stitionai records
13 published records for vendor stitionai.
Researcher profile
- Entered KEV
- 0 · 0%
- Weaponized
- 0 · 0%
- Pre-auth RCE
- 1
- With a fix record
- 0%
- Median publish → KEV
- No record has entered KEV
Pre-auth RCE: flaws that let an attacker run code over the network without an account. Median publish → KEV: the typical time between a record being published and CISA listing it as exploited.
Recurring classes
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')3
- CWE-23 Relative Path Traversal2
- CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')2
- CWE-352 Cross-Site Request Forgery (CSRF)1
- CWE-73 External Control of File Name or Path1
- CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')1
The weakness classes this vendor ships most often: where to look.
CWEAll records
13 records| Action | CVE | Vulnerability | Severity | EPSS · Published |
|---|---|---|---|---|
39Monitor | CVE-2024-40422Proof of concept | The snapshot_path parameter in the /api/get-browser-snapshot endpoint in stitionai devika v1 is susceptible to a path traversal attack.stitionai · devika · CWE-22 | Critical9.1 | 11.4%Jul 24, 2024 |
36Monitor | CVE-2024-5926No exploit | Path Traversal in stitionai/devikastitionai · devika · CWE-29 | Critical9.1 | 0.8%Jun 29, 2024 |
35Monitor | CVE-2024-5820No exploit | Unprotected WebSocket in stitionai/devikastitionai · devika · CWE-862 | High8.8 | 0.7%Jun 27, 2024 |
32Monitor | CVE-2024-5549No exploit | Data leak through CORS misconfiguration in stitionai/devikastitionai · devika · CWE-346 | High8.1 | 0.2%Jul 8, 2024 |
32Monitor | CVE-2024-5712No exploit | CSRF Vulnerability in stitionai/devikastitionai · devika · CWE-352 | High8.1 | 0.2%Jun 28, 2024 |
31Monitor | CVE-2024-5334Proof of concept | Local File Read in stitionai/devikastitionai · devika · CWE-73 | High7.5 | 2.0%Jun 27, 2024 |
30Monitor | CVE-2024-5548No exploit | Directory Traversal in stitionai/devikastitionai · devika · CWE-22 | High7.5 | 1.0%Jun 27, 2024 |
30Monitor | CVE-2024-5547No exploit | Directory Traversal in stitionai/devikastitionai · devika · CWE-23 | High7.5 | 1.0%Jun 27, 2024 |
30Monitor | CVE-2024-6433No exploit | Local File Inclusion in stitionai/devikastitionai · stitionai/devika · CWE-23 | High7.5 | 0.5%Jul 9, 2024 |
26Monitor | CVE-2024-6331No exploit | Injection by Prompt Injection in stitionai/devikastitionai · devika · CWE-74 | Medium6.5 | 0.4%Aug 3, 2024 |
24Monitor | CVE-2024-5711No exploit | Stored XSS in stitionai/devikastitionai · devika · CWE-79 | Medium6.1 | 0.4%Jul 7, 2024 |
24Monitor | CVE-2024-5821No exploit | Local File Inclusion (LFI) in stitionai/devikastitionai · stitionai/devika · CWE-22 | Medium6.2 | 0.2%Jul 3, 2024 |
21Monitor | CVE-2024-7790No exploit | DevikaAI Stored Cross-Site Scriptingstitionai · devika · CWE-79 | Medium5.4 | 0.3%Aug 14, 2024 |
- CVE-2024-4042239Monitor
The snapshot_path parameter in the /api/get-browser-snapshot endpoint in stitionai devika v1 is susceptible to a path traversal attack.
CriticalCVSS 9.1Proof of conceptEPSS 11%stitionai · devikaJul 24, 2024
- CVE-2024-592636Monitor
Path Traversal in stitionai/devika
CriticalCVSS 9.1No exploitEPSS 0%stitionai · devikaJun 29, 2024
- CVE-2024-582035Monitor
Unprotected WebSocket in stitionai/devika
HighCVSS 8.8No exploitEPSS 0%stitionai · devikaJun 27, 2024
- CVE-2024-554932Monitor
Data leak through CORS misconfiguration in stitionai/devika
HighCVSS 8.1No exploitEPSS 0%stitionai · devikaJul 8, 2024
- CVE-2024-571232Monitor
CSRF Vulnerability in stitionai/devika
HighCVSS 8.1No exploitEPSS 0%stitionai · devikaJun 28, 2024
- CVE-2024-533431Monitor
Local File Read in stitionai/devika
HighCVSS 7.5Proof of conceptEPSS 2%stitionai · devikaJun 27, 2024
- CVE-2024-554830Monitor
Directory Traversal in stitionai/devika
HighCVSS 7.5No exploitEPSS 1%stitionai · devikaJun 27, 2024
- CVE-2024-554730Monitor
Directory Traversal in stitionai/devika
HighCVSS 7.5No exploitEPSS 1%stitionai · devikaJun 27, 2024
- CVE-2024-643330Monitor
Local File Inclusion in stitionai/devika
HighCVSS 7.5No exploitEPSS 0%stitionai · stitionai/devikaJul 9, 2024
- CVE-2024-633126Monitor
Injection by Prompt Injection in stitionai/devika
MediumCVSS 6.5No exploitEPSS 0%stitionai · devikaAug 3, 2024
- CVE-2024-571124Monitor
Stored XSS in stitionai/devika
MediumCVSS 6.1No exploitEPSS 0%stitionai · devikaJul 7, 2024
- CVE-2024-582124Monitor
Local File Inclusion (LFI) in stitionai/devika
MediumCVSS 6.2No exploitEPSS 0%stitionai · stitionai/devikaJul 3, 2024
- CVE-2024-779021Monitor
DevikaAI Stored Cross-Site Scripting
MediumCVSS 5.4No exploitEPSS 0%stitionai · devikaAug 14, 2024