GitHub Advisoryadvisory · npm

GHSA-2r5h-gh4x-8hp9 Resources Downloaded over Insecure Protocol in igniteui

LOW Published 2019-02-18 Modified 2020-08-31 Official page ↗
Aliases
CVE-2016-10552
Ecosystem
npm
Packages
igniteui
Severity
Low
Weaknesses
CWE-311
Reviewed
2020-06-16

Affected packages

• npm igniteui: <= 0.0.5 (no fix yet)

Description

Affected versions of `igniteui` download Javascript and CSS resources over an unencrypted HTTP connection. An attacker with a privileged network position can intercept and view or modify any content sent or recieved over an unencrypted HTTP connection. Recommendation The `igniteui` package has been deprecated by the package author and now exists under `ignite-ui`, which should be used in place of this package.

Related

Alias · CVE (1)

  • CVE-2016-10552 igniteui 0.0.5 and earlier downloads JavaScript and CSS resources over insecure protocol. vulnerability

Weakness · CWE (1)

  • CWE-311 Missing Encryption of Sensitive Data weakness

References