References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

Known Affected Software Configurations Switch to CPE 2.2

Change History

OR
     *cpe:2.3:a:aimstack:aim:3.19.3:*:*:*:*:*:*:*

NIST AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

https://huntr.com/bounties/5b1ebc67-5346-44aa-b8b8-3c1c09d79680 No Types Assigned

https://huntr.com/bounties/5b1ebc67-5346-44aa-b8b8-3c1c09d79680 Exploit, Issue Tracking, Third Party Advisory

huntr.dev AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

huntr.dev CWE-79

A stored cross-site scripting (XSS) vulnerability exists in aimhubio/aim version 3.19.3. The vulnerability arises from the improper neutralization of input during web page generation, specifically in the logs-tab for runs. The terminal output logs are displayed using the `dangerouslySetInnerHTML` function in React, which is susceptible to XSS attacks. An attacker can exploit this vulnerability by injecting malicious scripts into the logs, which will be executed when a user views the logs-tab.

huntr.dev https://huntr.com/bounties/5b1ebc67-5346-44aa-b8b8-3c1c09d79680 [No types assigned]