CWE-310: Cryptographic Issues, page 4

Weaknesses in this category are related to the design and implementation of data confidentiality and integrity. Frequently these deal with the use of encoding techniques, encryption libraries, and hashing algorithms. The weaknesses in this category could lead to a degradation of the quality data if they are not addressed.

What the weakness is: CWE-310 at MITRE

1. 8.1CVE-2016-10656EPSS 1.7%2018-06-04

   qbs is a build tool that helps simplify the build process for developing projects across multiple platforms. qbs downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code exec…

2. 8.1CVE-2016-10655EPSS 1.7%2018-06-04

   The clang-extra module installs LLVM's clang-extra tools. clang-extra downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested r…

3. 8.1CVE-2016-10654EPSS 0.5%2018-06-04

   sfml downloads resources over HTTP, which leaves it vulnerable to MITM attacks.

4. 8.1CVE-2016-10653EPSS 1.7%2018-06-04

   xd-testing is a testing library for cross-device (XD) web applications. xd-testing downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out th…

5. 8.1CVE-2016-10652EPSS 0.5%2018-06-04

   prebuild-lwip is a module for comprehensive, fast, and simple image processing and manipulation. prebuild-lwip downloads resources over HTTP, which leaves it vulnerable to MITM attacks.

6. 8.1CVE-2016-10651EPSS 1.7%2018-06-04

   webdriver-launcher is a Node.js Selenium Webdriver Launcher. webdriver-launcher downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the r…

7. 8.1CVE-2016-10649EPSS 2.1%2018-06-04

   frames-compiler downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attack…

8. 8.1CVE-2016-10648EPSS 1.7%2018-06-04

   marionette-socket-host is a marionette-js-runner host for sending actions over a socket. marionette-socket-host downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execu…

9. 8.1CVE-2016-10647EPSS 1.7%2018-06-04

   node-air-sdk is an AIR SDK for nodejs. node-air-sdk downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an atta…

10. 8.1CVE-2016-10646EPSS 1.7%2018-06-04

    resourcehacker is a Node wrapper of Resource Hacker (windows executable resource editor). resourcehacker downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (R…

11. 8.1CVE-2016-10645EPSS 1.7%2018-06-04

    grunt-images is a grunt plugin for processing images. grunt-images downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested bina…

12. 8.1CVE-2016-10644EPSS 1.7%2018-06-04

    slimerjs-edge is a npm wrapper for installing the bleeding edge version of slimerjs. slimerjs-edge downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by…

13. 8.1CVE-2016-10643EPSS 1.7%2018-06-04

    jstestdriver is a wrapper for Google's jstestdriver. jstestdriver downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binar…

14. 8.1CVE-2016-10642EPSS 2.1%2018-06-04

    cmake installs the cmake x86 linux binaries. cmake downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attac…

15. 8.1CVE-2016-10641EPSS 0.6%2018-06-04

    node-bsdiff-android downloads resources over HTTP, which leaves it vulnerable to MITM attacks.

16. 8.1CVE-2016-10640EPSS 1.7%2018-06-04

    node-thulac is a node binding for thulac. node-thulac downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an at…

17. 8.1CVE-2016-10639EPSS 1.7%2018-06-04

    redis-srvr is a npm wrapper for redis-server. redis-srvr downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an…

18. 8.1CVE-2016-10638EPSS 1.7%2018-06-04

    js-given is a JavaScript frontend to jgiven. js-given downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an at…

19. 8.1CVE-2016-10637EPSS 1.7%2018-06-04

    haxe-dev is a cross-platform toolkit. haxe-dev downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker …

20. 8.1CVE-2016-10636EPSS 1.7%2018-06-04

    grunt-ccompiler is a Closure Compiler Grunt Plugin. grunt-ccompiler downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested bin…

21. 7.5CVE-2016-1000343EPSS 3.3%2018-06-04

    In the Bouncy Castle JCE Provider version 1.55 and earlier the DSA key pair generator generates a weak private key if used with default values. If the JCA key pair generator is not explicitly initialised with DSA parameters, 1.55 and earli…

22. 5.3CVE-2016-1000339EPSS 2.7%2018-06-04

    In the Bouncy Castle JCE Provider version 1.55 and earlier the primary engine class used for AES was AESFastEngine. Due to the highly table driven approach used in the algorithm it turns out that if the data channel on the CPU can be monit…

23. 8.1CVE-2016-10634EPSS 1.7%2018-06-01

    scala-standalone-bin is a Binary wrapper for ScalaJS. scala-standalone-bin downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the reques…

24. 8.1CVE-2016-10633EPSS 1.7%2018-06-01

    dwebp-bin is a dwebp node.js wrapper that convert WebP into PNG. dwebp-bin downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the reques…

25. 8.1CVE-2016-10632EPSS 1.7%2018-06-01

    apk-parser2 is a module which extracts Android Manifest info from an APK file. apk-parser2 downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swappin…

26. 8.1CVE-2016-10631EPSS 1.7%2018-06-01

    jvminstall is a module for downloading and unpacking jvm to local system. jvminstall downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out …

27. 5.9CVE-2016-10630EPSS 0.5%2018-06-01

    install-g-test downloads resources over HTTP, which leaves it vulnerable to MITM attacks.

28. 8.1CVE-2016-10629EPSS 1.7%2018-06-01

    nw-with-arm is a NW Installer including ARM-Build. nw-with-arm downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary w…

29. 8.1CVE-2016-10628EPSS 2.1%2018-06-01

    selenium-wrapper is a selenium server wrapper, including installation and chrome webdriver. selenium-wrapper downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code executio…

30. 8.1CVE-2016-10626EPSS 1.7%2018-06-01

    mystem3 is a NodeJS wrapper for the Yandex MyStem 3. mystem3 downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary wit…

31. 8.1CVE-2016-10625EPSS 1.7%2018-06-01

    headless-browser-lite is a minimal npm installer for phantomjs and slimerjs with no external dependencies. headless-browser-lite downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause …

32. 8.1CVE-2016-10624EPSS 2.1%2018-06-01

    selenium-chromedriver is a simple utility for downloading the Selenium Webdriver for Google Chrome selenium-chromedriver downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote c…

33. 8.1CVE-2016-10623EPSS 1.7%2018-06-01

    macaca-chromedriver-zxa is a Node.js wrapper for the selenium chromedriver. macaca-chromedriver-zxa downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) b…

34. 8.1CVE-2016-10622EPSS 2.0%2018-06-01

    nodeschnaps is a NodeJS compatibility layer for Java (Rhino). nodeschnaps downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the request…

35. 8.1CVE-2016-10621EPSS 1.7%2018-06-01

    fibjs is a runtime for javascript applictions built on google v8 JS. fibjs downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the reques…

36. 8.1CVE-2016-10620EPSS 1.7%2018-06-01

    atom-node-module-installer installs node modules for atom-shell applications. atom-node-module-installer binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swa…

37. 8.1CVE-2016-10619EPSS 0.5%2018-06-01

    pennyworth is a natural language templating engine. pennyworth downloads data resources over HTTP, which leaves it vulnerable to MITM attacks.

38. 8.1CVE-2016-10618EPSS 0.6%2018-06-01

    node-browser is a wrapper webdriver by nodejs. node-browser downloads resources over HTTP, which leaves it vulnerable to MITM attacks.

39. 8.1CVE-2016-10617EPSS 1.7%2018-06-01

    box2d-native downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker …

40. 8.1CVE-2016-10616EPSS 0.5%2018-06-01

    openframe-image is an Openframe extension which adds support for images via fbi. openframe-image downloads data resources over HTTP, which leaves it vulnerable to MITM attacks.

41. 8.1CVE-2016-10615EPSS 1.7%2018-06-01

    curses is bindings for the native curses library, a full featured console IO library. curses downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapp…

42. 8.1CVE-2016-10614EPSS 1.7%2018-06-01

    httpsync is a port of libcurl to node.js. httpsync downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attac…

43. 5.9CVE-2016-10613EPSS 0.5%2018-06-01

    bionode-sra is a Node.js wrapper for SRA Toolkit. bionode-sra downloads data resources over HTTP, which leaves it vulnerable to MITM attacks.

44. 8.1CVE-2016-10612EPSS 1.7%2018-06-01

    dalek-browser-ie-canary is Internet Explorer bindings for DalekJS. dalek-browser-ie-canary downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swappin…

45. 8.1CVE-2016-10610EPSS 0.5%2018-06-01

    unicode-json is a unicode lookup table. unicode-json before 2.0.0 downloads data resources over HTTP, which leaves it vulnerable to MITM attacks.

46. 8.1CVE-2016-10609EPSS 2.0%2018-06-01

    chromedriver126 is chromedriver version 1.26 for linux OS. chromedriver126 downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the reques…

47. 7.5CVE-2016-10608EPSS 1.6%2018-06-01

    robot-js is a module for native system automation for node.js. robot-js downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested…

48. 8.1CVE-2016-10607EPSS 1.7%2018-06-01

    openframe-glsviewer is a Openframe extension which adds support for shaders via glslViewer. openframe-glsviewer downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execu…

49. 8.1CVE-2016-10606EPSS 1.7%2018-06-01

    grunt-webdriver-qunit is a grunt plugin to run qunit with webdriver in grunt grunt-webdriver-qunit downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by…

50. 8.1CVE-2016-10605EPSS 1.7%2018-06-01

    dalek-browser-ie is Internet Explorer bindings for DalekJS. dalek-browser-ie downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requ…