CVE-2024-5549 Data leak through CORS misconfiguration in stitionai/devika

A CORS misconfiguration in the stitionai/devika repository allows attackers to steal sensitive information such as logs, browser sessions, and settings containing private API keys from other services. This vulnerability also enables attackers to perform actions on behalf of the user, such as...

CVE-2024-5549: Origin Validation Error

A CORS misconfiguration in the stitionai/devika repository allows attackers to steal sensitive information such as logs, browser sessions, and settings containing private API keys from other services. This vulnerability also enables attackers to perform actions on behalf of the user, such as...

CVE-2024-5711 Stored XSS in stitionai/devika

A stored Cross-Site Scripting XSS vulnerability exists in the stitionai/devika chat feature, allowing attackers to inject malicious payloads into the chat input. This vulnerability is due to the lack of input validation and sanitization on both the frontend and backend components of the...

CVE-2024-5711 Stored XSS in stitionai/devika

A stored Cross-Site Scripting XSS vulnerability exists in the stitionai/devika chat feature, allowing attackers to inject malicious payloads into the chat input. This vulnerability is due to the lack of input validation and sanitization on both the frontend and backend components of the...

CVE-2024-5711: Improper Neutralization of Input During Web Page Generation

A stored Cross-Site Scripting XSS vulnerability exists in the stitionai/devika chat feature, allowing attackers to inject malicious payloads into the chat input. This vulnerability is due to the lack of input validation and sanitization on both the frontend and backend components of the...

PT-2024-37088 · Unknown · Stitionai/Devika

Name of the Vulnerable Software and Affected Versions: stitutionai/devika affected versions not specified Description: A stored Cross-Site Scripting XSS vulnerability exists in the stitionai/devika chat feature, allowing attackers to inject malicious payloads into the chat input. This issue is du...

CVE-2024-5887

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...

CVE-2024-5821

The vulnerability allows an attacker to access sensitive files on the server by confusing the agent with incorrect file names. When a user requests the content of a file with a misspelled name, the agent attempts to correct the command and inadvertently reveals the content of the intended file,...

CVE-2024-5887

CVE-2024-5887 entry is rejected/not used and does not represent an active vulnerability.

CVE-2024-5887

...

CVE-2024-5887

...

CVE-2024-5821

CVE-2024-5821 describes a Local File Inclusion (LFI) in Stitionai/Devika (Devika AI software) where an attacker can access sensitive server files by exploiting a command-correction behavior when a user requests a misspelled filename. The underlying issue is that the agent’s correction attempt rev...

CVE-2024-5821 Local File Inclusion (LFI) in stitionai/devika

The vulnerability allows an attacker to access sensitive files on the server by confusing the agent with incorrect file names. When a user requests the content of a file with a misspelled name, the agent attempts to correct the command and inadvertently reveals the content of the intended file,...

CVE-2024-5821 Local File Inclusion (LFI) in stitionai/devika

The vulnerability allows an attacker to access sensitive files on the server by confusing the agent with incorrect file names. When a user requests the content of a file with a misspelled name, the agent attempts to correct the command and inadvertently reveals the content of the intended file,...

Devika Access Control Error Vulnerability

Stition Devika is an advanced AI software engineer at Stition USA that understands advanced human commands, breaks them down into steps, researches relevant information, and writes code to achieve a given goal. Devika is vulnerable to an access control error. An attacker exploiting this...

Number withdrawn

Stition Devika is a Senior AI Software Engineer at Stition USA that understands advanced human commands, breaks them down into steps, researches relevant information, and writes code to achieve given goals. This CVE number has been withdrawn...

The vulnerability of the AI-based development tool Devika, related to the， allows a hacker to execute a CSRF attack.

The vulnerability of the AI-based development tool Devika relates to the manipulation of cross-site requests. Exploiting this vulnerability allows a remote attacker to execute a CSRF attack...

CVE-2024-5926

A path traversal vulnerability in the get-project-files functionality of stitionai/devika allows attackers to read arbitrary files from the filesystem and cause a Denial of Service DoS. This issue is present in all versions of the application. The vulnerability arises due to insufficient path...

CVE-2024-5926 Path Traversal in stitionai/devika

A path traversal vulnerability in the get-project-files functionality of stitionai/devika allows attackers to read arbitrary files from the filesystem and cause a Denial of Service DoS. This issue is present in all versions of the application. The vulnerability arises due to insufficient path...

CVE-2024-5926 Path Traversal in stitionai/devika

A path traversal vulnerability in the get-project-files functionality of stitionai/devika allows attackers to read arbitrary files from the filesystem and cause a Denial of Service DoS. This issue is present in all versions of the application. The vulnerability arises due to insufficient path...