CVE-2016-10610 Downloads Resources over HTTP in unicode-json
HighCVSS 8.1
EPSS 0.53%
- Published
- Updated
- Exploit status
- No public exploit known
Description
unicode-json is a unicode lookup table. unicode-json before 2.0.0 downloads data resources over HTTP, which leaves it vulnerable to MITM attacks.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| npm unicode-json(npm) | < 2.0.0 | 2.0.0 |
| unicode-json | < 2.0.0 | 2.0.0 |
| HackerOne unicode-json node module | = < 2.0.0 | No fix listed |
References
- nvd.nist.gov third-party-advisory
- github.com
- www.npmjs.com
- nodesecurity.io third-party-advisory