CVE-2016-10664
- State
- Published
- Severity
- Not scored
- Published
- Jun 4, 2018
- Updated
- Sep 16, 2024
- Reserved
- Oct 29, 2017
Description
mystem is a Node.js wrapper for MyStem morphology text analyzer by Yandex.ru mystem downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.
Scores
The record has no CVSS score.
Weaknesses
- CWE-311 Missing Encryption of Sensitive Data (CWE-311)
Affected Products
| Product | Versions |
|---|---|
mystem node moduleHackerOne |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.