Basecamp
Monthly
Cross-site scripting in Trix rich text editor versions prior to 2.1.17 allows network-reachable attackers with content-insertion privileges to execute arbitrary JavaScript in victims' browser sessions. The DOMPurify sanitizer lacked a hook to explicitly block the `data-trix-serialized-attributes` attribute, enabling crafted attachment HTML to survive sanitization and fire event handlers such as `onerror` upon rendering. No CISA KEV listing was identified at time of analysis, but the fix PR publicly exposes a working test payload, materially lowering the barrier to exploitation.
Cross-site scripting in Trix editor prior to 2.1.18 allows DOM injection via unsanitized `javascript:` URIs deserialized from attacker-controlled JSON payloads during drag-and-drop operations. The vulnerable path exists exclusively in environments using the Level0InputController fallback - such as embedded WebViews lacking Input Events Level 2 support - where `StringPiece.fromJSON` applied `href` attributes from `application/x-trix-document` JSON directly to anchor elements, bypassing the DOMPurify checks that protected the HTML serialization path. No public exploit or active exploitation (CISA KEV) has been identified; the CVSS 4.0 score of 2.1 accurately reflects the constrained exploitability.
Directory traversal can occur in the Basecamp com.basecamp.bc3 application before 4.2.1 for Android, which may allow an attacker to write arbitrary files in the application's private directory. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
easymon version 1.4 and earlier contains a Cross Site Scripting (XSS) vulnerability in Endpoint where monitoring is mounted that can result in Reflected XSS that affects Firefox. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Cross-site scripting in Trix rich text editor versions prior to 2.1.17 allows network-reachable attackers with content-insertion privileges to execute arbitrary JavaScript in victims' browser sessions. The DOMPurify sanitizer lacked a hook to explicitly block the `data-trix-serialized-attributes` attribute, enabling crafted attachment HTML to survive sanitization and fire event handlers such as `onerror` upon rendering. No CISA KEV listing was identified at time of analysis, but the fix PR publicly exposes a working test payload, materially lowering the barrier to exploitation.
Cross-site scripting in Trix editor prior to 2.1.18 allows DOM injection via unsanitized `javascript:` URIs deserialized from attacker-controlled JSON payloads during drag-and-drop operations. The vulnerable path exists exclusively in environments using the Level0InputController fallback - such as embedded WebViews lacking Input Events Level 2 support - where `StringPiece.fromJSON` applied `href` attributes from `application/x-trix-document` JSON directly to anchor elements, bypassing the DOMPurify checks that protected the HTML serialization path. No public exploit or active exploitation (CISA KEV) has been identified; the CVSS 4.0 score of 2.1 accurately reflects the constrained exploitability.
Directory traversal can occur in the Basecamp com.basecamp.bc3 application before 4.2.1 for Android, which may allow an attacker to write arbitrary files in the application's private directory. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
easymon version 1.4 and earlier contains a Cross Site Scripting (XSS) vulnerability in Endpoint where monitoring is mounted that can result in Reflected XSS that affects Firefox. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.