Devika 信息泄露漏洞

Devika is an advanced AI software engineer open-sourced by stition. It can understand advanced human commands, break them down into steps, study the relevant information, and write code to achieve a given goal. Devika suffers from an information disclosure vulnerability that stems from being...

PT-2024-27998 · Unknown · Matrix Tafnit

Name of the Vulnerable Software and Affected Versions: Matrix Tafnit version 8 Description: The issue concerns files or directories being accessible to external parties, which is classified as CWE-552. Recommendations: For Matrix Tafnit version 8, consider restricting access to sensitive files an...

PT-2024-28272 · Studio 42 · Elfinder

Name of the Vulnerable Software and Affected Versions: Studio 42 elFinder version 2.1.64 Description: The issue allows an arbitrary attacker to expose secrets and perform remote code execution RCE by copying files with unauthorized extensions between server directories. This is due to incorrect...

CVE-2024-40422

The snapshotpath parameter in the /api/get-browser-snapshot endpoint in stitionai devika v1 is susceptible to a path traversal attack. An attacker can manipulate the snapshotpath parameter to traverse directories and access sensitive files on the server. This can potentially lead to unauthorized...

CVE-2024-40422

The snapshotpath parameter in the /api/get-browser-snapshot endpoint in stitionai devika v1 is susceptible to a path traversal attack. An attacker can manipulate the snapshotpath parameter to traverse directories and access sensitive files on the server. This can potentially lead to unauthorized...

CVE-2024-40422

The snapshotpath parameter in the /api/get-browser-snapshot endpoint in stitionai devika v1 is susceptible to a path traversal attack. An attacker can manipulate the snapshotpath parameter to traverse directories and access sensitive files on the server. This can potentially lead to unauthorized...

CVE-2024-40422

The snapshotpath parameter in the /api/get-browser-snapshot endpoint in stitionai devika v1 is susceptible to a path traversal attack. An attacker can manipulate the snapshotpath parameter to traverse directories and access sensitive files on the server. This can potentially lead to unauthorized...

CVE-2024-21527

Versions of the package github.com/gotenberg/gotenberg/v8/pkg/gotenberg before 8.1.0; versions of the package github.com/gotenberg/gotenberg/v8/pkg/modules/chromium before 8.1.0; versions of the package github.com/gotenberg/gotenberg/v8/pkg/modules/webhook before 8.1.0 are vulnerable to Server-si...

Information Disclosure

github.com/docker/docker is vulnerable to Information Disclosure. The vulnerability is due to the unexpected inclusion of arbitrary filesystem paths in the build context when exploited by a malicious Git repository. Attackers can use this to include sensitive files in the build context without th...

CVE-2024-40617

Summary: CVE-2024-40617 is a path traversal vulnerability in FUJITSU Network Edgiot GW1500 (M2M-GW for FENICS). A remote authenticated attacker with User Class privileges can send crafted requests to access restricted files, potentially hijacking Administrator Class privileges. Affected versions ...

CVE-2024-40617

Path traversal vulnerability exists in FUJITSU Network Edgiot GW1500 M2M-GW for FENICS. If a remote authenticated attacker with User Class privilege sends a specially crafted request to the affected product, access restricted files containing sensitive information may be accessed. As a result,...

SolarWinds Serv-U Path Traversal Vulnerability

SolarWinds Serv-U contains a path traversal vulnerability that allows an attacker access to read sensitive files on the host machine...

PT-2024-5723 · Fujitsu · Fujitsu Network Edgiot Gw1500

Name of the Vulnerable Software and Affected Versions: FUJITSU Network Edgiot GW1500 M2M-GW for FENICS versions not specified Description: The issue is related to a path traversal vulnerability, which may allow a remote attacker with User Class privilege to access restricted files containing...

Arbitrary File Access

OpenStack Cinder, Glance, and Nova are vulnerable to Arbitrary File Access. The vulnerability is due to a flaw in handling custom QCOW2 external data, where a crafted QCOW2 image can reference a specific data file path. The vulnerability allows an authenticated user to retrieve unauthorized copie...

ServiceNow Security Vulnerability

ServiceNow is a cloud computing platform from US-based ServiceNow, Inc. to help companies manage digital workflows for business operations. A security vulnerability exists in ServiceNow. An attacker exploiting the vulnerability could access sensitive files on the web application server...

The vulnerability of SAP Document Builder in creating and managing documents allows for unlimited uploading of sensitive files, enabling an attacker to gain access to read, modify, or delete data.

The vulnerability of SAP Document Builder for document creation and management lies in its ability to allow unlimited uploading of sensitive files. Exploiting this vulnerability could enable a malicious actor to gain read, modify, or delete access to data...

GHSA-MWXM-35F8-6VG2 Vanna vulnerable to SQL Injection

vanna-ai/vanna version v0.3.4 is vulnerable to SQL injection in some file-critical functions such as pgreadfile. This vulnerability allows unauthenticated remote users to read arbitrary local files on the victim server, including sensitive files like /etc/passwd, by exploiting the exposed SQL...

Exploit for Improper Restriction of XML External Entity Reference in Adobe Commerce

🇮🇱 BringThemHome NeverAgainIsNow 🇮🇱 We demand the...

PT-2024-35727 · Devika · Devika

Name of the Vulnerable Software and Affected Versions: stitutionai/devika version latest Description: A local file read issue exists due to improper handling of the snapshot path parameter in the "/api/get-browser-snapshot" endpoint. An attacker can exploit this by crafting a request with a...

CVE-2023-49110 XML External Entity Injection in Kiuwan SAST

When the Kiuwan Local Analyzer uploads the scan results to the Kiuwan SAST web application either on-premises or cloud/SaaS solution, the transmitted data consists of a ZIP archive containing several files, some of them in the XML file format. During Kiuwan's server-side processing of these XML...