CVE-2024-6331

stitionai/devika main branch as of commit cdfb782b0e634b773b10963c8034dc9207ba1f9f is vulnerable to Local File Read LFI by Prompt Injection. The integration of Google Gimini 1.0 Pro with HarmBlockThreshold.BLOCKNONE for HarmCategory.HARMCATEGORYHATESPEECH and HarmCategory.HARMCATEGORYHARASSMENT i...

CVE-2024-6331

stitionai/devika main branch as of commit cdfb782b0e634b773b10963c8034dc9207ba1f9f is vulnerable to Local File Read LFI by Prompt Injection. The integration of Google Gimini 1.0 Pro with HarmBlockThreshold.BLOCKNONE for HarmCategory.HARMCATEGORYHATESPEECH and HarmCategory.HARMCATEGORYHARASSMENT i...

CVE-2024-6331

CVE-2024-6331 affects stitionai/devika: Local File Read via Prompt Injection on the main branch as of commit cdfb782b0e634b773b10963c8034dc9207ba1f9f. The issue stems from prompt-injection allowing execution of commands that can read sensitive files (e.g., /etc/passwd) due to HarmBlockThreshold.B...

CVE-2024-6331 Injection by Prompt Injection in stitionai/devika

stitionai/devika main branch as of commit cdfb782b0e634b773b10963c8034dc9207ba1f9f is vulnerable to Local File Read LFI by Prompt Injection. The integration of Google Gimini 1.0 Pro with HarmBlockThreshold.BLOCKNONE for HarmCategory.HARMCATEGORYHATESPEECH and HarmCategory.HARMCATEGORYHARASSMENT i...

PT-2024-37546 · Stitionai +1 · Devika +1

Name of the Vulnerable Software and Affected Versions: stitionai/devika main branch as of commit cdfb782b0e634b773b10963c8034dc9207ba1f9f stitionai/devika up to version 1.0 Description: The issue concerns a Local File Read LFI vulnerability by Prompt Injection. It is caused by the integration of...

Security Bulletin: IBM Content Navigator is vulnerable to Server Side Request Forgery leading to Arbitrary File Read due to Oracle Outside In Technology (CVE-2023-35896)

Summary Oracle Outside In Technology is used in some configurations of IBM Content Navigator as part of the document viewer. CVE-2023-35896. Vulnerability Details CVEID:CVE-2023-35896 DESCRIPTION: IBM Content Navigator is vulnerable to server-side request forgery SSRF. This may allow an...

Arbitrary file read vulnerability exists in NC Cloud of UFIDA Network Technology Corporation (CNVD-2024-37279)

NC Cloud is a large enterprise digitalization platform. An arbitrary file read vulnerability exists in UFIDA Network Technology Corporation NC Cloud, which can be exploited by attackers to obtain sensitive information...

CVE-2024-7135 Tainacan <= 0.21.7 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Read

The Tainacan plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'getfile' function in all versions up to, and including, 0.21.7. The function is also vulnerable to directory traversal. This makes it possible for authenticated attackers, with...

CVE-2024-7135 Tainacan <= 0.21.7 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Read

The Tainacan plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'getfile' function in all versions up to, and including, 0.21.7. The function is also vulnerable to directory traversal. This makes it possible for authenticated attackers, with...

WordPress Tainacan plugin <= 0.21.7 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Read vulnerability

Missing Authorization to Authenticated Subscriber+ Arbitrary File Read vulnerability discovered by 1337Wannabe in WordPress Plugin Tainacan versions = 0.21.7...

Arbitrary File Read

anki is vulnerable to Arbitrary File Read. The vulnerability is due to the lack of proper sanitization of the verbatim package when processing Latex, which allows attackers to share a specially crafted flashcard to trigger this vulnerability...

Arbitrary File Read Vulnerability in Tianwen Property ERP System of Chengdu Tianwen Interconnection Technology Co. Ltd (CNVD-2024-36506)

Based on software development and technical services, Chengdu Tianwen Interlink Technology Co., Ltd. establishes property ERP application system and provides property management companies with intelligent property management solutions aiming at cost reduction, quality assurance and efficiency...

PT-2024-29686 · Spx · Spx

Name of the Vulnerable Software and Affected Versions: SPX aka php-spx versions 0.4.15 and earlier Description: The issue allows for SPX UI URI Directory Traversal, enabling the reading of arbitrary files. Recommendations: For SPX aka php-spx versions 0.4.15 and earlier, consider restricting acce...

CosmicSting: Magento Arbitrary File Read (CVE-2024-34102) + PHP Buffer Overflow in the iconv() function of glibc (CVE-2024-2961)

This combination of an Arbitrary File Read CVE-2024-34102 and a Buffer Overflow in glibc CVE-2024-2961 allows for unauthenticated Remote Code Execution on the following versions of Magento and Adobe Commerce and earlier if the PHP and glibc versions are also vulnerable: - 2.4.7 and earlier -...

SPX 安全漏洞

SPX is a simple PHP parser by Sylvain L. Personal Developer. A security vulnerability exists in SPX php-spx version 0.4.15 and earlier. An attacker can read arbitrary files by exploiting the vulnerability...

poc

This repository contains a collection of proof-of-concept PoC exploits for various vulnerabilities in Dahua products. The exploits are categorized by product and vulnerability type. The PoCs are for the following products: 1. Dahua DSS: - A command execution vulnerability CVE-XXXX-XXXX that allow...

SUSE CVE-2024-29073

An vulnerability in the handling of Latex exists in Ankitects Anki 24.04. When Latex is sanitized to prevent unsafe commands, the verbatim package, which comes installed by default in many Latex distributions, has been overlooked. A specially crafted flashcard can lead to an arbitrary file read. ...

SUSE CVE-2024-32484

An reflected XSS vulnerability exists in the handling of invalid paths in the Flask server in Ankitects Anki 24.04. A specially crafted flashcard can lead to JavaScript code execution and result in an arbitrary file read. An attacker can share a malicious flashcard to trigger this vulnerability...

Bazarr Arbitrary File Read Vulnerability

Bazarr is a companion app to Sonarr and Radarr that manages and downloads subtitles to your specifications. Bazarr suffers from an arbitrary file read vulnerability due to an issue in component /api/swaggerui/static in Bazaar v1.4.3 that allows an unauthenticated attacker to perform directory...

VulnCheck KEV: CVE-2024-5178

ServiceNow has addressed a sensitive file read vulnerability that was identified in the Washington DC, Vancouver, and Utah Now Platform releases. This vulnerability could allow an administrative user to gain unauthorized access to sensitive files on the web application server. The vulnerability i...