19 matches found
GO-2026-5433 DevSpace UI Server WebSocket CheckOrigin does not validate source in github.com/loft-sh/devspace
DevSpace UI Server WebSocket CheckOrigin does not validate source in github.com/loft-sh/devspace. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...
CVE-2026-42283
DevSpace is a client-only developer tool for cloud-native development with Kubernetes. Prior to 6.3.21, DevSpace's UI server WebSocket accepts connections from all origins by default, and therefore several endpoints are exposed via this WebSocket. When a developer runs the DevSpace UI and at the...
CVE-2026-42283
DevSpace is a client-only developer tool for cloud-native development with Kubernetes. Prior to 6.3.21, DevSpace's UI server WebSocket accepts connections from all origins by default, and therefore several endpoints are exposed via this WebSocket. When a developer runs the DevSpace UI and at the...
CVE-2026-42283 DevSpace UI Server WebSocket CheckOrigin does not validate source
DevSpace is a client-only developer tool for cloud-native development with Kubernetes. Prior to 6.3.21, DevSpace's UI server WebSocket accepts connections from all origins by default, and therefore several endpoints are exposed via this WebSocket. When a developer runs the DevSpace UI and at the...
CVE-2026-42283
DevSpace is a client-only developer tool for cloud-native development with Kubernetes. Prior to 6.3.21, DevSpace's UI server WebSocket accepts connections from all origins by default, and therefore several endpoints are exposed via this WebSocket. When a developer runs the DevSpace UI and at the...
CVE-2026-42283 DevSpace UI Server WebSocket CheckOrigin does not validate source
DevSpace is a client-only developer tool for cloud-native development with Kubernetes. Prior to 6.3.21, DevSpace's UI server WebSocket accepts connections from all origins by default, and therefore several endpoints are exposed via this WebSocket. When a developer runs the DevSpace UI and at the...
CVE-2026-42283
DevSpace UI server WebSocket checks pre-6.3.21 allowed cross-origin connections by default, exposing endpoints via ws://127.0.0.1:8090. A malicious site could trigger a cross-origin WebSocket from the user’s browser to access sensitive endpoints such as /api/logs, /api/enter, and /api/command, en...
EUVD-2026-30319
DevSpace is a client-only developer tool for cloud-native development with Kubernetes. Prior to 6.3.21, DevSpace's UI server WebSocket accepts connections from all origins by default, and therefore several endpoints are exposed via this WebSocket. When a developer runs the DevSpace UI and at the...
CVE-2026-42283 DevSpace UI Server WebSocket CheckOrigin does not validate source
DevSpace is a client-only developer tool for cloud-native development with Kubernetes. Prior to 6.3.21, DevSpace's UI server WebSocket accepts connections from all origins by default, and therefore several endpoints are exposed via this WebSocket. When a developer runs the DevSpace UI and at the...
DevSpace 信息泄露漏洞
DevSpace is a client developer tool for cloud-native development using Kubernetes, developed by DevSpace Inc. Versions prior to DevSpace 6.3.21 contained an information leakage vulnerability. This vulnerability stemmed from the UI server’s WebSocket feature, which accepts connections from all...
EUVD-2022-2800
Malicious code in bioql PyPI...
CVE-2020-15391
The UI in DevSpace 4.13.0 allows web sites to execute actions on pods on behalf of a victim because of a lack of authentication for the WebSocket protocol. This leads to remote code execution...
DevSpace vulnerable to remote code execution
The UI in DevSpace 4.13.0 allows web sites to execute actions on pods on behalf of a victim because of a lack of authentication for the WebSocket protocol. This leads to remote code execution...
GHSA-6H8C-GW33-CJM2 DevSpace vulnerable to remote code execution
The UI in DevSpace 4.13.0 allows web sites to execute actions on pods on behalf of a victim because of a lack of authentication for the WebSocket protocol. This leads to remote code execution...
CVE-2020-15391
The UI in DevSpace 4.13.0 allows web sites to execute actions on pods on behalf of a victim because of a lack of authentication for the WebSocket protocol. This leads to remote code execution...
CVE-2020-15391
The UI in DevSpace 4.13.0 allows web sites to execute actions on pods on behalf of a victim because of a lack of authentication for the WebSocket protocol. This leads to remote code execution...
Remote code execution
The UI in DevSpace 4.13.0 allows web sites to execute actions on pods on behalf of a victim because of a lack of authentication for the WebSocket protocol. This leads to remote code execution...
CVE-2020-15391
The UI in DevSpace 4.13.0 allows web sites to execute actions on pods on behalf of a victim because of a lack of authentication for the WebSocket protocol. This leads to remote code execution...
CVE-2020-15391
DevSpace 4.13.0 contains a vulnerability where the UI allows actions on pods via WebSocket without authentication, enabling remote code execution. The issue is tied to lack of authentication for WebSocket communications, leading to possible control of victim-side pods over the network. Acknowledg...