CVE-2020-7693

Incorrect handling of Upgrade header with the value websocket leads in crashing of containers hosting sockjs apps. This affects the package sockjs before 0.3.20...

Code injection

Incorrect handling of Upgrade header with the value websocket leads in crashing of containers hosting sockjs apps. This affects the package sockjs before 0.3.20...

CVE-2020-7693

Incorrect handling of Upgrade header with the value websocket leads in crashing of containers hosting sockjs apps. This affects the package sockjs before 0.3.20...

CVE-2020-7693

CVE-2020-7693 affects SockJS sockjs-node before 0.3.20. The issue is caused by improper handling of the Upgrade header with the value websocket, which can crash containers hosting SockJS apps. Severity per CVSS indicates a MEDIUM impact (availability impact = LOW). Remediation: upgrade SockJS to ...

CVE-2020-7693 Denial of Service (DoS)

Incorrect handling of Upgrade header with the value websocket leads in crashing of containers hosting sockjs apps. This affects the package sockjs before 0.3.20...

Exploit for Improper Handling of Exceptional Conditions in Sockjs_Project Sockjs

CVE-2020-7693: Meteor A demo Meteor app running the vuln...

0726react (=0.1.1), 0x0.icu.anima (=0.1.0) +12717 more potentially affected by CVE-2020-7693 via sockjs (>=0.0.4 <=0.3.19)

sockjs NPM version =0.0.4, =1.0.4, =0.1.0, =0.0.1, =0.1.0, =1.4.0, =0.1.0, =0.1.1 and more Source cves: CVE-2020-7693 Source advisory: SNYK:JS-SOCKJS-575261...

Denial of Service (DoS)

Overview sockjs is a JavaScript library for browsers that provides a WebSocket-like object. Affected versions of this package are vulnerable to Denial of Service DoS. Incorrect handling of Upgrade header with the value websocket leads in crashing of containers hosting sockjs apps. PoC by Andrew...

GitHub Security Lab: Initial websocket support for Javascript (SockJS)

This bug was reported directly to GitHub Security Lab...

CVE-2020-8823

A cross-site scripting XSS vulnerability was found in the Node.js library, sockjs. An attacker could use this vulnerability to supply a query string with script tags, which could trick a victim into executing a specially crafted JavaScript code...

Cross-site Scripting (XSS)

sockjs is vulnerable to cross-site scripting XSS. The attack exists because it does sanitize the callback parameter in lib/transport/htmlfile.js for non-alphanumeric symbols, allowing an attacker to inject malicious scripts...

CVE-2020-8823

htmlfile in lib/transport/htmlfile.js in SockJS before 0.3.0 is vulnerable to Reflected XSS via the /htmlfile c aka callback parameter...

CVE-2020-8823

htmlfile in lib/transport/htmlfile.js in SockJS before 0.3.0 is vulnerable to Reflected XSS via the /htmlfile c aka callback parameter...

Cross site scripting

htmlfile in lib/transport/htmlfile.js in SockJS before 0.3.0 is vulnerable to Reflected XSS via the /htmlfile c aka callback parameter...

CVE-2020-8823

htmlfile in lib/transport/htmlfile.js in SockJS before 0.3.0 is vulnerable to Reflected XSS via the /htmlfile c aka callback parameter...

CVE-2020-8823

SockJS contains a reflected XSS in htmlfile.js (lib/transport/htmlfile.js) exploitable via the /htmlfile callback parameter. Affected: SockJS prior to 0.3.0 (per CVE-2020-8823) with the issue described as Reflected XSS. Root cause is improper handling of non-alphanumeric characters in the callbac...

SockJS Cross-Site Scripting Vulnerability

SockJS is a browser JavaScript library that provides WebSocket-like objects. A reflective cross-site scripting vulnerability exists in htmlfile in lib/transport/htmlfile.js in versions of SockJS prior to 3.0. An attacker can exploit this vulnerability with the /htmlfile c parameter to conduct a...

Information disclosure

Evoko Home devices 1.31 through 1.37 allow remote attackers to obtain sensitive information such as usernames and password hashes via a WebSocket request, as demonstrated by the sockjs/224/uf1psgff/websocket URI at a wss:// URL...

Moderate severity vulnerability that affects org.springframework:spring-core

The Java SockJS client in Pivotal Spring Framework 4.1.x before 4.1.5 generates predictable session ids, which allows remote attackers to send messages to other sessions via unspecified vectors...

Pivotal Spring Java Framework 5.0.x Remote Code Execution

Exploit Title: Pivotal Spring Java Framework Vendor Homepage: https://pivotal.io/agile/press-release/pivotal-releases-spring-framework-for-modern-java-application-development CVE: CVE: CVE-2018-1270 Version: = 5.0.x Description: By connecting to spring STOMP, and putting the key for "selector"...