Search for packages
| purl | pkg:pypi/sickrage@9.4.62.dev1 |
| Next non-vulnerable version | None. |
| Latest non-vulnerable version | None. |
| Risk | 10.0 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-3r6f-mth3-byc3
Aliases: CVE-2021-25925 GHSA-rmp7-f2vp-3rq4 PYSEC-2021-147 |
in SiCKRAGE, versions 4.2.0 to 10.0.11.dev1 are vulnerable to Stored Cross-Site-Scripting (XSS) due to user input not being validated properly when processed by the server. Therefore, an attacker can inject arbitrary JavaScript code inside the application, and possibly steal a user’s sensitive information. |
Affected by 3 other vulnerabilities. Affected by 1 other vulnerability. |
|
VCID-fx2e-4479-z3hj
Aliases: CVE-2018-9160 GHSA-jrcv-3c5h-rh3q PYSEC-2018-101 |
SickRage before v2018.03.09-1 includes cleartext credentials in HTTP responses. |
Affected by 0 other vulnerabilities. |
|
VCID-r8xr-z1yy-nkat
Aliases: CVE-2021-25926 GHSA-x823-j7c4-vpc5 PYSEC-2021-148 |
In SiCKRAGE, versions 9.3.54.dev1 to 10.0.11.dev1 are vulnerable to Reflected Cross-Site-Scripting (XSS) due to user input not being validated properly in the `quicksearch` feature. Therefore, an attacker can steal a user's sessionID to masquerade as a victim user, to carry out any actions in the context of the user. |
Affected by 3 other vulnerabilities. Affected by 1 other vulnerability. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| This package is not known to fix vulnerabilities. | ||