PT-2024-20472

Name of the Vulnerable Software and Affected Versions Allegro AI’s ClearML platform versions 0.17.0 through 1.14.2 Description Deserialization of untrusted data can occur in the client SDK of Allegro AI’s ClearML platform, enabling a maliciously uploaded artifact to run arbitrary code on an end...

Allegro Cross-Site Scripting Vulnerability

Allegro is a cross-platform library open-sourced by Allegro primarily for video game and multimedia programming. A security vulnerability exists in Allegro AI ClearML. An attacker can exploit this vulnerability to execute a JavaScript payload when a user views the "Debug Samples" tab in the Web U...

Allegro Authorization Issues Vulnerability

Allegro is a cross-platform library open-sourced by Allegro primarily for video game and multimedia programming. A security vulnerability exists in Allegro AI ClearML that stems from a lack of authentication, which allows remote attackers to arbitrarily access, create, modify, and delete files...

Allegro Cross-Site Request Forgery Vulnerability

Allegro is a cross-platform library open-sourced by Allegro primarily for video game and multimedia programming. A cross-site request forgery vulnerability exists in Allegro AI ClearML. A remote attacker can use this vulnerability to impersonate a user by sending API requests via maliciously...

CVE-2024-24595

Allegro AI’s open-source version of ClearML stores passwords in plaintext within the MongoDB instance, resulting in a compromised server leaking all user emails and passwords...

Design/Logic Flaw

Allegro AI’s open-source version of ClearML stores passwords in plaintext within the MongoDB instance, resulting in a compromised server leaking all user emails and passwords...

CVE-2024-24595

Allegro AI’s open-source version of ClearML stores passwords in plaintext within the MongoDB instance, resulting in a compromised server leaking all user emails and passwords...

CVE-2024-24595

Allegro AI’s open-source version of ClearML stores passwords in plaintext within the MongoDB instance, resulting in a compromised server leaking all user emails and passwords...

CVE-2024-24595

CVE-2024-24595 affects Allegro AI ClearML (open-source) with a plaintext password storage flaw in the MongoDB instance, causing potential leakage of user emails and passwords. Root cause: credentials stored unencrypted in MongoDB. Impact: server compromise possible; confidentiality and integrity ...

PT-2024-20477

Name of the Vulnerable Software and Affected Versions ClearML affected versions not specified Description The issue concerns the storage of passwords in plaintext within the MongoDB instance of Allegro AI's open-source version of ClearML. This results in a compromised server potentially leaking a...

Allegro AI ClearML Security Vulnerability

Allegro is a cross-platform library open-sourced by Allegro primarily for video game and multimedia programming. A security vulnerability exists in Allegro AI ClearML that stems from storing passwords in plaintext in a MongoDB instance, causing an infected server to disclose all user emails and...

CVE-2024-0522

A vulnerability was found in Allegro RomPager 4.01. It has been classified as problematic. Affected is an unknown function of the file usertable.htm?action=delete of the component HTTP POST Request Handler. The manipulation of the argument username leads to cross-site request forgery. It is...

CVE-2024-0522

A vulnerability was found in Allegro RomPager 4.01. It has been classified as problematic. Affected is an unknown function of the file usertable.htm?action=delete of the component HTTP POST Request Handler. The manipulation of the argument username leads to cross-site request forgery. It is...

CVE-2024-0522 Allegro RomPager HTTP POST Request cross-site request forgery

A vulnerability was found in Allegro RomPager 4.01. It has been classified as problematic. Affected is an unknown function of the file usertable.htm?action=delete of the component HTTP POST Request Handler. The manipulation of the argument username leads to cross-site request forgery. It is...

CVE-2024-0522 Allegro RomPager HTTP POST Request cross-site request forgery

A vulnerability was found in Allegro RomPager 4.01. It has been classified as problematic. Affected is an unknown function of the file usertable.htm?action=delete of the component HTTP POST Request Handler. The manipulation of the argument username leads to cross-site request forgery. It is...

CVE-2024-0522

CVE-2024-0522 originates from Allegro RomPager 4.01, where CSRF can be triggered via the HTTP POST Request Handler in the file usertable.htm?action=delete , allowing remote exploitation. The underlying issue is a manipulation of the username argument that enables cross-site request forgery. Affec...

Allegro RomPager Cross-Site Request Forgery Vulnerability

Allegro is an open source Allegro cross-platform library primarily for video games and multimedia programming. A cross-site request forgery vulnerability exists in Allegro RomPager version 4.01, which stems from a cross-site request forgery CSRF vulnerability in the HTTP POST component of the fil...

allegro-hk.com Cross Site Scripting vulnerability OBB-3829454

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

allegro-bg.com Improper Access Control vulnerability OBB-3819011

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

allegrohotel.si Cross Site Scripting vulnerability OBB-3752372

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...