CVE-2024-32887

CVE-2024-32887 is a reflected XSS in Sidekiq’s Web UI where the substr parameter is echoed without encoding, enabling injection of JavaScript into responses and potential targeting of users of Sidekiq Web UI and other applications on the same domain. Affected component: Sidekiq Web UI (Ruby). Roo...

CVE-2024-32887

Sidekiq is simple, efficient background processing for Ruby. Sidekiq is reflected XSS vulnerability. The value of substr parameter is reflected in the response without any encoding, allowing an attacker to inject Javascript code into the response of the application. An attacker could exploit it t...

Sidekiq 安全漏洞

Sidekiq is a simple, efficient backend handler for Ruby from the Sidekiq open source. A security vulnerability exists in Sidekiq that stems from the presence of a cross-site scripting vulnerability...

Reflected XSS in Metrics Web Page

Reflected XSS in Sidekiq Web UI via the /metrics HTTP end-point and the substr query param: https://host/sidekiq/metrics?substr=foot%22%3E%3Cscript%20src=%22payload%22%20/%3E...

BIT-GITLAB-2023-3246 Allocation of Resources Without Limits or Throttling in GitLab

An issue has been discovered in GitLab EE/CE affecting all versions starting before 16.3.6, all versions starting from 16.4 before 16.4.2, all versions starting from 16.5 before 16.5.1 which allows an attackers to block Sidekiq job processor...

BIT-MASTODON-2022-46405

Mastodon through 4.0.2 allows attackers to cause a denial of service large Sidekiq pull queue by creating bot accounts that follow attacker-controlled accounts on certain other servers associated with a wildcard DNS A record, such that there is uncontrolled recursion of attacker-generated message...

GHSA-FHX8-5C23-X7X5 Cross Site Scripting vulnerability in Contribsys Sidekiq

Cross Site Scripting vulnerability in Contribsys Sidekiq v.6.5.8 allows a remote attacker to obtain sensitive information via a crafted URL to the filter functions...

Cross Site Scripting vulnerability in Contribsys Sidekiq

Cross Site Scripting vulnerability in Contribsys Sidekiq v.6.5.8 allows a remote attacker to obtain sensitive information via a crafted URL to the filter functions...

Cross-site Scripting (XSS)

Overview sidekiq-unique-jobs is a package containing unique jobs that were removed from sidekiq. Affected versions of this package are vulnerable to Cross-site Scripting XSS via filter functions. An attacker can obtain sensitive information from the application using this package, including...

CVE-2023-46950

Cross Site Scripting vulnerability in Contribsys Sidekiq v.6.5.8 allows a remote attacker to obtain sensitive information via a crafted URL to the filter functions...

CVE-2023-46951

Cross Site Scripting vulnerability in Contribsys Sidekiq v.6.5.8 allows a remote attacker to obtain sensitive information via a crafted payload to the uniquejobs function...

Cross site scripting

Cross Site Scripting vulnerability in Contribsys Sidekiq v.6.5.8 allows a remote attacker to obtain sensitive information via a crafted URL to the filter functions...

Cross site scripting

Cross Site Scripting vulnerability in Contribsys Sidekiq v.6.5.8 allows a remote attacker to obtain sensitive information via a crafted payload to the uniquejobs function...

CVE-2023-46950

Cross Site Scripting vulnerability in Contribsys Sidekiq v.6.5.8 allows a remote attacker to obtain sensitive information via a crafted URL to the filter functions...

CVE-2023-46950

CVE-2023-46950 affects Contribsys Sidekiq v6.5.8, with a Cross Site Scripting vulnerability that allows a remote attacker to obtain sensitive information via a crafted payload in the filter functions (and related uniquejobs context per Red Hat entries). The issue is described across multiple feed...

CVE-2023-46950

Cross Site Scripting vulnerability in Contribsys Sidekiq v.6.5.8 allows a remote attacker to obtain sensitive information via a crafted URL to the filter functions...

CVE-2023-46951

Cross Site Scripting vulnerability in Contribsys Sidekiq v.6.5.8 allows a remote attacker to obtain sensitive information via a crafted payload to the uniquejobs function...

CVE-2023-46950

Cross Site Scripting vulnerability in Contribsys Sidekiq v.6.5.8 allows a remote attacker to obtain sensitive information via a crafted URL to the filter functions...

CVE-2023-46951

Cross Site Scripting vulnerability in Contribsys Sidekiq v.6.5.8 allows a remote attacker to obtain sensitive information via a crafted payload to the uniquejobs function...

CVE-2023-46951

Cross Site Scripting vulnerability in Contribsys Sidekiq v.6.5.8 allows a remote attacker to obtain sensitive information via a crafted payload to the uniquejobs function...