PT-2025-12245

Name of the Vulnerable Software and Affected Versions aimhubio/aim version bb76afe Description A vulnerability in the LockManager.release locks function allows for arbitrary file deletion through relative path traversal. The run hash parameter, which is user-controllable, is concatenated without...

Aim 资源管理错误漏洞

Aim is an easy-to-use and high-performance open source experiment tracker from Aim Open Source USA. Aim version 3.25.0 suffers from a resource management error vulnerability that stems from the tracking server's susceptibility to denial-of-service attacks, which may cause the server to be...

Aim 安全漏洞

Aim is an easy-to-use and high-performance open source experiment tracker from Aim Open Source USA. A security vulnerability exists in Aim version 3.23.0, which stems from a failure to properly clean up the Text Explorer component when using dangerouslySetInnerHTML, allowing arbitrary JavaScript ...

Aim 跨站请求伪造漏洞

Aim is an easy-to-use and high-performance open source experiment tracker from Aim Open Source USA. Aim version 3.22.0 suffers from a cross-site request forgery vulnerability that originates from allowing remote code execution, denial of service, and arbitrary file reads and writes...

Aim 访问控制错误漏洞

Aim is an easy-to-use and high-performance open source experiment tracker from Aim Open Source USA. An access control error vulnerability exists in Aim version 3.22.0, which stems from the AimQL query language's use of the outdated safergetattr function and unprotected str.formatmap method, which...

Aim 安全漏洞

Aim is an easy-to-use and high-performance open source experiment tracker from Aim Open Source USA. A security vulnerability exists in the bb76afe version of Aim, which stems from the LockManager.releaselocks function not normalizing user-controllable parameters, which could lead to arbitrary fil...

PT-2025-12026

Name of the Vulnerable Software and Affected Versions aimhubio/aim version 3.23.0 Description The ScheduledStatusReporter object can be instantiated to run on the main thread of the tracking server, leading to the main thread being blocked indefinitely. This results in a denial of service as the...

Aim 安全漏洞

Aim is an easy-to-use and high-performance open source experiment tracker from Aim Open Source USA. A security vulnerability exists in Aim version 3.25.0 that originates when tracking a large number of Text objects and querying them simultaneously via the Web API, which can lead to server...

Aim 资源管理错误漏洞

Aim is an easy-to-use and high-performance open source experiment tracker from Aim Open Source USA. Aim version 3.25.0 suffers from a Resource Management Error vulnerability that stems from not limiting the number of requested metrics, which could lead to a denial of service attack...

PT-2025-12170

Name of the Vulnerable Software and Affected Versions aimhubio/aim version 3.22.0 Description The issue concerns the LocalFileManager. cleanup function in the aim tracking server, which accepts a user-specified glob-pattern for deleting files. This function does not verify that the matched files...

Aim 资源管理错误漏洞

Aim is an easy-to-use and high-performance open source experiment tracker from Aim Open Source USA. Aim version 3.23.0 suffers from a Resource Management Error vulnerability that originates when certain methods of requesting data from an external server do not have a timeout set, causing the serv...

PT-2025-12305

Name of the Vulnerable Software and Affected Versions aimhubio/aim version 3.25.0 Description The tracking server in aimhubio/aim is vulnerable to a denial of service attack. This occurs because the server overrides the maximum size for websocket messages, allowing very large images to be tracked...

Aim 安全漏洞

Aim is an easy-to-use and high-performance open source experiment tracker from Aim Open Source USA. A security vulnerability exists in Aim version 3.25.0 that stems from an unset timeout and could lead to a denial of service attack...

Aim 安全漏洞

Aim is an easy-to-use and high-performance open source experiment tracker from Aim Open Source USA. A security vulnerability exists in Aim version 3.19.3, which stems from an unvalidated path to the tarfile.extractall function and could lead to arbitrary file extraction and overwriting...

Aim 路径遍历漏洞

Aim is an easy-to-use and high-performance open source experiment tracker from Aim Open Source USA. Aim version 3.22.0 suffers from a path traversal vulnerability that stems from the LocalFileManager.cleanup function failing to validate a file path, which could lead to arbitrary file deletion...

PT-2025-12162

Name of the Vulnerable Software and Affected Versions aimhubio/aim version 3.19.3 Description A vulnerability in the "runs/delete-batch" endpoint allows for arbitrary file or directory deletion through path traversal. The endpoint does not mitigate path traversal when handling user-specified...

CVE-2024-9982

AIM LINE Marketing Platform from Esi Technology does not properly validate a specific query parameter. When the LINE Campaign Module is enabled, unauthenticated remote attackers can inject arbitrary FetchXml commands to read, modify, and delete database content...

CVE-2024-6227

A vulnerability in aimhubio/aim version 3.19.3 allows an attacker to cause an infinite loop by configuring the remote tracking server to point at itself. This results in the server endlessly connecting to itself, rendering it unable to respond to other connections...

The vulnerability in the web interface of the software for monitoring and registering machine learning experiments, Aim, allows a violator to trigger a service failure.

The vulnerability of the software interface for monitoring and registering machine learning experiments related to Aim is associated with blocking the server during processing due to uncontrolled resource consumption. Exploiting this vulnerability allows a malicious actor to cause service failure...

CVE-2024-13040 Quanta Computer QOCA aim - Authorization Bypass

The QOCA aim from Quanta Computer has an Authorization Bypass Through User-Controlled Key vulnerability. By controlling the user ID parameter, remote attackers with regular privileges could access certain features as any user, modify any user's account information and privileges, leading to...