sentry@8.1.4 vulnerabilities
A realtime logging and aggregation server.
-
latest version
23.7.1
-
first published
13 years ago
-
latest version published
a year ago
-
licenses detected
- [2.0.0-RC5,10.0.0)
Direct Vulnerabilities
Known vulnerabilities in the sentry package. This does not include vulnerabilities belonging to this package’s dependencies.
Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.Vulnerability | Vulnerable Version |
---|---|
Affected versions of this package are vulnerable to Race Condition due to attributes being accessed and modified without proper synchronization. How to fix Race Condition? Upgrade |
[,8.4.1)
|
Affected versions of this package are vulnerable to Improper Authentication. An attacker with sufficient client-side exploits could retrieve a valid access token for another user during the OAuth token exchange due to incorrect credential validation. The client ID must be known and the API application must have already been authorized on the targeted user account. How to fix Improper Authentication? A fix was pushed into the |
[0,)
|
Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) due to the usage of insecure regex in How to fix Regular Expression Denial of Service (ReDoS)? Upgrade |
[,22.6.0)
|
Affected versions of this package are vulnerable to Open Redirect via the 'API Applications' feature. The issue lies in the OAuth endpoint created by the 'API Applications' feature. When an error occurs during the OAuth processing, the application redirects to the user-specified URL without any confirmation. This allows an attacker to conduct phishing attacks, or chain it with other bugs to elevate impact. How to fix Open Redirect? Upgrade |
[0,20.12.1)
|
Affected versions of this package are vulnerable to Cross-site Scripting (XSS) attacks via the Request interface. An attacker could craft a Sentry packet with a |
[8,8.8.0)
|
Affected versions of this package are vulnerable to Cross-site Scripting (XSS) attacks. During deserialization in the project selector, an attacker can inject and execute arbitrary script via the sentryapi. |
[8,8.7.0)
|