CVE-2024-9410 Ada.cx SSRF via Sentry Misconfiguration

Ada.cx's Sentry configuration allowed for blind server-side request forgeries SSRF through the use of a data scraping endpoint...

PT-2024-39615 · Ada.Cx · Ada.Cx

Name of the Vulnerable Software and Affected Versions: Ada.cx affected versions not specified Description: The issue concerns a blind server-side request forgery SSRF vulnerability in Ada.cx's Sentry configuration. This vulnerability is exploited through a data scraping endpoint, allowing for SSR...

CVE-2024-9410: Server-Side Request Forgery (SSRF)

Ada.cx's Sentry configuration allowed for blind server-side request forgeries SSRF through the use of a data scraping endpoint...

GHSA-593M-55HH-J8GV Sentry SDK Prototype Pollution gadget in JavaScript SDKs

Impact In case a Prototype Pollution vulnerability is present in a user's application or bundled libraries, the Sentry SDK could potentially serve as a gadget to exploit that vulnerability. The exploitability depends on the specific details of the underlying Prototype Pollution issue. !NOTE This...

@gambalabs/sentry-nuxt (>=8.31.1, <=8.32.0), @globalbrain/sefirot (3.40.0) +31 more potentially affected by unknown CVE via @sentry/browser (>=8.0.0-alpha.2, <=8.32.0)

@sentry/browser NPM version =8.0.0-alpha.2, =8.31.1, =7.0.0, =8.9.0, =1.0.386-leo-ron-885-experimental.13, =0.0.1, =0.1.0, =8.0.0-alpha.2, =8.0.0-alpha.2, =8.0.0-alpha.2, =1.0.0-beta.1, =5.0.0-beta.0, =8.0.0-alpha.2, =8.0.0-alpha.2, =8.32.0 and more Source cves: unknown CVE Source advisory:...

@1d/analytics (>=3.0.1, <=3.0.4), @adamduren/sentry-remix (>=7.86.0-vercel-patch.1, <=7.86.0) +229 more potentially affected by unknown CVE via @sentry/browser (>=7.0.0-alpha.0, <=7.119.0)

@sentry/browser NPM version =7.0.0-alpha.0, =3.0.1, =7.86.0-vercel-patch.1, =1.16.23-1, =1.0.15, =0.0.0-dev.1739244769735, =1.0.0, =0.17.7-ludo.13, =0.1.1, =0.1.1, =0.1.1, =0.1.1, =0.1.1, =0.3.1-alpha.2 - @canva/app-ui-kit 4.0.0 and more Source cves: unknown CVE Source advisory:...

@1d/analytics (>=3.0.1, <=3.0.4), @adamduren/sentry-remix (>=7.86.0-vercel-patch.1, <=7.86.0) +229 more potentially affected by unknown CVE via @sentry/browser (>=7.0.0-alpha.0, <=7.119.0)

@sentry/browser NPM version =7.0.0-alpha.0, =3.0.1, =7.86.0-vercel-patch.1, =1.16.23-1, =1.0.15, =0.0.0-dev.1739244769735, =1.0.0, =0.17.7-ludo.13, =0.1.1, =0.1.1, =0.1.1, =0.1.1, =0.1.1, =0.3.1-alpha.2 - @canva/app-ui-kit 4.0.0 and more Source cves: unknown CVE Source advisory: GHSA-593M-55HH-J8...

@gambalabs/sentry-nuxt (>=8.31.1, <=8.32.0), @globalbrain/sefirot (3.40.0) +31 more potentially affected by unknown CVE via @sentry/browser (>=8.0.0-alpha.2, <=8.32.0)

@sentry/browser NPM version =8.0.0-alpha.2, =8.31.1, =7.0.0, =8.9.0, =1.0.386-leo-ron-885-experimental.13, =0.0.1, =0.1.0, =8.0.0-alpha.2, =8.0.0-alpha.2, =8.0.0-alpha.2, =1.0.0-beta.1, =5.0.0-beta.0, =8.0.0-alpha.2, =8.0.0-alpha.2, =8.32.0 and more Source cves: unknown CVE Source advisory:...

PT-2024-40093

Name of the Vulnerable Software and Affected Versions: Sentry JavaScript SDK versions prior to 7.119.1 Sentry JavaScript SDK versions prior to 8.33.0 Description: The Sentry SDK can potentially serve as a gadget to exploit a Prototype Pollution vulnerability present in a user's application or...

Authorization Bypass

Sentry is vulnerable to Authorization Bypass. The vulnerability is due to improper scoping of authorization checks on requests to mute alert rules, which allows authenticated users to mute alerts without being members of the organization or having the required permissions on the project...

CVE-2024-45605

Sentry is a developer-first error tracking and performance monitoring platform. An authenticated user delete the user issue alert notifications for arbitrary users given a know alert ID. A patch was issued to ensure authorization checks are properly scoped on requests to delete user alert...

CVE-2024-45606

Sentry is a developer-first error tracking and performance monitoring platform. An authenticated user can mute alert rules from arbitrary organizations and projects with a know rule ID. The user does not need to be a member of the organization or have permissions on the project. In our review, we...

CVE-2024-45605

Sentry is a developer-first error tracking and performance monitoring platform. An authenticated user delete the user issue alert notifications for arbitrary users given a know alert ID. A patch was issued to ensure authorization checks are properly scoped on requests to delete user alert...

CVE-2024-45605 Improper authorization on deletion of user issue alert notifications in sentry

Sentry is a developer-first error tracking and performance monitoring platform. An authenticated user delete the user issue alert notifications for arbitrary users given a know alert ID. A patch was issued to ensure authorization checks are properly scoped on requests to delete user alert...

CVE-2024-45605

Sentry vulnerability CVE-2024-45605: Improper authorization allows an authenticated user to delete user issue alert notifications for arbitrary users when they know an alert ID. The issue is mitigated by a patch that scopes authorization checks on delete requests; affected deployments need to upg...

CVE-2024-45605 Improper authorization on deletion of user issue alert notifications in sentry

Sentry is a developer-first error tracking and performance monitoring platform. An authenticated user delete the user issue alert notifications for arbitrary users given a know alert ID. A patch was issued to ensure authorization checks are properly scoped on requests to delete user alert...

CVE-2024-45605 Improper authorization on deletion of user issue alert notifications in sentry

Sentry is a developer-first error tracking and performance monitoring platform. An authenticated user delete the user issue alert notifications for arbitrary users given a know alert ID. A patch was issued to ensure authorization checks are properly scoped on requests to delete user alert...

CVE-2024-45606 Improper authorization on muting of alert rules in sentry

Sentry is a developer-first error tracking and performance monitoring platform. An authenticated user can mute alert rules from arbitrary organizations and projects with a know rule ID. The user does not need to be a member of the organization or have permissions on the project. In our review, we...

CVE-2024-45606 Improper authorization on muting of alert rules in sentry

Sentry is a developer-first error tracking and performance monitoring platform. An authenticated user can mute alert rules from arbitrary organizations and projects with a know rule ID. The user does not need to be a member of the organization or have permissions on the project. In our review, we...

CVE-2024-45606 Improper authorization on muting of alert rules in sentry

Sentry is a developer-first error tracking and performance monitoring platform. An authenticated user can mute alert rules from arbitrary organizations and projects with a know rule ID. The user does not need to be a member of the organization or have permissions on the project. In our review, we...