679 matches found
CVE-2024-8238: Improper Neutralization of Special Elements Used in a Template Engine
In version 3.22.0 of aimhubio/aim, the AimQL query language uses an outdated version of the safergetattr function from RestrictedPython. This version does not protect against the str.formatmap method, allowing an attacker to leak server-side secrets or potentially gain unrestricted code execution...
CVE-2024-12778: Allocation of Resources Without Limits or Throttling
A vulnerability in aimhubio/aim version 3.25.0 allows for a denial of service DoS attack. The issue arises when a large number of tracked metrics are retrieved simultaneously from the Aim web API, causing the web server to become unresponsive. The root cause is the lack of a limit on the number o...
CVE-2024-8061: Synchronous Access of Remote Resource without Timeout
In version 3.23.0 of aimhubio/aim, certain methods that request data from external servers do not have set timeouts, causing the server to wait indefinitely for a response. This can lead to a denial of service, as the tracking server does not respond to other requests while waiting. The issue...
CVE-2024-8769: Improper Limitation of a Pathname to a Restricted Directory
A vulnerability in the LockManager.releaselocks function in aimhubio/aim commit bb76afe allows for arbitrary file deletion through relative path traversal. The runhash parameter, which is user-controllable, is concatenated without normalization as part of a path used to specify file deletion. Thi...
CVE-2025-0189: Allocation of Resources Without Limits or Throttling
In version 3.25.0 of aimhubio/aim, the tracking server is vulnerable to a denial of service attack. The server overrides the maximum size for websocket messages, allowing very large images to be tracked. This causes the server to become unresponsive to other requests while processing the large...
Aim 资源管理错误漏洞
Aim is an easy-to-use and high-performance open source experiment tracker from Aim Open Source USA. Aim version 3.25.0 suffers from a resource management error vulnerability that stems from the tracking server's susceptibility to denial-of-service attacks, which may cause the server to be...
CVE-2024-6829: External Control of File Name or Path
A vulnerability in aimhubio/aim version 3.19.3 allows an attacker to exploit the tarfile.extractall function to extract the contents of a maliciously crafted tarfile to arbitrary locations on the host server. The attacker can control repo.path and runhash to bypass directory existence checks and...
PT-2025-12170
Name of the Vulnerable Software and Affected Versions aimhubio/aim version 3.22.0 Description The issue concerns the LocalFileManager. cleanup function in the aim tracking server, which accepts a user-specified glob-pattern for deleting files. This function does not verify that the matched files...
CVE-2023-31361: Uncontrolled Search Path Element
A DLL hijacking vulnerability in AMD Integrated Management Technology AIM-T Manageability Service could allow an attacker to achieve privilege escalation potentially resulting in arbitrary code execution...
CVE-2023-31360: Incorrect Default Permissions
Incorrect default permissions in the AMD Integrated Management Technology AIM-T Manageability Service installation directory could allow an attacker to achieve privilege escalation, potentially resulting in arbitrary code execution...
CVE-2024-9982
AIM LINE Marketing Platform from Esi Technology does not properly validate a specific query parameter. When the LINE Campaign Module is enabled, unauthenticated remote attackers can inject arbitrary FetchXml commands to read, modify, and delete database content...
CVE-2024-6227
A vulnerability in aimhubio/aim version 3.19.3 allows an attacker to cause an infinite loop by configuring the remote tracking server to point at itself. This results in the server endlessly connecting to itself, rendering it unable to respond to other connections...
The vulnerability in the web interface of the software for monitoring and registering machine learning experiments, Aim, allows a violator to trigger a service failure.
The vulnerability of the software interface for monitoring and registering machine learning experiments related to Aim is associated with blocking the server during processing due to uncontrolled resource consumption. Exploiting this vulnerability allows a malicious actor to cause service failure...
CVE-2024-13040 Quanta Computer QOCA aim - Authorization Bypass
The QOCA aim from Quanta Computer has an Authorization Bypass Through User-Controlled Key vulnerability. By controlling the user ID parameter, remote attackers with regular privileges could access certain features as any user, modify any user's account information and privileges, leading to...
CVE-2024-13040
CVE-2024-13040 details (Quanta Computer QOCA aim): A vulnerability titled “Authorization Bypass Through User-Controlled Key” arises from allowing manipulation of the user ID parameter. Remote attackers with regular privileges could access features as any user, modify any user’s account informatio...
CVE-2024-13040 Quanta Computer QOCA aim - Authorization Bypass
The QOCA aim from Quanta Computer has an Authorization Bypass Through User-Controlled Key vulnerability. By controlling the user ID parameter, remote attackers with regular privileges could access certain features as any user, modify any user's account information and privileges, leading to...
PT-2024-17898 · Quanta Computer · Qoca Aim
Name of the Vulnerable Software and Affected Versions: Quanta Computer's QOCA aim affected versions not specified Description: The QOCA aim from Quanta Computer has an Authorization Bypass Through User-Controlled Key issue. By controlling the user ID parameter, remote attackers with regular...
Quanta Computer QOCA aim 安全漏洞
Quanta Computer QOCA aim is an AI-assisted medical imaging and automated reasoning platform from Quanta Computer China. A security vulnerability exists in Quanta Computer QOCA aim that stems from an authorization bypass user control key vulnerability that allows a remote attacker with regular...
AMD Management Plugin for SCCM Incorrect Default Permissions Vulnerability
Bulletin ID: AMD-SB-9005 Potential Impact: Incorrect Default Permissions Leading to Arbitrary Execution Severity: High Summary An incorrect default permissions vulnerability is identified within the AMD Management Plugin for the Microsoft® System Center Configuration Manager SCCM. The plugin is...
