Skip to main content
cve.nowby Sazabi
← RubyGems
RubyGemsPackage

sidekiq

5 known vulnerabilities (2 high, 1 medium), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
5 · 2 high, 1 medium
Registry
RubyGems

Advisories 5

  • CVE-2024-32887Medium 5.5

    Reflected XSS in sidekiq

    Affected: from 7.2.0, fixed in 7.2.4.

  • Versions of the package sidekiq before 7.1.3 are vulnerable to Denial of Service (DoS) due to insufficient checks in the…

    Affected: from 7.0.0, fixed in 7.1.3; fixed in 6.5.10.

  • Cross-site Scripting (XSS) - Reflected in sidekiq/sidekiq

    Affected: from 7.0.4, fixed in 7.0.8.

  • In api.rb in Sidekiq before 5.2.10 and 6.4.0, there is no limit on the number of days when requesting stats for the graph.

    Affected: from 6.0.0, fixed in 6.4.0; fixed in 5.2.10.

  • Sidekiq through 5.1.3 and 6.x through 6.2.0 allows XSS via the queue name of the live-poll feature when Internet Explorer is used.

    Affected: fixed in 5.2.0; from 6.0.0, fixed in 6.2.1.