CVE-2024-6578Medium· 6.1▾ SunlitAim Stored Cross-site Scripting Vulnerability
▾ Sunlit zone — Low / medium · no exploitation signal
impact 33.6 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 8.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
0.3%
0.3% → 0.3%
A stored cross-site scripting (XSS) vulnerability exists in aimhubio/aim version 3.19.3. The vulnerability arises from the improper neutralization of input during web page generation, specifically in the logs-tab for runs. The terminal output logs are displayed using the dangerouslySetInnerHTML function in React, which is susceptible to XSS attacks. An attacker can exploit this vulnerability by injecting malicious scripts into the logs, which will be executed when a user views the logs-tab.
aim <= 3.19.3Refer to the advisory for the patched release.
Connected by shared product, vendor, weakness, or advisory.
CVE-2024-2195Critical· 9.8Aim Web API vulnerable to Remote Code Execution
CVE-2024-8769Critical· 9.1Aim path traversal in LockManager.release_locks
CVE-2024-12777Medium· 5.9Aim vulnerable to Synchronous Access of Remote Resource without Timeout
CVE-2024-8238Medium· 5.9Aim Improper Access Control
CVE-2024-8863Low· 3.5Aim Stored XSS through TEXT EXPLORER
CVE-2024-6483Medium· 5.3Aim Relative Path Traversal vulnerability