CVE-2024-8863

The CVE-2024-8863 issue affects aimhubio Aim up to 3.24, where the Text Explorer component’s textbox.tsx uses dangerouslySetInnerHTML. The root cause is manipulation of the query argument that enables cross-site scripting. The vulnerability is remote-exploitable and public exploits have been disc...

CVE-2024-6483

The CVE-2024-6483 entry concerns aimhubio/aim v3.19.3 with a path traversal flaw in the runs/delete-batch endpoint. The issue allows arbitrary file/directory deletion via user-specified run-names, risking denial of service or data loss. Reports from multiple sources (Red Hat, NVD, OSV, GHSA, Snyk...

CVE-2024-12777

The CVE-2024-12777 entry describes a Denial of Service in aimhubio/aim 3.25.0 caused by misuse of the sshfs-client. The tracking server is single-threaded and can become unresponsive when asked to connect to an unresponsive socket via sshfs. The root cause is the lack of an additional timeout in ...