CVE-2024-5548

Summary (CVE-2024-5548): A directory traversal vulnerability exists in the stitionai/devika repository, affecting the /api/download-project endpoint. The flaw stems from insufficient input validation in the download_project function, when handling the project_name parameter, enabling an attacker ...

CVE-2024-5547 Directory Traversal in stitionai/devika

A directory traversal vulnerability exists in the /api/download-project-pdf endpoint of the stitionai/devika repository, affecting the latest version. The vulnerability arises due to insufficient sanitization of the 'projectname' parameter in the downloadprojectpdf function. Attackers can exploit...

CVE-2024-5547 Directory Traversal in stitionai/devika

A directory traversal vulnerability exists in the /api/download-project-pdf endpoint of the stitionai/devika repository, affecting the latest version. The vulnerability arises due to insufficient sanitization of the 'projectname' parameter in the downloadprojectpdf function. Attackers can exploit...

CVE-2024-5547

CVE-2024-5547 is a directory traversal vulnerability in the stitionai/devika repository, exposed via the GET /api/download-project-pdf endpoint. The issue stems from insufficient sanitization of the project_name parameter in the download_project_pdf function, enabling an attacker to manipulate th...

CVE-2024-5334 Local File Read in stitionai/devika

A local file read vulnerability exists in the stitionai/devika repository, affecting the latest version. The vulnerability is due to improper handling of the 'snapshotpath' parameter in the '/api/get-browser-snapshot' endpoint. An attacker can exploit this vulnerability by crafting a request with...

CVE-2024-5334 Local File Read in stitionai/devika

A local file read vulnerability exists in the stitionai/devika repository, affecting the latest version. The vulnerability is due to improper handling of the 'snapshotpath' parameter in the '/api/get-browser-snapshot' endpoint. An attacker can exploit this vulnerability by crafting a request with...

CVE-2024-5334 Local File Read in stitionai/devika

A local file read vulnerability exists in the stitionai/devika repository, affecting the latest version. The vulnerability is due to improper handling of the 'snapshotpath' parameter in the '/api/get-browser-snapshot' endpoint. An attacker can exploit this vulnerability by crafting a request with...

CVE-2024-5334

Summary of CVE-2024-5334 (Devika): A local file read vulnerability exists in the stitionai/devika repository due to improper handling of the ‘snapshot_path’ parameter in the POST/GET endpoint “/api/get-browser-snapshot.” Attackers can craft a request with a malicious snapshot_path to read arbitra...

CVE-2024-5820: Missing Authorization

An unprotected WebSocket connection in the latest version of stitionai/devika commit ecee79f allows a malicious website to connect to the backend and issue commands on behalf of the user. The backend serves all listeners on the given socket, enabling any such malicious website to intercept all...

Devika Path Traversal Vulnerability

Stition Devika is an advanced AI software engineer at Stition USA that understands advanced human commands, breaks them down into steps, researches relevant information, and writes code to achieve a given goal. Devika has a path traversal vulnerability that stems from the application having a...

Devika Security Breach

Stition Devika is an advanced AI software engineer at Stition USA that understands advanced human commands, breaks them down into steps, researches the relevant information, and writes code to achieve a given goal. Devika has a security vulnerability that stems from an ineffectively protected...

CVE-2024-5548: Improper Limitation of a Pathname to a Restricted Directory

A directory traversal vulnerability exists in the stitionai/devika repository, specifically within the /api/download-project endpoint. Attackers can exploit this vulnerability by manipulating the 'projectname' parameter in a GET request to download arbitrary files from the system. This issue...

PT-2024-36524 · Devika · Devika

Name of the Vulnerable Software and Affected Versions: stitutionai/devika repository version latest Description: A directory traversal issue exists in the "/api/download-project-pdf" endpoint due to insufficient sanitization of the project name parameter in the download project pdf function. This...

Devika Security Breach

Stition Devika is an advanced AI software engineer at Stition USA that understands advanced human commands, breaks them down into steps, researches the relevant information, and writes code to achieve a given goal. Devika has a security vulnerability that stems from the application having a...

CVE-2024-5547: Relative Path Traversal

A directory traversal vulnerability exists in the /api/download-project-pdf endpoint of the stitionai/devika repository, affecting the latest version. The vulnerability arises due to insufficient sanitization of the 'projectname' parameter in the downloadprojectpdf function. Attackers can exploit...

CVE-2024-5334: External Control of File Name or Path

A local file read vulnerability exists in the stitionai/devika repository, affecting the latest version. The vulnerability is due to improper handling of the 'snapshotpath' parameter in the '/api/get-browser-snapshot' endpoint. An attacker can exploit this vulnerability by crafting a request with...

PT-2024-4466 · Devika · Devika

Name of the Vulnerable Software and Affected Versions: Devika affected versions not specified Description: The issue is related to a cross-site request forgery CSRF attack. It may allow a remote attacker to exploit the vulnerability, potentially enabling them to perform unauthorized actions...