TI-2023-01778 CVE-2023-1892 · GHSA-h3r8-h5qw-4r35
Cross-site Scripting (XSS) - Reflected in sidekiq/sidekiq
Priority HIGH 76
Cross-site Scripting (XSS) - Reflected in GitHub repository sidekiq/sidekiq prior to 7.0.8.
contribsys
Records9All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical1CVSS 9.0–10.0
CVSS high5CVSS 7.0–8.9
Exploited now
contribsys records in CISA KEVNo contribsys vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
6 records in Sidekiq · all components
TI-2023-25350 CVE-2023-46951 · GHSA-xfrr-fwx4-vqh9
Cross Site Scripting vulnerability in Contribsys Sidekiq v.6.5.8 allows a remote attacker…
Priority MEDIUM 60
Cross Site Scripting vulnerability in Contribsys Sidekiq v.6.5.8 allows a remote attacker to obtain sensitive information via a crafted payload to the uniquejobs function.
TI-2023-25349 CVE-2023-46950 · GHSA-fhx8-5c23-x7x5
Cross Site Scripting vulnerability in Contribsys Sidekiq v.6.5.8 allows a remote attacker…
Priority MEDIUM 60
Cross Site Scripting vulnerability in Contribsys Sidekiq v.6.5.8 allows a remote attacker to obtain sensitive information via a crafted URL to the filter functions.
TI-2023-11365 CVE-2023-26141 · GHSA-3qc2-v3hp-6cv8
Uncontrolled resource consumption in sidekiq
Priority MEDIUM 41
Versions of the package sidekiq before 7.1.3 are vulnerable to Denial of Service (DoS) due to insufficient checks in the dashboard-charts.js file.
TI-2022-07850 CVE-2022-23837 · GHSA-jrfj-98qg-qjgv
In api.rb in Sidekiq before 5.2.10 and 6.4.0, there is no limit on the number of days…
Priority MEDIUM 41
In api.rb in Sidekiq before 5.2.10 and 6.4.0, there is no limit on the number of days when requesting stats for the graph.
TI-2021-10692 CVE-2021-30151 · GHSA-grh7-935j-hg6w
Sidekiq through 5.1.3 and 6.x through 6.2.0 allows XSS via the queue name of the…
Priority LOW 34
Sidekiq through 5.1.3 and 6.x through 6.2.0 allows XSS via the queue name of the live-poll feature when Internet Explorer is used.