repository icon
aimhubio / aim Project repository

Aim 💫 — An easy-to-use & supercharged open-source experiment tracker.

Submit a report

FIRST INTERACTION

WITHINN/A DAYS

REVIEW

WITHIN38 DAYS

FIX

WITHINN/A DAYS

Sandbox Escape via API Endpoint Leading to Remote Code Execution in Aim
superboy-zjc
self closed
Arbitrary File Write via Path Traversal in restore_run_backup
j0x1nx
duplicate
High
Stored XSS and CSRF through Pyodide in reports
patrik-ha
pending
Denial of service through tracking and requesting Aim objects through web API
patrik-ha
High
•$450•CVE-2025-0190
Denial of service by tracking large images
patrik-ha
High
•$450•CVE-2025-0189
Web server DOS through run metrics
patrik-ha
High
•$450•CVE-2024-12778
Denial of service through sshfs-client in tracking server
patrik-ha
Medium
•$75•CVE-2024-12777
Stored XSS in TextExplorer
patrik-ha
duplicate
High
Denial of service through instantiation of ScheduledStatusReporter in tracking s...
patrik-ha
High
•$450•CVE-2024-10110
Rce via Unclaimed S3 Bucket Usage And Arbitrary File Overwrite
aftersnows
not applicable
Path Traversal in restore_run_backup()
jkylekelly
self closed
Clickjacking vulnerability
tharunavula
not applicable
Stored XSS through TEXT EXPLORER
aftersnows
duplicate
High
XSS in TextBox Component
lambdasawa
duplicate
Critical
Arbitrary file deletion through relative path traversal in tracking server
patrik-ha
Critical
•$900•CVE-2024-8769
Denial of service due to no timeouts for some tracking server endpoints
patrik-ha
High
•$450•CVE-2024-8061
Unrestricted Code Execution via Outdated safer_getattr()
baroncrowley
Medium
•$75•CVE-2024-8238
Stored XSS in Text Explorer via tracked texts
0x999-x
High
•$450•CVE-2024-8101
CSRF through tracking server
patrik-ha
High
•$450•CVE-2024-7760
Arbitrary file deletion through tracking server
patrik-ha
High
•$450•CVE-2024-6851
Arbitrary file overwrite through tarfile-extraction
patrik-ha
Critical
•$900•CVE-2024-6829
Cross-site Request Forgery on Every Endpoint
pinkdraconian
duplicate
High
Stored XSS through run logs
patrik-ha
High
•$450•CVE-2024-6578
Denial of service by pointing tracking server at itself
patrik-ha
High
•$450•CVE-2024-6227
Arbitrary file overwrite and arbitrary data exfiltration
patrik-ha
Critical
•$900•CVE-2024-6396
Arbitrary file/directory deletion
patrik-ha
Medium
•$75•CVE-2024-6483
Remote Code Execution still in Aim Web API in aimhubio/aim (serious)
wh0amitz
duplicate
Critical
CSRF allows to delete runs
h2oa
informative
High
Frameable response (potential Clickjacking)
h2oa
informative
Medium
CSRF allows to delete tags
h2oa
informative
Medium
A user can remove notes despite it is not possible through the UI
acciobugs
informative
Medium
CSRF allows to delete runs and perform other operations
nerrorsec
High
•$1350•CVE-2024-2196
Remote Code Execution in Aim Web API
fa2y
Critical
•$2700•CVE-2024-2195
Sandbox escape via various forms of "format".
ready-research
informative
Critical
SQL injection attack on aim database.
andy53
spam