relational mapping, or a middleman to convert things from Postgres, MySQL, MariaDB, SQLite and Microsoft SQL Server into usable data for… |
CVE-2016-10549 | Medium | 4.4 | 2018-05-31 | Sails is an MVC style framework for building realtime web applications. Version 0.12.7 and lower have an issue with the CORS configuration where the value of t… |
CVE-2016-10548 | Medium | 6.1 | 2018-05-31 | Arbitrary code execution is possible in reduce-css-calc node module <=1.2.4 through crafted css. This makes cross sites scripting (XSS) possible on the client… |
CVE-2016-10547 | Medium | 6.1 | 2018-05-31 | Nunjucks is a full featured templating engine for JavaScript. Versions 2.4.2 and lower have a cross site scripting (XSS) vulnerability in autoescape mode. In a… |
CVE-2016-10546 | Critical | 9.8 | 2018-05-31 | An arbitrary code injection vector was found in PouchDB 6.0.4 and lesser via the map/reduce functions used in PouchDB temporary views and design documents. The… |
CVE-2016-10544 | Medium | 5.9 | 2018-05-31 | uws is a WebSocket server library. By sending a 256mb websocket message to a uws server instance with permessage-deflate enabled, there is a possibility used c… |
CVE-2016-10543 | Medium | 5.3 | 2018-05-31 | call is an HTTP router that is primarily used by the hapi framework. There exists a bug in call versions 2.0.1-3.0.1 that does not validate empty parameters, w… |
CVE-2016-10542 | High | 7.5 | 2018-05-31 | ws is a "simple to use, blazing fast and thoroughly tested websocket client, server and console for node.js, up-to-date against RFC-6455". By sending an overly… |
CVE-2016-10541 | Critical | 9.8 | 2018-05-31 | The npm module "shell-quote" 1.6.0 and earlier cannot correctly escape ">" and "<" operator used for redirection in shell. Applications that depend on shell-qu… |
CVE-2016-10540 | High | 7.5 | 2018-05-31 | Minimatch is a minimal matching utility that works by converting glob expressions into JavaScript `RegExp` objects. The primary function, `minimatch(path, patt… |
CVE-2016-10539 | High | 7.5 | 2018-05-31 | negotiator is an HTTP content negotiator for Node.js and is used by many modules and frameworks including Express and Koa. The header for "Accept-Language", wh… |
CVE-2016-10538 | Low | 3.5 | 2018-05-31 | The package `node-cli` before 1.0.0 insecurely uses the lock_file and log_file. Both of these are temporary, but it allows the starting user to overwrite any f… |
CVE-2016-10537 | Medium | 5.4 | 2018-05-31 | backbone is a module that adds in structure to a JavaScript heavy application through key-value pairs and custom events connecting to your RESTful API through… |
CVE-2016-10536 | Medium | 5.9 | 2018-05-31 | engine.io-client is the client for engine.io, the implementation of a transport-based cross-browser/cross-device bi-directional communication layer for Socket… |
CVE-2016-10535 | Medium | 5.9 | 2018-05-31 | csrf-lite is a cross-site request forgery protection library for framework-less node sites. csrf-lite uses `===`, a fail first string comparison, instead of a… |
CVE-2016-10534 | Medium | 5.9 | 2018-05-31 | electron-packager is a command line tool that packages Electron source code into `.app` and `.exe` packages. along with Electron. The `--strict-ssl` command li… |
CVE-2016-10533 | High | 8.8 | 2018-05-31 | express-restify-mongoose is a module to easily create a flexible REST interface for mongoose models. express-restify-mongoose 2.4.2 and earlier and 3.0.X throu… |
CVE-2016-10532 | Critical | 9.8 | 2018-05-31 | console-io is a module that allows users to implement a web console in their application. A malicious user could bypass the authentication and execute any comm… |
CVE-2016-10531 | Medium | 6.1 | 2018-05-31 | marked is an application that is meant to parse and compile markdown. Due to the way that marked 0.3.5 and earlier parses input, specifically HTML entities, it… |
CVE-2016-10530 | Medium | 5.9 | 2018-05-31 | The airbrake module 0.3.8 and earlier defaults to sending environment variables over HTTP. Environment variables can often times contain secret keys and other… |
CVE-2016-10529 | High | 8.8 | 2018-05-31 | Droppy versions <3.5.0 does not perform any verification for cross-domain websocket requests. An attacker is able to make a specially crafted page that can sen… |
CVE-2016-10528 | Medium | 4.9 | 2018-05-31 | restafary is a REpresentful State Transfer API for Creating, Reading, Using, Deleting files on a server from the web. Restafary before 1.6.1 is able to set up… |
CVE-2016-10527 | High | 7.5 | 2018-05-31 | The riot-compiler version version 2.3.21 has an issue in a regex (Catastrophic Backtracking) thats make it unusable under certain conditions. |
CVE-2016-10526 | High | 8.6 | 2018-05-31 | A common setup to deploy to gh-pages on every commit via a CI system is to expose a github token to ENV and to use it directly in the auth part of the url. In… |
CVE-2016-10524 | High | 8.2 | 2018-05-31 | i18n-node-angular is a module used to interact between i18n and angular without using additional resources. A REST API endpoint that is used for development in… |
CVE-2016-10523 | High | 7.5 | 2018-05-31 | MQTT before 3.4.6 and 4.0.x before 4.0.5 allows specifically crafted MQTT packets to crash the application, making a DoS attack feasible with very little bandw… |
CVE-2016-10521 | High | 7.5 | 2018-05-31 | jshamcrest is vulnerable to regular expression denial of service (ReDoS) when certain types of user input is passed in to the emailAddress validator. |
CVE-2016-10520 | High | 7.5 | 2018-05-31 | jadedown is vulnerable to regular expression denial of service (ReDoS) when certain types of user input is passed in. |
CVE-2016-10519 | High | 7.5 | 2018-05-31 | A security issue was found in bittorrent-dht before 5.1.3 that allows someone to send a specific series of messages to a listening peer and get it to reveal in… |
CVE-2016-10518 | High | 7.5 | 2018-05-31 | A vulnerability was found in the ping functionality of the ws module before 1.0.0 which allowed clients to allocate memory by sending a ping frame. The ping fu… |
CVE-2016-10698 | High | 8.1 | 2018-05-29 | mystem-fix is a node.js wrapper for MyStem morphology text analyzer by Yandex.ru mystem-fix downloads binary resources over HTTP, which leaves it vulnerable to… |
CVE-2016-10682 | High | 8.1 | 2018-05-29 | massif is a Phantomjs fork massif downloads resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution… |
CVE-2016-10681 | High | 8.1 | 2018-05-29 | roslib-socketio - The standard ROS Javascript Library fork for add support to socket.io roslib-socketio downloads binary resources over HTTP, which leaves it v… |
CVE-2016-10680 | High | 8.1 | 2018-05-29 | adamvr-geoip-lite is a light weight native JavaScript implementation of GeoIP API from MaxMind adamvr-geoip-lite downloads geoip resources over HTTP, which lea… |
CVE-2016-10679 | High | 8.1 | 2018-05-29 | selenium-standalone-painful installs a start-selenium command line to start a standalone selenium server with chrome-driver. selenium-standalone-painful downlo… |
CVE-2016-10674 | High | 8.1 | 2018-05-29 | limbus-buildgen is a "build anywhere" build system. limbus-buildgen versions below 0.1.1 download binary resources over HTTP, which leaves it vulnerable to MIT… |
CVE-2016-10666 | High | 8.1 | 2018-05-29 | tomita-parser is a Node wrapper for Yandex Tomita Parser tomita-parser downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may… |
CVE-2016-10659 | High | 8.1 | 2018-05-29 | poco - The POCO libraries, downloads source file resources used for compilation over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to ca… |
CVE-2016-10658 | High | 8.1 | 2018-05-29 | native-opencv is the OpenCV library installed via npm native-opencv downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be… |
CVE-2016-10650 | High | 8.1 | 2018-05-29 | ntfserver is a Network Testing Framework Server. ntfserver downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible… |
CVE-2016-10635 | High | 8.1 | 2018-05-29 | broccoli-closure is a Closure compiler plugin for Broccoli. broccoli-closure before 1.3.1 downloads binary resources over HTTP, which leaves it vulnerable to M… |
CVE-2016-10627 | High | 8.1 | 2018-05-29 | scala-bin is a binary wrapper for Scala. scala-bin downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to caus… |
CVE-2016-10611 | High | 8.1 | 2018-05-29 | strider-sauce is Sauce Labs / Selenium support for Strider. strider-sauce downloads zipped resources over HTTP, which leaves it vulnerable to MITM attacks. It… |
CVE-2016-10601 | High | 8.1 | 2018-05-29 | webdrvr is a npm wrapper for Selenium Webdriver including Chromedriver / IEDriver / IOSDriver / Ghostdriver. webdrvr downloads binary resources over HTTP, whic… |