Barak Tawily

**Name of the Vulnerable Software and Affected Versions** DevSpace version 4.13.0 **Description** The issue in DevSpace allows websites to execute actions on pods on behalf of a victim due to a lack of authentication for the WebSocket protocol, leading to remote code execution. **Recommendations** For DevSpace version 4.13.0, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** StackStorm Web UI versions prior to 2.9.3 StackStorm Web UI versions 2.10.x prior to 2.10.3 **Description** The issue allows bypassing the CORS protection mechanism via a "null" origin value, potentially leading to XSS. **Recommendations** For versions prior to 2.9.3, update to version 2.9.3 or later. For versions 2.10.x prior to 2.10.3, update to version 2.10.3 or later.

**Name of the Vulnerable Software and Affected Versions** geminabox versions prior to 0.13.6 **Description** The issue allows for Cross-site Scripting (XSS) attacks. This can be demonstrated by uploading a gem file with a crafted `gem.homepage` value in its `.gemspec` file. **Recommendations** For versions prior to 0.13.6, update to version 0.13.6 or later to resolve the issue. As a temporary workaround, consider restricting the upload of gem files or validating the `gem.homepage` value in the `.gemspec` file to prevent malicious input.

**Name of the Vulnerable Software and Affected Versions** geminabox versions prior to 0.13.7 **Description** The issue allows for a CSRF attack, which can lead to unintended actions such as uploading a gem. **Recommendations** For versions prior to 0.13.7, update to version 0.13.7 or later to resolve the issue.