CVE-2025-0189: Allocation of Resources Without Limits or Throttling

In version 3.25.0 of aimhubio/aim, the tracking server is vulnerable to a denial of service attack. The server overrides the maximum size for websocket messages, allowing very large images to be tracked. This causes the server to become unresponsive to other requests while processing the large...

CVE-2024-8238: Improper Neutralization of Special Elements Used in a Template Engine

In version 3.22.0 of aimhubio/aim, the AimQL query language uses an outdated version of the safergetattr function from RestrictedPython. This version does not protect against the str.formatmap method, allowing an attacker to leak server-side secrets or potentially gain unrestricted code execution...

CVE-2024-8101: Improper Neutralization of Input During Web Page Generation

A stored cross-site scripting XSS vulnerability exists in the Text Explorer component of aimhubio/aim version 3.23.0. The vulnerability arises due to the use of dangerouslySetInnerHTML without proper sanitization, allowing arbitrary JavaScript execution when rendering tracked texts. This can be...

CVE-2024-6851: Improper Limitation of a Pathname to a Restricted Directory

In version 3.22.0 of aimhubio/aim, the LocalFileManager.cleanup function in the aim tracking server accepts a user-specified glob-pattern for deleting files. The function does not verify that the matched files are within the directory managed by LocalFileManager, allowing a maliciously crafted...

PT-2025-12170

Name of the Vulnerable Software and Affected Versions aimhubio/aim version 3.22.0 Description The issue concerns the LocalFileManager. cleanup function in the aim tracking server, which accepts a user-specified glob-pattern for deleting files. This function does not verify that the matched files...

Aim 安全漏洞

Aim is an easy-to-use and high-performance open source experiment tracker from Aim Open Source USA. A security vulnerability exists in Aim version 3.19.3, which stems from an unvalidated path to the tarfile.extractall function and could lead to arbitrary file extraction and overwriting...

Aim 路径遍历漏洞

Aim is an easy-to-use and high-performance open source experiment tracker from Aim Open Source USA. Aim version 3.22.0 suffers from a path traversal vulnerability that stems from the LocalFileManager.cleanup function failing to validate a file path, which could lead to arbitrary file deletion...

PT-2025-12305

Name of the Vulnerable Software and Affected Versions aimhubio/aim version 3.25.0 Description The tracking server in aimhubio/aim is vulnerable to a denial of service attack. This occurs because the server overrides the maximum size for websocket messages, allowing very large images to be tracked...

Aim 资源管理错误漏洞

Aim is an easy-to-use and high-performance open source experiment tracker from Aim Open Source USA. Aim version 3.23.0 suffers from a Resource Management Error vulnerability that originates when certain methods of requesting data from an external server do not have a timeout set, causing the serv...

CVE-2024-7760: Cross-Site Request Forgery (CSRF)

aimhubio/aim version 3.22.0 contains a Cross-Site Request Forgery CSRF vulnerability in the tracking server. The vulnerability is due to overly permissive CORS settings, allowing cross-origin requests from all origins. This enables CSRF attacks on all endpoints of the tracking server, which can b...

CVE-2023-31361: Uncontrolled Search Path Element

A DLL hijacking vulnerability in AMD Integrated Management Technology AIM-T Manageability Service could allow an attacker to achieve privilege escalation potentially resulting in arbitrary code execution...

CVE-2023-31360: Incorrect Default Permissions

Incorrect default permissions in the AMD Integrated Management Technology AIM-T Manageability Service installation directory could allow an attacker to achieve privilege escalation, potentially resulting in arbitrary code execution...

CVE-2024-9982

AIM LINE Marketing Platform from Esi Technology does not properly validate a specific query parameter. When the LINE Campaign Module is enabled, unauthenticated remote attackers can inject arbitrary FetchXml commands to read, modify, and delete database content...

CVE-2024-6227

A vulnerability in aimhubio/aim version 3.19.3 allows an attacker to cause an infinite loop by configuring the remote tracking server to point at itself. This results in the server endlessly connecting to itself, rendering it unable to respond to other connections...

The vulnerability in the web interface of the software for monitoring and registering machine learning experiments, Aim, allows a violator to trigger a service failure.

The vulnerability of the software interface for monitoring and registering machine learning experiments related to Aim is associated with blocking the server during processing due to uncontrolled resource consumption. Exploiting this vulnerability allows a malicious actor to cause service failure...

CVE-2024-13040 Quanta Computer QOCA aim - Authorization Bypass

The QOCA aim from Quanta Computer has an Authorization Bypass Through User-Controlled Key vulnerability. By controlling the user ID parameter, remote attackers with regular privileges could access certain features as any user, modify any user's account information and privileges, leading to...

CVE-2024-13040 Quanta Computer QOCA aim - Authorization Bypass

The QOCA aim from Quanta Computer has an Authorization Bypass Through User-Controlled Key vulnerability. By controlling the user ID parameter, remote attackers with regular privileges could access certain features as any user, modify any user's account information and privileges, leading to...

CVE-2024-13040

CVE-2024-13040 details (Quanta Computer QOCA aim): A vulnerability titled “Authorization Bypass Through User-Controlled Key” arises from allowing manipulation of the user ID parameter. Remote attackers with regular privileges could access features as any user, modify any user’s account informatio...

PT-2024-17898 · Quanta Computer · Qoca Aim

Name of the Vulnerable Software and Affected Versions: Quanta Computer's QOCA aim affected versions not specified Description: The QOCA aim from Quanta Computer has an Authorization Bypass Through User-Controlled Key issue. By controlling the user ID parameter, remote attackers with regular...

Quanta Computer QOCA aim 安全漏洞

Quanta Computer QOCA aim is an AI-assisted medical imaging and automated reasoning platform from Quanta Computer China. A security vulnerability exists in Quanta Computer QOCA aim that stems from an authorization bypass user control key vulnerability that allows a remote attacker with regular...