← 返回地图破甲

浏览报告

仅含 CVE

57 份报告 · 本页赏金 $21,892 · 清除筛选

Ordinary HEY user can make HEY originate authenticated mail from attacker-selected @hey.com addresses访问控制Basecamp中危—2026-10-20 A third-party Basecamp OAuth token mints a full launchpad web session through GET /my/login_option访问控制Basecamp中危—2026-10-30 Cross-account XSS on app.basecamp.com: oEmbed option injection chained through Turbo defeats the CSP nonce跨站脚本Basecamp中危—2026-10-28 Cross-account webhook takeover: PUT and DELETE on /<account>/webhooks/<id>.json reach another account's webhook身份认证Basecamp中危—2026-10-30 Open redirect on app.hey.com bypasses HEY desktop's internal-origin allowlist and loads attacker content inside a HEY BrowserWindow开放重定向Basecamp低危—2026-10-15 Launchpad file read leaks production keys路径遍历Basecamp高危$9,3372026-10-28 launchpad.37signals.com OAuth AS issues victim-bound credential to unverified attacker redirect → full CIA triad on Basecamp API身份认证Basecamp中危—2026-10-30 One-click cross-account JavaScript execution steals a victim write token through Turbo pagination and unattached Active Storage HTML跨站脚本Basecamp中危—2026-10-02 Any installed app can force immediate logout and persistent DOS of authenticated Basecamp sessions via unprotected exported StartActivity访问控制Basecamp低危—2026-07-04 DOM XSS in `fizzy.do` import filename preview enables one-click victim account takeover跨站脚本Basecamp中危—2026-04-14 Stored XSS on Trix Editor version latest (2.1.16) - Sanitizer Bypass跨站脚本Basecamp低危$3372026-07-14 Improper Access Control in `fizzy.do` import flow allows cross-tenant ActionText reference resolution and data disclosure访问控制Basecamp低危—2026-04-14 Unauthenticated access to private files on app.fizzy.do via Active Storage URLs leads to information disclosure不安全的直接对象引用Basecamp低危$1002026-03-16 Link unfurling calls out to arbitrary URLs and the private-network guard misses link-local addresses服务端请求伪造Basecamp低危—2025-12-22 Improper bot-authentication allows to impersonate any user when sending messages in a room身份认证Basecamp中危$2,0002025-11-21 Two click Account Takeover代码执行Basecamp中危—2025-11-11 Mutation Based Stored XSS on Trix Editor version latest (2.1.8)其他弱点Basecamp高危—2025-06-27 Critical Data Breach - Big Data for all domains其他弱点Basecamp低危—2025-01-14 Path traversal in deeplink query parameter can expose any user's private info to a public directory (one click)路径遍历Basecamp低危—2024-07-09 Navgraph confusion allows any 3p app to send and read requests from the server at app.hey.com代码执行Basecamp低危—2024-07-09 Stored XSS on trix editor version 2.1.1跨站脚本Basecamp中危$1,0002024-11-04 Account takeover via insecure intent handling代码执行Basecamp低危—2024-05-30 AWS keys and user cookie leakage via uninitialized memory leak in outdated librsvg version in Basecamp信息泄露Basecamp中危$8,8682023-09-21 Spam & Clearance checks disabled with existing referenced Message-ID访问控制Basecamp低危$2502026-01-21 Arbitrary write in the application's data folder and arbitrary read of server's replies from 3rd party apps.路径遍历Basecamp中危—2023-06-07