CVE-2024-45786: Authorization Bypass Through User-Controlled Key

This vulnerability exists in Reedos aiM-Star version 2.0.1 due to improper access controls on its certain API endpoints. An authenticated remote attacker could exploit this vulnerability by manipulating a parameter through API request URL which could lead to gain unauthorized access to sensitive...

PT-2024-31768

Name of the Vulnerable Software and Affected Versions: Reedos aiM-Star version 2.0.1 Description: This issue exists due to missing rate limiting on OTP requests in certain API endpoints. An authenticated remote attacker could exploit this by sending multiple OTP requests through vulnerable API...

CVE-2024-45789: Improper Validation of Integrity Check Value

This vulnerability exists in Reedos aiM-Star version 2.0.1 due to improper validation of the ‘mode’ parameter in the API endpoint used during the registration process. An authenticated remote attacker could exploit this vulnerability by manipulating parameter in the API request body on the...

CVE-2024-45790: Improper Restriction of Excessive Authentication Attempts

This vulnerability exists in Reedos aiM-Star version 2.0.1 due to missing restrictions for excessive failed authentication attempts on its API based login. A remote attacker could exploit this vulnerability by conducting a brute force attack against legitimate user passwords, which could lead to...

PT-2024-31769

Name of the Vulnerable Software and Affected Versions: Reedos aiM-Star version 2.0.1 Description: This issue exists due to improper validation of the mode parameter in the API endpoint used during the registration process. An authenticated remote attacker could exploit this by manipulating the...

Reedos aiM-Star security vulnerability

Reedos aiM-Star is a software product from Reedos for mutual fund distribution. A security vulnerability exists in Reedos aiM-Star version 2.0.1, which stems from the lack of a restriction on excessive failed authentication attempts for API-based logins, which could lead to unauthorized access an...

Reedos aiM-Star security vulnerability

Reedos aiM-Star is a software product from Reedos for mutual fund distribution. A security vulnerability exists in Reedos aiM-Star version 2.0.1 that stems from improper validation of the mode parameter in the API endpoint used during the enrollment process, which allows an attacker to bypass...

Reedos aiM-Star security vulnerability

Reedos aiM-Star is a software product from Reedos for mutual fund distribution. A security vulnerability exists in Reedos aiM-Star version 2.0.1, which stems from a lack of rate limiting for OTP requests in certain API endpoints, which could allow an attacker to send multiple OTP requests through...

Reedos aiM-Star security vulnerability

Reedos aiM-Star is a software product from Reedos for mutual fund distribution. A security vulnerability exists in Reedos aiM-Star version 2.0.1 that originates from the transmission of sensitive information in plain text in certain API endpoints, resulting in the exposure of sensitive informatio...

Reedos aiM-Star security vulnerability

Reedos aiM-Star is a software product from Reedos for mutual fund distribution. A security vulnerability exists in Reedos aiM-Star version 2.0.1 that stems from improper access control to certain API endpoints, which allows an attacker to manipulate parameters to access sensitive information via ...

GHSA-P9F2-JG9W-CX69 Aim Stored Cross-site Scripting Vulnerability

A stored cross-site scripting XSS vulnerability exists in aimhubio/aim version 3.19.3. The vulnerability arises from the improper neutralization of input during web page generation, specifically in the logs-tab for runs. The terminal output logs are displayed using the dangerouslySetInnerHTML...

llm-toys (0.1.1), tcbench (>=0.0.20, <=0.0.22) +1 more potentially affected by CVE-2024-6578 via aim (>=3.17.4, <=3.19.3)

aim PYPI version =3.17.4, =0.0.20, =0.1.0, =0.5.6 Source cves: CVE-2024-6578 Source advisory: OSV:GHSA-P9F2-JG9W-CX69...

llm-toys (0.1.1), tcbench (>=0.0.20, <=0.0.22) +1 more potentially affected by CVE-2024-6578 via aim (>=3.17.4, <=3.19.3)

aim PYPI version =3.17.4, =0.0.20, =0.1.0, =0.5.6 Source cves: CVE-2024-6578 Source advisory: GHSA-P9F2-JG9W-CX69...

CVE-2024-6578 Stored XSS in aimhubio/aim

A stored cross-site scripting XSS vulnerability exists in aimhubio/aim version 3.19.3. The vulnerability arises from the improper neutralization of input during web page generation, specifically in the logs-tab for runs. The terminal output logs are displayed using the dangerouslySetInnerHTML...

CVE-2024-6578

Stored XSS in aimhubio/aim 3.19.3 affects the logs-tab rendering, where logs are output with React dangerouslySetInnerHTML, allowing injected scripts to execute when a user views logs. Root cause: improper neutralization of input during web page generation. Impact: potential script execution in a...

CVE-2024-6578

A stored cross-site scripting XSS vulnerability exists in aimhubio/aim version 3.19.3. The vulnerability arises from the improper neutralization of input during web page generation, specifically in the logs-tab for runs. The terminal output logs are displayed using the "dangerouslySetInnerHTML"...

CVE-2024-6578 Stored XSS in aimhubio/aim

A stored cross-site scripting XSS vulnerability exists in aimhubio/aim version 3.19.3. The vulnerability arises from the improper neutralization of input during web page generation, specifically in the logs-tab for runs. The terminal output logs are displayed using the dangerouslySetInnerHTML...

CVE-2024-6578 Stored XSS in aimhubio/aim

A stored cross-site scripting XSS vulnerability exists in aimhubio/aim version 3.19.3. The vulnerability arises from the improper neutralization of input during web page generation, specifically in the logs-tab for runs. The terminal output logs are displayed using the dangerouslySetInnerHTML...

CVE-2024-6578: Improper Neutralization of Input During Web Page Generation

A stored cross-site scripting XSS vulnerability exists in aimhubio/aim version 3.19.3. The vulnerability arises from the improper neutralization of input during web page generation, specifically in the logs-tab for runs. The terminal output logs are displayed using the dangerouslySetInnerHTML...

Aim: Cross-site scripting vulnerabilities

Aim is an easy-to-use and high-performance open source experiment tracker from Aim Open Source USA. Aim version 3.19.3 suffers from a cross-site scripting vulnerability that stems from incorrect neutralization of inputs during web page generation, which results in susceptibility to cross-site...