CVE-2024-24593

A cross-site request forgery CSRF vulnerability in all versions up to 1.14.1 of the api server component of Allegro AI’s ClearML platform allows a remote attacker to impersonate a user by sending API requests via maliciously crafted html. Exploitation of the vulnerability allows an attacker to...

CVE-2024-24593

A cross-site request forgery CSRF vulnerability in all versions up to 1.14.1 of the api server component of Allegro AI’s ClearML platform allows a remote attacker to impersonate a user by sending API requests via maliciously crafted html. Exploitation of the vulnerability allows an attacker to...

CVE-2024-24592

Lack of authentication in all versions of the fileserver component of Allegro AI’s ClearML platform allows a remote attacker to arbitrarily access, create, modify and delete files...

CVE-2024-24592

The connected Nessus entry ties CVE-2024-24592 to ClearML’s fileserver, indicating an unauthenticated file access flaw in ClearML

CVE-2024-24592

Lack of authentication in all versions of the fileserver component of Allegro AI’s ClearML platform allows a remote attacker to arbitrarily access, create, modify and delete files...

CVE-2024-24591

A path traversal vulnerability in versions 1.4.0 to 1.14.1 of the client SDK of Allegro AI’s ClearML platform enables a maliciously uploaded dataset to write local or remote files to an arbitrary location on an end user’s system when interacted with...

CVE-2024-24591

Summary of CVE-2024-24591 : A path traversal vulnerability affects Allegro AI’s ClearML platform client SDK versions 1.4.0 through 1.14.1. The issue arises when handling uploaded datasets, allowing a malicious dataset to write local or remote files to arbitrary locations on an end user’s system u...

CVE-2024-24591

A path traversal vulnerability in versions 1.4.0 to 1.14.1 of the client SDK of Allegro AI’s ClearML platform enables a maliciously uploaded dataset to write local or remote files to an arbitrary location on an end user’s system when interacted with...

CVE-2024-24591

A path traversal vulnerability in versions 1.4.0 to 1.14.1 of the client SDK of Allegro AI’s ClearML platform enables a maliciously uploaded dataset to write local or remote files to an arbitrary location on an end user’s system when interacted with...

CVE-2024-24590

Deserialization of untrusted data can occur in versions 0.17.0 to 1.14.2 of the client SDK of Allegro AI’s ClearML platform, enabling a maliciously uploaded artifact to run arbitrary code on an end user’s system when interacted with...

CVE-2024-24590

ClearML (Allegro AI) client SDK vulnerabilities: deserialization of untrusted data in versions 0.17.0–1.14.2 can allow remote code execution via a malicious pickle artifact. Root cause: unsafe Python pickle deserialization during artifact processing. Impact: arbitrary code execution/reverse shell...

CVE-2024-24590

Deserialization of untrusted data can occur in versions 0.17.0 to 1.14.2 of the client SDK of Allegro AI’s ClearML platform, enabling a maliciously uploaded artifact to run arbitrary code on an end user’s system when interacted with...

CVE-2024-24590

Deserialization of untrusted data can occur in versions 0.17.0 to 1.14.2 of the client SDK of Allegro AI’s ClearML platform, enabling a maliciously uploaded artifact to run arbitrary code on an end user’s system when interacted with...

Allegro AI ClearML Stores Credentials in Plaintext in MongoDB Instance

Allegro AI’s open-source version of ClearML stores passwords in plaintext within the MongoDB instance, resulting in a compromised server leaking all user emails and passwords...

GHSA-GVQV-H7HH-6FCC Allegro AI ClearML Stores Credentials in Plaintext in MongoDB Instance

Allegro AI’s open-source version of ClearML stores passwords in plaintext within the MongoDB instance, resulting in a compromised server leaking all user emails and passwords...

PT-2024-20472

Name of the Vulnerable Software and Affected Versions Allegro AI’s ClearML platform versions 0.17.0 through 1.14.2 Description Deserialization of untrusted data can occur in the client SDK of Allegro AI’s ClearML platform, enabling a maliciously uploaded artifact to run arbitrary code on an end...

PT-2024-20473

Name of the Vulnerable Software and Affected Versions Allegro AI's ClearML platform versions 1.4.0 through 1.14.1 Description A path traversal vulnerability in the client SDK of Allegro AI's ClearML platform enables a maliciously uploaded dataset to write local or remote files to an arbitrary...

Allegro Path Traversal Vulnerability

Allegro is an open source cross-platform library from Allegro that focuses on video game and multimedia programming. A path traversal vulnerability exists in Allegro AI ClearML version 1.4.0 and later. An attacker can exploit this vulnerability to write a local or remote file to an arbitrary...

Allegro Code Issue Vulnerability

Allegro is a cross-platform library open-sourced by Allegro primarily for video game and multimedia programming. A code issue vulnerability exists in Allegro AI ClearML version 0.17.0 and later versions that stems from untrusted data deserialization. An attacker can exploit this vulnerability to...

Allegro Authorization Issues Vulnerability

Allegro is a cross-platform library open-sourced by Allegro primarily for video game and multimedia programming. A security vulnerability exists in Allegro AI ClearML that stems from a lack of authentication, which allows remote attackers to arbitrarily access, create, modify, and delete files...