These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
A cross-site scripting vulnerability exists in Trix, a rich text editor, prior to version 2.1.17. The vulnerability occurs when a data-trix-serialized-attributes attribute bypasses the DOMPurify sanitizer, allowing an attacker to craft HTML with a malicious payload that executes arbitrary JavaScript in the user's session. This may lead to unauthorized actions or disclosure of sensitive information. The is [truncated]
A stored cross-site scripting vulnerability exists in Trix, a rich text editor, prior to version 2.1.18. The vulnerability occurs when crafted HTML is pasted into the editor, allowing an attacker to inject malicious JavaScript code. This code can be executed when another user renders and clicks the content. Applications that apply server-side HTML sanitization can neutralize the payload on save. The issue [truncated]
An unauthenticated attacker can induce a logged-in user's browser to submit requests that are forwarded to enabled upstream write or management endpoints, such as creating an Alertmanager silence or requesting a Prometheus reload. This vulnerability affects the basecamp/upright at commit efe4f2e5254ac6e57e45d2261804cca74dbbca3f, which disables Rails CSRF protection for its Alertmanager and Prometheus prox [truncated]
A cross-site scripting vulnerability exists in Trix, a rich text editor, prior to version 2.1.18. The vulnerability occurs when a crafted application/x-trix-document JSON payload is dropped into an editor using the fallback Level0InputController, such as an embedded WebView without Input Events Level 2 support. This allows a draggable element containing a javascript: URI to bypass DOMPurify sanitization a [truncated]