Denial of Service (DoS)

Overview sockjs is a JavaScript library for browsers that provides a WebSocket-like object. Affected versions of this package are vulnerable to Denial of Service DoS. Incorrect handling of Upgrade header with the value websocket leads in crashing of containers hosting sockjs apps. PoC by Andrew...

GitHub Security Lab: Initial websocket support for Javascript (SockJS)

This bug was reported directly to GitHub Security Lab...

CVE-2020-8823

A cross-site scripting XSS vulnerability was found in the Node.js library, sockjs. An attacker could use this vulnerability to supply a query string with script tags, which could trick a victim into executing a specially crafted JavaScript code...

Cross-site Scripting (XSS)

sockjs is vulnerable to cross-site scripting XSS. The attack exists because it does sanitize the callback parameter in lib/transport/htmlfile.js for non-alphanumeric symbols, allowing an attacker to inject malicious scripts...

CVE-2020-8823

htmlfile in lib/transport/htmlfile.js in SockJS before 0.3.0 is vulnerable to Reflected XSS via the /htmlfile c aka callback parameter...

CVE-2020-8823

htmlfile in lib/transport/htmlfile.js in SockJS before 0.3.0 is vulnerable to Reflected XSS via the /htmlfile c aka callback parameter...

CVE-2020-8823

htmlfile in lib/transport/htmlfile.js in SockJS before 0.3.0 is vulnerable to Reflected XSS via the /htmlfile c aka callback parameter...

Cross site scripting

htmlfile in lib/transport/htmlfile.js in SockJS before 0.3.0 is vulnerable to Reflected XSS via the /htmlfile c aka callback parameter...

CVE-2020-8823

htmlfile in lib/transport/htmlfile.js in SockJS before 0.3.0 is vulnerable to Reflected XSS via the /htmlfile c aka callback parameter...

CVE-2020-8823

SockJS contains a reflected XSS in htmlfile.js (lib/transport/htmlfile.js) exploitable via the /htmlfile callback parameter. Affected: SockJS prior to 0.3.0 (per CVE-2020-8823) with the issue described as Reflected XSS. Root cause is improper handling of non-alphanumeric characters in the callbac...

SockJS Cross-Site Scripting Vulnerability

SockJS is a browser JavaScript library that provides WebSocket-like objects. A reflective cross-site scripting vulnerability exists in htmlfile in lib/transport/htmlfile.js in versions of SockJS prior to 3.0. An attacker can exploit this vulnerability with the /htmlfile c parameter to conduct a...

CVE-2020-7232

Evoko Home devices 1.31 through 1.37 allow remote attackers to obtain sensitive information such as usernames and password hashes via a WebSocket request, as demonstrated by the sockjs/224/uf1psgff/websocket URI at a wss:// URL...

Information disclosure

Evoko Home devices 1.31 through 1.37 allow remote attackers to obtain sensitive information such as usernames and password hashes via a WebSocket request, as demonstrated by the sockjs/224/uf1psgff/websocket URI at a wss:// URL...

Moderate severity vulnerability that affects org.springframework:spring-core

The Java SockJS client in Pivotal Spring Framework 4.1.x before 4.1.5 generates predictable session ids, which allows remote attackers to send messages to other sessions via unspecified vectors...

Pivotal Spring Java Framework 5.0.x Remote Code Execution

Exploit Title: Pivotal Spring Java Framework Vendor Homepage: https://pivotal.io/agile/press-release/pivotal-releases-spring-framework-for-modern-java-application-development CVE: CVE: CVE-2018-1270 Version: = 5.0.x Description: By connecting to spring STOMP, and putting the key for "selector"...

Pivotal Spring Java Framework < 5.0 - Remote Code Execution Exploit

Exploit for java platform in category web applications Exploit Title: Pivotal Spring Java Framework Vendor Homepage: https://pivotal.io/agile/press-release/pivotal-releases-spring-framework-for-modern-java-application-development CVE: CVE: CVE-2018-1270 Version: = 5.0.x Description: By connecting...

Brute-force Session Guessing Attacks

sockjs-client is vulnerable to brute-force session guessing attacks. The vulnerability is due to using default random 8-character long session ID which is not robust enough to prevent the attackers from guessing the ID using the Brute-Force search...

Unspecified Vulnerability in Pivotal Software Spring Framework Java SockJS Client

Pivotal Software Spring Framework is the U.S. Pivotal Software, Inc. of a set of open source Java, Java EE application framework. The framework helps developers build high-quality applications . A security vulnerability exists in the Java SockJS client in Pivotal Software Spring Framework version...

CVE-2015-0201

The Java SockJS client in Pivotal Spring Framework 4.1.x before 4.1.5 generates predictable session ids, which allows remote attackers to send messages to other sessions via unspecified vectors...

Design/Logic Flaw

The Java SockJS client in Pivotal Spring Framework 4.1.x before 4.1.5 generates predictable session ids, which allows remote attackers to send messages to other sessions via unspecified vectors...