CVE-2024-6227

CVE-2024-6227 affects the open-source tool aimhubio/aim version 3.19.3. The vulnerability arises when the remote tracking server is configured to point at itself, causing the server to endlessly connect to itself. This self-loop leads to a denial of service by rendering the server unresponsive to...

CVE-2024-6227 Infinite Loop in aimhubio/aim

A vulnerability in aimhubio/aim version 3.19.3 allows an attacker to cause an infinite loop by configuring the remote tracking server to point at itself. This results in the server endlessly connecting to itself, rendering it unable to respond to other connections...

Aim Resource Management Error Vulnerability

Aim is an easy-to-use and high-performance open source experiment tracker from Aim Open Source USA. Aim version 3.19.3 suffers from a Resource Management Error vulnerability that originates from allowing an attacker to cause a denial of service by configuring a remote tracking server to point to...

Aim Code Injection Vulnerability

Aim is an easy-to-use and high-performance open source experiment tracker from the United States. Aim suffers from a code injection vulnerability. The vulnerability stems from the application failing to properly filter special elements of constructed code segments. An attacker could exploit the...

Cross-Site Request Forgery (CSRF)

aim is vulnerable to Cross-Site Request Forgery CSRF. The vulnerability is due to the lack of CSRF and CORS protection in the aim dashboard, allowing attackers to perform actions such as deleting runs, updating data, and stealing data like log records and notes without the user's consent...

Aim Web API vulnerable to Remote Code Execution

A critical Remote Code Execution RCE vulnerability was identified in the aimhubio/aim project, specifically within the /api/runs/search/run/ endpoint, affecting versions = 3.0.0. The vulnerability resides in the runsearchapi function of the aim/web/api/runs/views.py file, where improper restricti...

Aim Cross-Site Request Forgery vulnerability allows user to delete runs and perform other operations

aimhubio/aim is vulnerable to Cross-Site Request Forgery CSRF, allowing attackers to perform actions such as deleting runs, updating data, and stealing data like log records and notes without the user's consent. The vulnerability stems from the lack of CSRF and CORS protection in the aim dashboar...

GHSA-99W2-67H8-5948 Aim Cross-Site Request Forgery vulnerability allows user to delete runs and perform other operations

aimhubio/aim is vulnerable to Cross-Site Request Forgery CSRF, allowing attackers to perform actions such as deleting runs, updating data, and stealing data like log records and notes without the user's consent. The vulnerability stems from the lack of CSRF and CORS protection in the aim dashboar...

GHSA-MXVW-CJ37-8G2H Aim Web API vulnerable to Remote Code Execution

A critical Remote Code Execution RCE vulnerability was identified in the aimhubio/aim project, specifically within the /api/runs/search/run/ endpoint, affecting versions = 3.0.0. The vulnerability resides in the runsearchapi function of the aim/web/api/runs/views.py file, where improper restricti...

CVE-2024-2195

A critical Remote Code Execution RCE vulnerability was identified in the aimhubio/aim project, specifically within the /api/runs/search/run/ endpoint, affecting versions = 3.0.0. The vulnerability resides in the runsearchapi function of the aim/web/api/runs/views.py file, where improper restricti...

CVE-2024-2196

aimhubio/aim is vulnerable to Cross-Site Request Forgery CSRF, allowing attackers to perform actions such as deleting runs, updating data, and stealing data like log records and notes without the user's consent. The vulnerability stems from the lack of CSRF and CORS protection in the aim dashboar...

CVE-2024-2195

A critical Remote Code Execution RCE vulnerability was identified in the aimhubio/aim project, specifically within the /api/runs/search/run/ endpoint, affecting versions = 3.0.0. The vulnerability resides in the runsearchapi function of the aim/web/api/runs/views.py file, where improper restricti...

CVE-2024-2196

The aimhubio/aim Cross-Site Request Forgery (CSRF) vulnerability is caused by missing CSRF and CORS protections in the aim dashboard. An attacker can lure a logged-in user into issuing unauthorized requests, enabling actions such as deleting runs, updating data, and exfiltrating log records or no...

CVE-2024-2196 CSRF Vulnerability in aimhubio/aim

aimhubio/aim is vulnerable to Cross-Site Request Forgery CSRF, allowing attackers to perform actions such as deleting runs, updating data, and stealing data like log records and notes without the user's consent. The vulnerability stems from the lack of CSRF and CORS protection in the aim dashboar...

CVE-2024-2196 CSRF Vulnerability in aimhubio/aim

aimhubio/aim is vulnerable to Cross-Site Request Forgery CSRF, allowing attackers to perform actions such as deleting runs, updating data, and stealing data like log records and notes without the user's consent. The vulnerability stems from the lack of CSRF and CORS protection in the aim dashboar...

CVE-2024-2195 Remote Code Execution in aimhubio/aim

A critical Remote Code Execution RCE vulnerability was identified in the aimhubio/aim project, specifically within the /api/runs/search/run/ endpoint, affecting versions = 3.0.0. The vulnerability resides in the runsearchapi function of the aim/web/api/runs/views.py file, where improper restricti...

CVE-2024-2195 Remote Code Execution in aimhubio/aim

A critical Remote Code Execution RCE vulnerability was identified in the aimhubio/aim project, specifically within the /api/runs/search/run/ endpoint, affecting versions = 3.0.0. The vulnerability resides in the runsearchapi function of the aim/web/api/runs/views.py file, where improper restricti...

Aim 代码注入漏洞

Aim is an easy-to-use and high-performance open source experiment tracker from the United States. Aim suffers from a code injection vulnerability. The vulnerability stems from the application failing to properly filter special elements of constructed code segments. An attacker could exploit the...

PT-2024-5058

Name of the Vulnerable Software and Affected Versions: aimhubio/aim versions = 3.0.0 Description: A critical Remote Code Execution RCE vulnerability was identified in the aimhubio/aim project, specifically within the "/api/runs/search/run/" endpoint. The vulnerability resides in the run search ap...

Aim 跨站请求伪造漏洞

Aim is an easy-to-use and high-performance open source experiment tracker from the United States. Aim suffers from a cross-site request forgery vulnerability. An attacker could use this vulnerability to perform actions such as deleting runs, updating data, and stealing data such as log records an...