Barak Tawily

**Nome do software vulnerável e versões afetadas** DevSpace versão 4.13.0 **Descrição** A vulnerabilidade no DevSpace permite que sites executem ações em pods em nome de uma vítima devido à falta de autenticação no protocolo WebSocket, levando à execução remota de código. **Recomendações** Para a versão 4.13.0 do DevSpace, no momento, não há informações sobre uma versão mais recente que contenha uma correção para essa vulnerabilidade.

**Name of the Vulnerable Software and Affected Versions** StackStorm Web UI versions prior to 2.9.3 StackStorm Web UI versions 2.10.x prior to 2.10.3 **Description** The issue allows bypassing the CORS protection mechanism via a "null" origin value, potentially leading to XSS. **Recommendations** For versions prior to 2.9.3, update to version 2.9.3 or later. For versions 2.10.x prior to 2.10.3, update to version 2.10.3 or later.

**Name of the Vulnerable Software and Affected Versions** geminabox versions prior to 0.13.6 **Description** The issue allows for Cross-site Scripting (XSS) attacks. This can be demonstrated by uploading a gem file with a crafted `gem.homepage` value in its `.gemspec` file. **Recommendations** For versions prior to 0.13.6, update to version 0.13.6 or later to resolve the issue. As a temporary workaround, consider restricting the upload of gem files or validating the `gem.homepage` value in the `.gemspec` file to prevent malicious input.

**Name of the Vulnerable Software and Affected Versions** geminabox versions prior to 0.13.7 **Description** The issue allows for a CSRF attack, which can lead to unintended actions such as uploading a gem. **Recommendations** For versions prior to 0.13.7, update to version 0.13.7 or later to resolve the issue.