Homepage
About Snyk

sentry@2.0.0-Alpha1 vulnerabilities

A realtime logging and aggregation server.

Go back to all versions of this package
Report a new vulnerability Found a mistake?

Direct Vulnerabilities

Known vulnerabilities in the sentry package. This does not include vulnerabilities belonging to this package’s dependencies.

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.
Fix for free
Vulnerability Vulnerable Version
  • H
Race Condition

Affected versions of this package are vulnerable to Race Condition due to attributes being accessed and modified without proper synchronization.

How to fix Race Condition?

Upgrade sentry to version 8.4.1 or higher.

[,8.4.1)
  • M
Improper Authentication

Affected versions of this package are vulnerable to Improper Authentication. An attacker with sufficient client-side exploits could retrieve a valid access token for another user during the OAuth token exchange due to incorrect credential validation. The client ID must be known and the API application must have already been authorized on the targeted user account.

How to fix Improper Authentication?

A fix was pushed into the master branch but not yet published.

[0,)
  • M
Regular Expression Denial of Service (ReDoS)

Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) due to the usage of insecure regex in FIELD_REGEX and TAG_REGEX. Exploiting this vulnerability is possible by providing a string containing a lot of underscores.

How to fix Regular Expression Denial of Service (ReDoS)?

Upgrade sentry to version 22.6.0 or higher.

[,22.6.0)
  • M
Open Redirect

Affected versions of this package are vulnerable to Open Redirect via the 'API Applications' feature. The issue lies in the OAuth endpoint created by the 'API Applications' feature. When an error occurs during the OAuth processing, the application redirects to the user-specified URL without any confirmation. This allows an attacker to conduct phishing attacks, or chain it with other bugs to elevate impact.

How to fix Open Redirect?

Upgrade sentry to version 20.12.1 or higher.

[0,20.12.1)
  • M
Cross-site Scripting (XSS)

sentry is a realtime logging and aggregation server.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) attacks. When creating or editing a widget, user values are not escaped.

[,7.7.0)
  • M
Cross-site Scripting (XSS)

sentry is a realtime logging and aggregation server.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) attacks. The tag values were not escaped on the group details page.

[,7.4.0)
  • M
Cross-site Scripting (XSS)

sentry is a realtime logging and aggregation server.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) attacks via the project name field.

[,7.0.0)
  • H
Arbitrary Code Execution

sentry is a realtime logging and aggregation server.

Affected versions of this package are vulnerable to Arbitrary Code Execution. There was no verification on which interface was used, allowing an attacker to use an interface of their choice, and execute arbitrary code.

[,6.1.1)
  • M
Cross-site Scripting (XSS)

sentry is a realtime logging and aggregation server.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) attacks due to the lack of escaping in JQuery ajax completion dropdowns.

[,5.4.4)
  • M
Cross-site Scripting (XSS)

sentry is a realtime logging and aggregation server.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) attacks as it did not escape user input in the z function.

[,5.4.4)
Go back to all versions of this package