65 matches found
CVE-2023-32766
Gitpod before 2022.11.3 allows XSS because redirection can occur for some protocols outside of the trusted set of three vscode: vscode-insiders: jetbrains-gateway:...
CVE-2023-32766: Improper Neutralization of Input During Web Page Generation
Gitpod before 2022.11.3 allows XSS because redirection can occur for some protocols outside of the trusted set of three vscode: vscode-insiders: jetbrains-gateway:...
CVE-2023-32766
Gitpod before 2022.11.3 allows XSS because redirection can occur for some protocols outside of the trusted set of three vscode: vscode-insiders: jetbrains-gateway:...
CVE-2023-32766
CVE-2023-32766 affects Gitpod prior to 2022.11.3, where an XSS arises from redirects to non-trusted protocols outside the approved set (vscode:, vscode-insiders:, jetbrains-gateway:). The root cause is improper URL handling that allows attacker-controlled or crafted URLs to redirect a user’s brow...
CVE-2023-32766
Gitpod before 2022.11.3 allows XSS because redirection can occur for some protocols outside of the trusted set of three vscode: vscode-insiders: jetbrains-gateway:...
CVE-2023-0957
An issue was discovered in Gitpod versions prior to release-2022.11.2.16. There is a Cross-Site WebSocket Hijacking CSWSH vulnerability that allows attackers to make WebSocket connections to the Gitpod JSONRPC server using a victim’s credentials, because the Origin header is not restricted. This...
Cross site scripting
An issue was discovered in Gitpod versions prior to release-2022.11.2.16. There is a Cross-Site WebSocket Hijacking CSWSH vulnerability that allows attackers to make WebSocket connections to the Gitpod JSONRPC server using a victim’s credentials, because the Origin header is not restricted. This...
CVE-2023-0957
An issue was discovered in Gitpod versions prior to release-2022.11.2.16. There is a Cross-Site WebSocket Hijacking CSWSH vulnerability that allows attackers to make WebSocket connections to the Gitpod JSONRPC server using a victim’s credentials, because the Origin header is not restricted. This...
CVE-2023-0957
An issue was discovered in Gitpod versions prior to release-2022.11.2.16. There is a Cross-Site WebSocket Hijacking CSWSH vulnerability that allows attackers to make WebSocket connections to the Gitpod JSONRPC server using a victim’s credentials, because the Origin header is not restricted. This...
CVE-2023-0957
An issue was discovered in Gitpod versions prior to release-2022.11.2.16. There is a Cross-Site WebSocket Hijacking CSWSH vulnerability that allows attackers to make WebSocket connections to the Gitpod JSONRPC server using a victim’s credentials, because the Origin header is not restricted. This...
CVE-2023-0957
An issue was discovered in Gitpod versions prior to release-2022.11.2.16. There is a Cross-Site WebSocket Hijacking CSWSH vulnerability that allows attackers to make WebSocket connections to the Gitpod JSONRPC server using a victim’s credentials, because the Origin header is not restricted. This...
CVE-2023-0957
CVE-2023-0957 describes a Cross-Site WebSocket Hijacking (CSWSH) vulnerability in Gitpod versions prior to release-2022.11.2.16. The issue arises because the Origin header is not restricted, allowing an attacker to initiate WebSocket connections to the Gitpod JSONRPC server using a victim’s crede...
PT-2023-16641
Name of the Vulnerable Software and Affected Versions Gitpod versions prior to release-2022.11.2.16 Description The issue allows attackers to make WebSocket connections to the Gitpod JSONRPC server using a victim’s credentials due to the lack of restriction on the Origin header. This can lead to...
CVE-2023-0957: Missing Origin Validation in WebSockets
An issue was discovered in Gitpod versions prior to release-2022.11.2.16. There is a Cross-Site WebSocket Hijacking CSWSH vulnerability that allows attackers to make WebSocket connections to the Gitpod JSONRPC server using a victim’s credentials, because the Origin header is not restricted. This...
Gitpod 访问控制错误漏洞
Gitpod is an open source Kubernetes application for automated and ready-to-use code development environments that can be integrated into your existing workflow. Gitpod has a security vulnerability that stems from the presence of a Cross-Site WebSocket Hijacking CSWSH vulnerability, which can be...
CVE-2021-35206
Gitpod before 0.6.0 allows unvalidated redirects...
CVE-2021-35206
Gitpod before 0.6.0 allows unvalidated redirects...
Design/Logic Flaw
Gitpod before 0.6.0 allows unvalidated redirects...
