CVE-2024-45606

CVE-2024-45606 affects Sentry (self-hosted and SaaS). An authenticated user could mute alert rules across arbitrary organizations and projects using a known rule ID without membership or project permissions due to improper authorization checks. A fix was issued to scope authorization correctly; a...

CVE-2024-45606

Sentry is a developer-first error tracking and performance monitoring platform. An authenticated user can mute alert rules from arbitrary organizations and projects with a know rule ID. The user does not need to be a member of the organization or have permissions on the project. In our review, we...

GHSA-V345-W9F2-MPM5 Sentry improperly authorizes muting of alert rules

Impact An authenticated user can mute alert rules from arbitrary organizations and projects given a known given rule ID. The user does not need to be a member of the organization or have permissions on the project. In our review, we have identified no instances where alerts have been muted by...

Sentry improperly authorizes muting of alert rules

Impact An authenticated user can mute alert rules from arbitrary organizations and projects given a known given rule ID. The user does not need to be a member of the organization or have permissions on the project. In our review, we have identified no instances where alerts have been muted by...

GHSA-54M3-95J9-V89J Sentry improperly authorizes deletion of user issue alert notifications

Impact An authenticated user may delete user issue alert notifications for arbitrary users given a known alert ID. Patches A patch was issued to ensure authorization checks are properly scoped on requests to delete user alert notifications. Sentry SaaS users do not need to take any action...

Sentry improperly authorizes deletion of user issue alert notifications

Impact An authenticated user may delete user issue alert notifications for arbitrary users given a known alert ID. Patches A patch was issued to ensure authorization checks are properly scoped on requests to delete user alert notifications. Sentry SaaS users do not need to take any action...

Sentry security vulnerabilities

Sentry is a developer-oriented bug tracking and performance monitoring platform from Sentry Open Source. A security vulnerability exists in Sentry versions 23.4.0 and earlier and 24.8.0 and earlier, which stems from the fact that an authenticated user can use a known rule ID to mute the alert rul...

Sentry security vulnerabilities

Sentry is a developer-oriented bug tracking and performance monitoring platform from Sentry Open Source. A security vulnerability exists in Sentry versions 23.9.0 and earlier and 24.8.0 and earlier, which stems from an authenticated user being able to remove alert notifications from any user with...

CVE-2024-45605: Authorization Bypass Through User-Controlled Key

Sentry is a developer-first error tracking and performance monitoring platform. An authenticated user delete the user issue alert notifications for arbitrary users given a know alert ID. A patch was issued to ensure authorization checks are properly scoped on requests to delete user alert...

CVE-2024-45606: Authorization Bypass Through User-Controlled Key

Sentry is a developer-first error tracking and performance monitoring platform. An authenticated user can mute alert rules from arbitrary organizations and projects with a know rule ID. The user does not need to be a member of the organization or have permissions on the project. In our review, we...

Sentry Switched CDU Bruteforce Login Utility

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Sentry Switched CDU Bruteforce Login Utility', 'Description' = % This module scans for ServerTech's Sentry Switched CDU Cabinet Power Distributio...

Cross Site Scripting (XSS)

Sentry is vulnerable to Cross Site Scripting XSS. The vulnerability is due to lack of input sanitization for payloads sent from Integration platform integrations, which allows arbitrary HTML tags to be stored and rendered on the Issues page...

openSUSE 15 Security Update : python-sentry-sdk (openSUSE-SU-2024:0214-1)

The remote openSUSE 15 host has a package installed that is affected by a vulnerability as referenced in the openSUSE- SU-2024:0214-1 advisory. - CVE-2024-40647: Do not leak environment variables to child processes. bsc1228128 Tenable has extracted the preceding description block directly from th...

CVE-2024-41656

Sentry is an error tracking and performance monitoring platform. Starting in version 10.0.0 and prior to version 24.7.1, an unsanitized payload sent by an Integration platform integration allows storing arbitrary HTML tags on the Sentry side with the subsequent rendering them on the Issues page...

CVE-2024-41656 Sentry vulnerable to stored Cross-Site Scripting (XSS)

Sentry is an error tracking and performance monitoring platform. Starting in version 10.0.0 and prior to version 24.7.1, an unsanitized payload sent by an Integration platform integration allows storing arbitrary HTML tags on the Sentry side with the subsequent rendering them on the Issues page...

CVE-2024-41656 Sentry vulnerable to stored Cross-Site Scripting (XSS)

Sentry is an error tracking and performance monitoring platform. Starting in version 10.0.0 and prior to version 24.7.1, an unsanitized payload sent by an Integration platform integration allows storing arbitrary HTML tags on the Sentry side with the subsequent rendering them on the Issues page...

CVE-2024-41656

Sentry vulnerability CVE-2024-41656 affects self-hosted Sentry versions 10.0.0 to before 24.7.1, where an unsanitized payload from an Integration platform could store arbitrary HTML that is later rendered on the Issues page. The issue is mitigated for Sentry SaaS (already patched) and on sentry.i...

CVE-2024-41656 Sentry vulnerable to stored Cross-Site Scripting (XSS)

Sentry is an error tracking and performance monitoring platform. Starting in version 10.0.0 and prior to version 24.7.1, an unsanitized payload sent by an Integration platform integration allows storing arbitrary HTML tags on the Sentry side with the subsequent rendering them on the Issues page...

CVE-2024-41656

Sentry is an error tracking and performance monitoring platform. Starting in version 10.0.0 and prior to version 24.7.1, an unsanitized payload sent by an Integration platform integration allows storing arbitrary HTML tags on the Sentry side with the subsequent rendering them on the Issues page...

cbs-sentry-dingding (1.0.24), cbs-sentry-qyweixin (1.0.1) +47 more potentially affected by CVE-2024-41656 via sentry (20.8.0)

sentry PYPI version 20.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on sentry and may be impacted: - cbs-sentry-dingding 1.0.24 - cbs-sentry-qyweixin 1.0.1 - csnp =0.0.5, =1.0.0, =0.2.4, =1.0.0, =0.1.0, =0.4.0, =0.1.0, =0.2.0 and more Source cves:...