Vulnerabilities

The AIL Framework crawler splash domain page (showDomain.html) is vulnerable to stored cross-site script injection (XSS).

The Onion module in AIL Framework contained a performance shortcut in its URL extraction logic that accepted URLs as valid .onion targets based solely on a length check (exactly 69 characters) and a suffix check (ending…

The AIL Framework crawler task creation API (api_add_crawler_task) contained an insufficient authorization check when a user supplied a cookiejar UUID to attach to a one-shot or scheduled crawler task.

The AIL Framework's username timeline feature is vulnerable to stored cross-site scripting (XSS).

The AIL Framework tag selector component (var/www/static/js/tags.js) is vulnerable to stored cross-site scripting (XSS).

The AIL Framework (ail-project/ail-framework) contains a stored cross-site scripting (XSS) vulnerability in two Jinja2 templates that render popovers for matched, tracked, or tagged content: var/www/templates/chats_explo…

AIL Framework contains a server-side request forgery (SSRF) vulnerability in its crawler submission functionality.

AIL Project contains a stored cross-site scripting vulnerability in the translation controls displayed for chat messages and forum posts.

AIL Framework contains a stored cross-site scripting vulnerability in the crawler domain view.

AIL Framework contained a reflected cross-site scripting vulnerability in the /tag/add_tags endpoint.

AIL Framework contains a path traversal vulnerability in its PDF object handling.

AIL did not restrict repeated failed attempts to verify a two-factor authentication (OTP) code.

A path traversal vulnerability exists in AIL Framework before the release containing commit 0041456af25da0cdea1c1c4624e46baff2731d8f.

AIL framework contains a path traversal vulnerability in the /objects/item/diff endpoint.