{"id":"CVE-2016-1000224","aliases":[],"url":"https://o3.security/vulnerability/CVE-2016-1000224","summary":"Insecure Defaults Leads to Potential MITM in ezseed-transmission","details":"Affected versions of `ezseed-transmission` download and run a script over an HTTP connection.\n\nAn attacker in a privileged network position could launch a Man-in-the-Middle attack and intercept the script, replacing it with malicious code, completely compromising the system running `ezseed-transmission`.\n\n\n\n## Recommendation\n\nUpdate to version 0.0.15 or later.","published":"2020-09-01T15:26:35Z","modified":"2023-11-08T03:58:07.413368Z","cvss":{"score":4.2,"severity":"MEDIUM","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"npm","name":"ezseed-transmission","fixedVersion":"0.0.15"}],"fix":null,"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2016-1000224"},{"type":"WEB","url":"https://snyk.io/vuln/npm:ezseed-transmission:20160729"},{"type":"WEB","url":"https://www.npmjs.com/advisories/114"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2023-11-08T03:58:07.413368Z"}}