CVE-2024-5334 Local File Read in stitionai/devika

A local file read vulnerability exists in the stitionai/devika repository, affecting the latest version. The vulnerability is due to improper handling of the 'snapshotpath' parameter in the '/api/get-browser-snapshot' endpoint. An attacker can exploit this vulnerability by crafting a request with...

CVE-2024-5334 Local File Read in stitionai/devika

A local file read vulnerability exists in the stitionai/devika repository, affecting the latest version. The vulnerability is due to improper handling of the 'snapshotpath' parameter in the '/api/get-browser-snapshot' endpoint. An attacker can exploit this vulnerability by crafting a request with...

CVE-2024-5334

Summary of CVE-2024-5334 (Devika): A local file read vulnerability exists in the stitionai/devika repository due to improper handling of the ‘snapshot_path’ parameter in the POST/GET endpoint “/api/get-browser-snapshot.” Attackers can craft a request with a malicious snapshot_path to read arbitra...

Devika Security Breach

Stition Devika is an advanced AI software engineer at Stition USA that understands advanced human commands, breaks them down into steps, researches the relevant information, and writes code to achieve a given goal. Devika has a security vulnerability that stems from allowing external control over...

Malicious code in internal-logger (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9b2be6f0f43b615fc7cc5c7e1f674bc14906e1a598c8aadb3aeaaf9253f8f9b2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in arangodb (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d3e09e7451852efa7e3e9deea5dc6dd6e2cf678f5368a741c35b2eac846fff21 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in exel-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b6083dc24b3cdb6bfd02f5426aa373f2425aab6e9508e12255fc1e08133809bc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

The vulnerability of the PHP-SVG-Lib library for file analysis and rendering of vector graphics lies in improper external control of file names or paths, allowing attackers to execute arbitrary code.

The vulnerability of the php-svg-lib library for analyzing and rendering vector graphics is related to improper external manipulation of the file name or path. Exploiting this vulnerability could allow an attacker to execute arbitrary code with insufficient protection against attacks...

CVE-2023-38520 WordPress Pinpoint Booking System plugin <= 2.9.9.3.4 - Parameter Tampering

External Control of Assumed-Immutable Web Parameter vulnerability in PINPOINT.WORLD Pinpoint Booking System allows Functionality Misuse.This issue affects Pinpoint Booking System: from n/a through 2.9.9.3.4...

CVE-2023-24373

External Control of Assumed-Immutable Web Parameter vulnerability in WpDevArt Booking calendar, Appointment Booking System allows Manipulating Hidden Fields.This issue affects Booking calendar, Appointment Booking System: from n/a through 3.2.3...

CVE-2023-24373 WordPress Booking calendar, Appointment Booking System plugin <= 3.2.3 - Bypass vulnerability

External Control of Assumed-Immutable Web Parameter vulnerability in WpDevArt Booking calendar, Appointment Booking System allows Manipulating Hidden Fields.This issue affects Booking calendar, Appointment Booking System: from n/a through 3.2.3...

Malicious code in random-avishek (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 02969e3f79ab835099da7fc1ca720e01142e1d7c098b4021ddb45930af85f11a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @juiggitea/vero-placeat-ea-consequuntur (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ce8c3feba471a4cbe36afc647558994783b5f59eb77754f5f4401e1abf65fcf5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @juiggitea/quod-voluptatibus-molestias-modi (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 757fcc48a2d8bf16a4025910d6ded04f0aa457e61a0c4b175e318f19d67694f6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @juiggitea/reprehenderit-distinctio-eligendi (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b2a9f6cecd2cf176717f4e7156853376de7daa7b8af31cd521dc38bf8e1070f5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @juiggitea/quod-expedita-esse (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7556e700280a034c9e53944d6b3ea6e9a9f4a53c7b5eab105a122361de6fdcb5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @juiggitea/occaecati-aliquid-rerum (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 71b603de6339dc781efe5676f470ad1e1f8e15edf1ec700583008766718c85f5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @juiggitea/nisi-ducimus-rerum (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1449df082cd9795e8fc860af980b28b44c5f0c18262c9574f2adf9aeab0092a8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @juiggitea/commodi-eius-repudiandae (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 22949271db4d8ac0cd780cfefd377135c5d39d2ee2fff5d2c67f1ded937f2694 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-1409 Malicious code in @juiggitea/aperiam-facilis-molestias-mollitia (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 830ae116327023f82a97307586211b0744214fdad67a3897bfbe58f8e49b249b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...