repository icon
allegroai / clearml-server Project repository

ClearML - Auto-Magical CI/CD to streamline your AI workload. Experiment Management, Data Management, Pipeline, Orchestration, Scheduling & Serving in one MLOps/LLMOps solution

Submit a report

FIRST INTERACTION

WITHIN21 DAYS

REVIEW

WITHIN68 DAYS

FIX

WITHIN44 DAYS

Supply Chain Defect: All ClearML Server Deployments Share Publicly Known JWT Sig...
apeiria-zero
self closed
Fileserver Missing Authorization — Cross-Tenant File Access (Incomplete Fix for...
wernerina
not applicable
NoSQL Injection via __raw__ MongoDB Queries in Query Parameter Processing
optimus-fulcria
not applicable
Cross-Tenant IDOR in tasks.started and queues.add_task allows authenticated user...
iiviel
not applicable
Unauthenticated Guest Password Disclosure via /auth.fixed_users_mode endpoint re...
iiviel
not applicable
Stored XSS on Training field name
vinit989
not applicable
Business Logic bypass via race conditions
vinit989
not applicable
Hard-Coded Default Credentials in `clearml-server` via `secure.conf`
ganggreentempertatum
informative
High
Name Path Traversal in "events.download_task_log"
ganggreentempertatum
not applicable
exposure secret key
ngockhanhc311
informative
High
CSRF edit profiles
ngockhanhc311
not applicable
POST based reflected XSS at file server
geraldino2
informative
None
Stored XSS in SVG Image
0xryuzak1
informative
High
Insufficient Session Expiration in allegroai / clearml-server
0xryuzak1
informative
None
Stored XSS In Project Description
ye-yint-htet-t
informative
None
Stored XSS in Project description, Reports (markdown editor component)
m0kr4n3
Medium
•CVE-2023-6778