Description
geoip-lite-country is a stripped down version of geoip-lite, supporting only country lookup. geoip-lite-country before 1.1.4 downloads data resources over HTTP, which leaves it vulnerable to MITM attacks.
Remediation
References
https://nodesecurity.io/advisories/183
Related Vulnerabilities
CVE-2019-16762 Vulnerability in npm package slpjs
CVE-2020-1935 Vulnerability in maven package org.apache.tomcat.embed:tomcat-embed-core
CVE-2018-1000865 Vulnerability in maven package org.kohsuke:groovy-sandbox
CVE-2022-45392 Vulnerability in maven package io.jenkins.plugins:cavisson-ns-nd-integration
CVE-2020-6458 Vulnerability in maven package org.webjars.npm:electron