Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

10 records

Vendor: Allegro.AI Clear all filters
TI-2024-26231 CVE-2024-39272 · GHSA-q53q-67p3-fpjw

Cross-site scripting in ClearML

Priority MEDIUM 42

A cross-site scripting (xss) vulnerability exists in the dataset upload functionality of ClearML Enterprise Server 3.22.5-1533.

CVSS 3.1CRITICAL 9.0 Network Low privileges User interaction EPSS 0.00569 Published 2025-02-06 No fix listed CWE-79
TI-2024-29374 CVE-2024-43779 · GHSA-v6jv-x2rf-449c

Information disclosure in ClearML

Priority HIGH 69

An information disclosure vulnerability exists in the Vault API functionality of ClearML Enterprise Server 3.22.5-1533.

CVSS 3.1HIGH 7.7 Network Low privileges No interaction EPSS 0.00816 Published 2025-02-06 No fix listed CWE-200
TI-2024-16210 CVE-2024-24594 · GHSA-f7f8-8qv6-p289

Cross-site scripting in Allegro.AI ClearML

Priority MEDIUM 43

A cross-site scripting (XSS) vulnerability in all versions of the web server component of Allegro AI’s ClearML platform allows a remote attacker to execute a JavaScript payload when a user views the Debug Samples tab in…

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.00594 Published 2024-02-06 No fix listed CWE-79
TI-2024-16209 CVE-2024-24593 · GHSA-w6j5-fp4m-crpf

Cross-site request forgery in Allegro.AI ClearML

Priority MEDIUM 41

A cross-site request forgery (CSRF) vulnerability in all versions up to 1.14.1 of the api server component of Allegro AI’s ClearML platform allows a remote attacker to impersonate a user by sending API requests via malic…

CVSS 3.1CRITICAL 9.6 Network No auth User interaction EPSS 0.0038 Published 2024-02-06 Fixed in 1.14.2 CWE-352
TI-2024-16208 CVE-2024-24592 · GHSA-6g66-738j-p78c

Improper authentication in Allegro.AI ClearML

Priority MEDIUM 51

Lack of authentication in all versions of the fileserver component of Allegro AI’s ClearML platform allows a remote attacker to arbitrarily access, create, modify and delete files.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00981 Published 2024-02-06 No fix listed CWE-425
TI-2024-16207 CVE-2024-24591 · GHSA-m95h-p4gg-wfw3

Path traversal in Allegro.AI ClearML

Priority HIGH 73

A path traversal vulnerability in versions 1.4.0 to 1.14.1 of the client SDK of Allegro AI’s ClearML platform enables a maliciously uploaded dataset to write local or remote files to an arbitrary location on an end user’…

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00798 Published 2024-02-06 Fixed in 1.14.2 CWE-22
TI-2024-16206 CVE-2024-24590 · GHSA-cpcw-9h9m-wqw9

Deserialization of untrusted data in Allegro.AI ClearML

Priority HIGH 73

Deserialization of untrusted data can occur in versions 0.17.0 to 1.14.2 of the client SDK of Allegro AI’s ClearML platform, enabling a maliciously uploaded artifact to run arbitrary code on an end user’s system when int…

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.02473 Published 2024-02-06 Fixed in 1.14.3 CWE-502
TI-2024-16211 CVE-2024-24595 · GHSA-gvqv-h7hh-6fcc

Insufficiently protected credentials in Allegro.AI ClearML

Priority LOW 33

Allegro AI’s open-source version of ClearML stores passwords in plaintext within the MongoDB instance, resulting in a compromised server leaking all user emails and passwords.

CVSS 3.1HIGH 7.1 Local Low privileges No interaction EPSS 0.00257 Published 2024-02-05 No fix listed CWE-522