CVE-2016-10542

ws is a "simple to use, blazing fast and thoroughly tested websocket client, server and console for node.js, up-to-date against RFC-6455". By sending an overly long websocket payload to a ws server, it is possible to crash the node process. This affects ws 1.1.0 and earlier...

CVE-2016-10542

The CVE-2016-10542 issue affects the node.js ws websocket library (versions up to 1.1.0). The vulnerability allows a Denial of Service by sending an overly large payload, crashing the node process. Public documentation from the connected sources confirms the root cause is an insufficient payload ...

CVE-2016-10542

ws is a "simple to use, blazing fast and thoroughly tested websocket client, server and console for node.js, up-to-date against RFC-6455". By sending an overly long websocket payload to a ws server, it is possible to crash the node process. This affects ws 1.1.0 and earlier...

CVE-2016-10544

The CVE affects uws (WebSocket server library). A crafted 256 MB websocket message with permessage-deflate enabled can be compressed then uncompressed to exceed V8’s maximum string size during processing, causing the node process to crash. Affected versions are 0.10.0 through 0.10.8. The issue ar...

CVE-2016-10544

uws is a WebSocket server library. By sending a 256mb websocket message to a uws server instance with permessage-deflate enabled, there is a possibility used compression will shrink said 256mb down to less than 16mb of websocket payload which passes the length check of 16mb payload. This data wil...

CVE-2016-10529

Droppy versions 3.5.0 does not perform any verification for cross-domain websocket requests. An attacker is able to make a specially crafted page that can send requests as the context of the currently logged in user. For example this means the malicious user could add a new admin account under hi...

CVE-2016-10544

uws is a WebSocket server library. By sending a 256mb websocket message to a uws server instance with permessage-deflate enabled, there is a possibility used compression will shrink said 256mb down to less than 16mb of websocket payload which passes the length check of 16mb payload. This data wil...

CVE-2016-10529: Cross-Site Request Forgery (CSRF)

Droppy versions 3.5.0 does not perform any verification for cross-domain websocket requests. An attacker is able to make a specially crafted page that can send requests as the context of the currently logged in user. For example this means the malicious user could add a new admin account under hi...

CVE-2016-10532: Improper Authentication

console-io is a module that allows users to implement a web console in their application. A malicious user could bypass the authentication and execute any command that the user who is running the console-io application 2.2.13 and earlier is able to run. This means that if console-io was running...

PT-2018-4709

Name of the Vulnerable Software and Affected Versions Droppy versions prior to 3.5.0 Description The issue concerns a lack of verification for cross-domain websocket requests. This allows an attacker to create a specially crafted page that can send requests on behalf of the currently logged-in...

CVE-2016-10544: Uncontrolled Resource Consumption

uws is a WebSocket server library. By sending a 256mb websocket message to a uws server instance with permessage-deflate enabled, there is a possibility used compression will shrink said 256mb down to less than 16mb of websocket payload which passes the length check of 16mb payload. This data wil...

PT-2018-4723

Name of the Vulnerable Software and Affected Versions uws versions 0.10.0 through 0.10.8 Description The issue arises when a WebSocket server instance with permessage-deflate enabled receives a large WebSocket message. If a 256MB WebSocket message is sent, the compression may shrink it to less th...

CVE-2016-10542: Uncontrolled Resource Consumption

ws is a "simple to use, blazing fast and thoroughly tested websocket client, server and console for node.js, up-to-date against RFC-6455". By sending an overly long websocket payload to a ws server, it is possible to crash the node process. This affects ws 1.1.0 and earlier...

PT-2018-4721

Name of the Vulnerable Software and Affected Versions ws versions 1.1.0 and earlier Description The issue allows an attacker to crash the node process by sending an overly long websocket payload to a ws server. This is due to the affected versions of ws not appropriately limiting the size of...

CVE-2016-10542

creationtimestamp| type| source ---|---|--- 2018-05-29 15:50:33+00:00| seen| https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/dos/http/wsdos.rb 2025-10-23 21:12:58+00:00| seen| MISP/a9d21043-f825-4bac-8d2b-56fb9e8343e7 2026-09-08 06:47:02+00:00| seen|...

Pivotal Spring Java Framework < 5.0 - Remote Code Execution Exploit

Exploit for java platform in category web applications Exploit Title: Pivotal Spring Java Framework Vendor Homepage: https://pivotal.io/agile/press-release/pivotal-releases-spring-framework-for-modern-java-application-development CVE: CVE: CVE-2018-1270 Version: = 5.0.x Description: By connecting...

Pivotal Spring Java Framework 5.0.x Remote Code Execution

Exploit Title: Pivotal Spring Java Framework Vendor Homepage: https://pivotal.io/agile/press-release/pivotal-releases-spring-framework-for-modern-java-application-development CVE: CVE: CVE-2018-1270 Version: = 5.0.x Description: By connecting to spring STOMP, and putting the key for "selector"...

Martem TELEM-GW6/GWM Cross-Site Scripting Vulnerability

Martem specializes in providing remote control systems for monitoring and controlling distribution networks, and its customers include distribution companies as well as industrial and transportation companies that own their own power grids. A cross-site scripting vulnerability exists in Martem...

WebSocket Live Chat Cross Site Scripting

Exploit Title: WebSocket Live Chat - Cross-Site Scripting Date: 2018-05-22 Exploit Author: Alireza Norkazemi Vendor Homepage: https://codecanyon.net/item/websocket-live-chat-instant-messaging-php/16545798?srank=1 POC : 1 Create your account and click setting icon and go to profile 2 Put this...

WebSocket Live Chat - Cross-Site Scripting Vulnerability

Exploit for php platform in category web applications Exploit Title: WebSocket Live Chat - Cross-Site Scripting Exploit Author: Alireza Norkazemi Vendor Homepage: https://codecanyon.net/item/websocket-live-chat-instant-messaging-php/16545798?srank=1 POC : 1 Create your account and click setting...