contribsys vulnerabilities

Products

• sidekiq 6
• faktory 3

Latest contribsys CVEs

Newest publication first

1. CVE-2026-63403 Faktory: Unrecovered panic in command handlers allows full-server denial of service

   Published 2026-08-25

   High·CVSS 8.7 EPSS 0.45%

   Faktory is a language-agnostic background job server. In versions prior to 1.10.0, the server is vulnerable to an unauthenticated denial of service in which a single malformed command crashes the entire process. Its wire protocol is line-based, and several command handlers slice...

2. CVE-2026-63404 Faktory: Insecure predictable /tmp/redis.conf enables local Redis config hijack (network exposure / root RCE primitive)

   Published 2026-08-25

   High·CVSS 7.3 EPSS 0.16%

   Faktory is a language-agnostic background job server. In versions prior to 1.10.0, the embedded Redis bootstrapper is vulnerable to an insecure temporary file flaw that lets a local unprivileged user hijack the Redis configuration and escalate to root. It writes its startup confi...

3. CVE-2023-46951 Cross Site Scripting vulnerability in Contribsys Sidekiq v.6.5.8 allows a remote attacker to obtain sensitive information via a crafted payload to the uniquejobs function.

   Published 2024-03-01

   Medium·CVSS 6.1 EPSS 0.55%

   Cross Site Scripting vulnerability in Contribsys Sidekiq v.6.5.8 allows a remote attacker to obtain sensitive information via a crafted payload to the uniquejobs function.

4. CVE-2024-25122 Cross-site Scripting sidekiq-unique-jobs UI server vulnerability

   Published 2024-02-13

   Medium·CVSS 6.1 EPSS 0.53% PoC

   sidekiq-unique-jobs is an open source project which prevents simultaneous Sidekiq jobs with the same unique arguments to run. Specially crafted GET request parameters handled by any of the following endpoints of sidekiq-unique-jobs' "admin" web UI, allow a super-user attacker, or...

5. CVE-2023-37279 Faktory Web Dashboard can lead to denial of service(DOS) via malicious user input

   Published 2023-09-20

   High·CVSS 7.5 EPSS 0.92%

   Faktory is a language-agnostic persistent background job server. Prior to version 1.8.0, the Faktory web dashboard can suffer from denial of service by a crafted malicious url query param days. The vulnerability is related to how the backend reads the days URL query parameter in...

6. CVE-2023-26141 sidekiq Denial of Service vulnerability

   Published 2023-09-14

   Medium·CVSS 4.9 EPSS 0.94% PoC

   Versions of the package sidekiq before 7.1.3 are vulnerable to Denial of Service (DoS) due to insufficient checks in the dashboard-charts.js file. An attacker can exploit this vulnerability by manipulating the localStorage value which will cause excessive polling requests.

7. CVE-2023-1892 Cross-site Scripting (XSS) - Reflected in sidekiq/sidekiq

   Published 2023-04-05

   Critical·CVSS 9.6 EPSS 2.7% PoC

   Cross-site Scripting (XSS) - Reflected in GitHub repository sidekiq/sidekiq prior to 7.0.8.

8. CVE-2022-23837 Denial of service in sidekiq

   Published 2022-01-21

   High·CVSS 7.5 EPSS 5.2% PoC

   In api.rb in Sidekiq before 5.2.10 and 6.4.0, there is no limit on the number of days when requesting stats for the graph. This overloads the system, affecting the Web UI, and makes it unavailable to users.

9. CVE-2021-30151 Cross-site Scripting in Sidekiq

   Published 2021-04-06

   Medium·CVSS 6.1 EPSS 4.2%

   Sidekiq through 5.1.3 and 6.x through 6.2.0 allows XSS via the queue name of the live-poll feature when Internet Explorer is used.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.