CVE-2024-6706: Improper Neutralization of Input During Web Page Generation

Attackers can craft a malicious prompt that coerces the language model into executing arbitrary JavaScript in the context of the web page...

SUSE CVE-2024-41815

Starship is a cross-shell prompt. Starting in version 1.0.0 and prior to version 1.20.0, undocumented and unpredictable shell expansion and/or quoting rules make it easily to accidentally cause shell injection when using custom commands with starship in bash. This issue only affects users with...

Mozilla Firefox 安全漏洞

Mozilla Firefox is an open source web browser from the Mozilla Foundation in the United States. A security bypass vulnerability exists in Mozilla Firefox for Android, which is caused due to a selection option that obscures security prompts. An attacker could exploit the vulnerability to trick use...

Security Vulnerabilities fixed in Firefox ESR 128.1 — Mozilla

Select options could obscure the fullscreen notification dialog. This could be used by a malicious site to perform a spoofing attack. Insufficient checks when processing graphics shared memory could have led to memory corruption. This could be leveraged by an attacker to perform a sandbox escape....

Mozilla Thunderbird < 115.14

The version of Thunderbird installed on the remote macOS or Mac OS X host is prior to 115.14. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2024-38 advisory. - Unexpected marking work at the start of sweeping could have led to a use-after-free. CVE-2024-7527 -...

Security Vulnerabilities fixed in Thunderbird 115.14 — Mozilla

Insufficient checks when processing graphics shared memory could have led to memory corruption. This could be leveraged by an attacker to perform a sandbox escape. Incomplete WebAssembly exception handing could have led to a use-after-free. Editor code failed to check an attribute value. This cou...

De-risk Generative AI: Enterprise TruRisk Platform Advances to Secure AI and LLM Workloads

As we stand at the frontier of technological innovation, artificial intelligence AI and large language models LLMs are reshaping industries, driving automation, enhancing customer experiences, optimizing processes, and unlocking business opportunities for modern enterprises. However, this rapid...

CVE-2024-6331

stitionai/devika main branch as of commit cdfb782b0e634b773b10963c8034dc9207ba1f9f is vulnerable to Local File Read LFI by Prompt Injection. The integration of Google Gimini 1.0 Pro with HarmBlockThreshold.BLOCKNONE for HarmCategory.HARMCATEGORYHATESPEECH and HarmCategory.HARMCATEGORYHARASSMENT i...

CVE-2024-6331

stitionai/devika main branch as of commit cdfb782b0e634b773b10963c8034dc9207ba1f9f is vulnerable to Local File Read LFI by Prompt Injection. The integration of Google Gimini 1.0 Pro with HarmBlockThreshold.BLOCKNONE for HarmCategory.HARMCATEGORYHATESPEECH and HarmCategory.HARMCATEGORYHARASSMENT i...

CVE-2024-6331 Injection by Prompt Injection in stitionai/devika

stitionai/devika main branch as of commit cdfb782b0e634b773b10963c8034dc9207ba1f9f is vulnerable to Local File Read LFI by Prompt Injection. The integration of Google Gimini 1.0 Pro with HarmBlockThreshold.BLOCKNONE for HarmCategory.HARMCATEGORYHATESPEECH and HarmCategory.HARMCATEGORYHARASSMENT i...

CVE-2024-6331

CVE-2024-6331 affects stitionai/devika: Local File Read via Prompt Injection on the main branch as of commit cdfb782b0e634b773b10963c8034dc9207ba1f9f. The issue stems from prompt-injection allowing execution of commands that can read sensitive files (e.g., /etc/passwd) due to HarmBlockThreshold.B...

CVE-2024-6331 Injection by Prompt Injection in stitionai/devika

stitionai/devika main branch as of commit cdfb782b0e634b773b10963c8034dc9207ba1f9f is vulnerable to Local File Read LFI by Prompt Injection. The integration of Google Gimini 1.0 Pro with HarmBlockThreshold.BLOCKNONE for HarmCategory.HARMCATEGORYHATESPEECH and HarmCategory.HARMCATEGORYHARASSMENT i...

PT-2024-37546 · Stitionai +1 · Devika +1

Name of the Vulnerable Software and Affected Versions: stitionai/devika main branch as of commit cdfb782b0e634b773b10963c8034dc9207ba1f9f stitionai/devika up to version 1.0 Description: The issue concerns a Local File Read LFI vulnerability by Prompt Injection. It is caused by the integration of...

Devika 信息泄露漏洞

Devika is an advanced AI software engineer open-sourced by stition. It can understand advanced human commands, break them down into steps, study the relevant information, and write code to achieve a given goal. Devika suffers from an information disclosure vulnerability that stems from being...

CVE-2024-6331: Improper Neutralization of Special Elements in Output Used by a Downstream Component

stitionai/devika main branch as of commit cdfb782b0e634b773b10963c8034dc9207ba1f9f is vulnerable to Local File Read LFI by Prompt Injection. The integration of Google Gimini 1.0 Pro with HarmBlockThreshold.BLOCKNONE for HarmCategory.HARMCATEGORYHATESPEECH and HarmCategory.HARMCATEGORYHARASSMENT i...

MAI-2024-0037

The Cross-Prompt Injection Attack XPIA can be significantly intensified by incorporating a Greedy Coordinate Gradient GCG suffix into the malicious payload. This technique enhances the probability that a Large Language Model LLM will execute the embedded instruction, even when a user's primary...

CVE-2024-40833

A logic issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14.6, iOS 16.7.9 and iPadOS 16.7.9, macOS Monterey 12.7.6, macOS Ventura 13.6.8. A shortcut may be able to use sensitive data with certain actions without prompting the user...

CVE-2024-40833

A logic issue was addressed with improved checks. This issue is fixed in iOS 16.7.9 and iPadOS 16.7.9, macOS Monterey 12.7.6, macOS Sonoma 14.6, macOS Ventura 13.6.8. A shortcut may be able to use sensitive data with certain actions without prompting the user...

CVE-2024-40834

This issue was addressed by adding an additional prompt for user consent. This issue is fixed in macOS Sonoma 14.6, macOS Monterey 12.7.6, macOS Ventura 13.6.8. A shortcut may be able to bypass sensitive Shortcuts app settings...

CVE-2024-40835

A logic issue was addressed with improved checks. This issue is fixed in iOS 16.7.9 and iPadOS 16.7.9, macOS Ventura 13.6.8, macOS Monterey 12.7.6, iOS 17.6 and iPadOS 17.6, watchOS 10.6, macOS Sonoma 14.6. A shortcut may be able to use sensitive data with certain actions without prompting the us...