193 matches found
vtorch (>=0.2.19, <=1.4.2) potentially affected by CVE-2024-24595 via clearml (0.17.4)
clearml PYPI version 0.17.4 is affected by a known vulnerability. The following packages have a transitive dependency on clearml and may be impacted: - vtorch =0.2.19, =1.4.2 Source cves: CVE-2024-24595 Source advisory: OSV:GHSA-GVQV-H7HH-6FCC...
GHSA-GVQV-H7HH-6FCC Allegro AI ClearML Stores Credentials in Plaintext in MongoDB Instance
Allegro AI’s open-source version of ClearML stores passwords in plaintext within the MongoDB instance, resulting in a compromised server leaking all user emails and passwords...
CVE-2024-24591: Improper Limitation of a Pathname to a Restricted Directory
A path traversal vulnerability in versions 1.4.0 to 1.14.1 of the client SDK of Allegro AI’s ClearML platform enables a maliciously uploaded dataset to write local or remote files to an arbitrary location on an end user’s system when interacted with...
CVE-2024-24590: Deserialization of Untrusted Data
Deserialization of untrusted data can occur in versions 0.17.0 to 1.14.2 of the client SDK of Allegro AI’s ClearML platform, enabling a maliciously uploaded artifact to run arbitrary code on an end user’s system when interacted with...
CVE-2024-24594: Improper Neutralization of Input During Web Page Generation
A cross-site scripting XSS vulnerability in all versions of the web server component of Allegro AI’s ClearML platform allows a remote attacker to execute a JavaScript payload when a user views the Debug Samples tab in the web UI...
Allegro Code Issue Vulnerability
Allegro is a cross-platform library open-sourced by Allegro primarily for video game and multimedia programming. A code issue vulnerability exists in Allegro AI ClearML version 0.17.0 and later versions that stems from untrusted data deserialization. An attacker can exploit this vulnerability to...
Allegro Authorization Issues Vulnerability
Allegro is a cross-platform library open-sourced by Allegro primarily for video game and multimedia programming. A security vulnerability exists in Allegro AI ClearML that stems from a lack of authentication, which allows remote attackers to arbitrarily access, create, modify, and delete files...
CVE-2024-24592: Direct Request
Lack of authentication in all versions of the fileserver component of Allegro AI’s ClearML platform allows a remote attacker to arbitrarily access, create, modify and delete files...
PT-2024-20473
Name of the Vulnerable Software and Affected Versions Allegro AI's ClearML platform versions 1.4.0 through 1.14.1 Description A path traversal vulnerability in the client SDK of Allegro AI's ClearML platform enables a maliciously uploaded dataset to write local or remote files to an arbitrary...
Allegro Cross-Site Request Forgery Vulnerability
Allegro is a cross-platform library open-sourced by Allegro primarily for video game and multimedia programming. A cross-site request forgery vulnerability exists in Allegro AI ClearML. A remote attacker can use this vulnerability to impersonate a user by sending API requests via maliciously...
PT-2024-20472
Name of the Vulnerable Software and Affected Versions Allegro AI’s ClearML platform versions 0.17.0 through 1.14.2 Description Deserialization of untrusted data can occur in the client SDK of Allegro AI’s ClearML platform, enabling a maliciously uploaded artifact to run arbitrary code on an end...
Allegro Path Traversal Vulnerability
Allegro is an open source cross-platform library from Allegro that focuses on video game and multimedia programming. A path traversal vulnerability exists in Allegro AI ClearML version 1.4.0 and later. An attacker can exploit this vulnerability to write a local or remote file to an arbitrary...
PT-2024-20476 · Allegro Ai · Clearml
Name of the Vulnerable Software and Affected Versions: Allegro AI's ClearML platform affected versions not specified Description: A cross-site scripting XSS vulnerability in the web server component of Allegro AI's ClearML platform allows a remote attacker to execute a JavaScript payload when a...
Allegro Cross-Site Scripting Vulnerability
Allegro is a cross-platform library open-sourced by Allegro primarily for video game and multimedia programming. A security vulnerability exists in Allegro AI ClearML. An attacker can exploit this vulnerability to execute a JavaScript payload when a user views the "Debug Samples" tab in the Web U...
PT-2024-20475
Name of the Vulnerable Software and Affected Versions Allegro AI’s ClearML platform versions prior to 1.14.1 Description A cross-site request forgery CSRF vulnerability allows a remote attacker to impersonate a user by sending API requests via maliciously crafted HTML. This can lead to the...
CVE-2024-24593: Cross-Site Request Forgery (CSRF)
A cross-site request forgery CSRF vulnerability in all versions up to 1.14.1 of the api server component of Allegro AI’s ClearML platform allows a remote attacker to impersonate a user by sending API requests via maliciously crafted html. Exploitation of the vulnerability allows an attacker to...
CVE-2024-24595
Allegro AI’s open-source version of ClearML stores passwords in plaintext within the MongoDB instance, resulting in a compromised server leaking all user emails and passwords...
Design/Logic Flaw
Allegro AI’s open-source version of ClearML stores passwords in plaintext within the MongoDB instance, resulting in a compromised server leaking all user emails and passwords...
CVE-2024-24595
CVE-2024-24595 affects Allegro AI ClearML (open-source) with a plaintext password storage flaw in the MongoDB instance, causing potential leakage of user emails and passwords. Root cause: credentials stored unencrypted in MongoDB. Impact: server compromise possible; confidentiality and integrity ...