Devika
Vendor:
First CVE: Jun 27, 2024 · Active for 2 years
11
Total CVEs
More Total CVEs than 89% of tracked products
11.0
Avg CVEs / Year
Higher CVE frequency than 96% of tracked products
7.6
Avg CVSS
Higher Avg CVSS than 60% of tracked products
0.0%
KEV Rate
Bottom 1%
Trends Over Time
The number and severity of CVEs published that impact Devika over time
Volume of CVEsAvg CVSS Base Score
First CVE
Jun 27, 2024
2 years ago
Most Recent CVE
Aug 14, 2024
709 days ago
CVE Severity & Scoring
Devika11 CVEs
27%
55%
18%
All CVEs352,294 CVEs
45%
40%
11%
MediumHighCritical
Attack Vector
Local0 (0.0%)
Network11 (100.0%)
Unknown0 (0.0%)
Physical0 (0.0%)
Adjacent Network0 (0.0%)
Attack Complexity
Low11 (100.0%)
High0 (0.0%)
Unknown0 (0.0%)
User Interaction
None6 (54.5%)
Unknown0 (0.0%)
Required5 (45.5%)
Privileges Required
Low2 (18.2%)
High0 (0.0%)
None9 (81.8%)
Unknown0 (0.0%)
Top CVEs
Signals from CVEs in this product scope (11 CVEs).
11 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2024-40422CRITICAL The snapshot_path parameter in the /api/get-browser-snapshot endpoint in stitionai devika v1 is susceptible to a path traversal attack. An attacker can manipulate the snapshot_path | Jul 24, 2024 | 9.1 | 52 | NO | YES |
CVE-2024-5334HIGH A local file read vulnerability exists in the stitionai/devika repository, affecting the latest version. The vulnerability is due to improper handling of the 'snapshot_path' parame | Jun 27, 2024 | 7.5 | 30 | NO | YES |
CVE-2024-5926CRITICAL A path traversal vulnerability in the get-project-files functionality of stitionai/devika allows attackers to read arbitrary files from the filesystem and cause a Denial of Service | Jun 30, 2024 | 9.1 | 26 | NO | NO |
CVE-2024-5820HIGH An unprotected WebSocket connection in the latest version of stitionai/devika (commit ecee79f) allows a malicious website to connect to the backend and issue commands on behalf of | Jun 27, 2024 | 8.8 | 24 | NO | NO |
CVE-2024-5712HIGH A Cross-Site Request Forgery (CSRF) vulnerability was identified in the stitionai/devika application, affecting the latest version. This vulnerability allows attackers to perform u | Jun 28, 2024 | 8.1 | 23 | NO | NO |
CVE-2024-5549HIGH A CORS misconfiguration in the stitionai/devika repository allows attackers to steal sensitive information such as logs, browser sessions, and settings containing private API keys | Jul 9, 2024 | 8.1 | 22 | NO | NO |
CVE-2024-5548HIGH A directory traversal vulnerability exists in the stitionai/devika repository, specifically within the /api/download-project endpoint. Attackers can exploit this vulnerability by m | Jun 27, 2024 | 7.5 | 21 | NO | NO |
CVE-2024-6331MEDIUM stitionai/devika main branch as of commit cdfb782b0e634b773b10963c8034dc9207ba1f9f is vulnerable to Local File Read (LFI) by Prompt Injection. The integration of Google Gimini 1.0 | Aug 4, 2024 | 6.5 | 20 | NO | NO |
CVE-2024-5547HIGH A directory traversal vulnerability exists in the /api/download-project-pdf endpoint of the stitionai/devika repository, affecting the latest version. The vulnerability arises due | Jun 27, 2024 | 7.5 | 20 | NO | NO |
CVE-2024-5711MEDIUM A stored Cross-Site Scripting (XSS) vulnerability exists in the stitionai/devika chat feature, allowing attackers to inject malicious payloads into the chat input. This vulnerabili | Jul 8, 2024 | 6.1 | 18 | NO | NO |
Exploit Exposure
Signals from CVEs in this product scope (11 CVEs).
CISA KEV
0 CVEs
0.0% of CVEs· Bottom 1%
Metasploit
0 CVEs
0.0% of CVEs· Bottom 1%
Nuclei
2 CVEs
18.2% of CVEs· 98th percentile
ExploitDB
1 CVE
9.1% of CVEs· 89th percentile
Social Chatter
Signals from CVEs in this product scope (11 CVEs).
Media Mentions
Signals from CVEs in this product scope (11 CVEs).
Top CNAs Publishing CVEs For Devika
Top CWEs
Versions
| Version | CVE Count | Avg CVSS | Avg EPSS | KEV | Exploits |
|---|---|---|---|---|---|
| 1.0 | 7 | 8.1 | 2.4% | 0 | 2 |