GCVE - cpe:2.3:a:allegro.ai:clearml:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:allegro.ai:clearml:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Allegro.Ai (`8ecf4d05-5bdd-5603-8eb0-76f323d9c640`)
Product	Clearml (`bdf55241-c8b8-5267-8834-6fde615abb02`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from gcve-enriched-dumps CVE data

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2024-24595`	vulnerable	2026-06-08 06:29:41.528995	Details available MEDIUM (6) Allegro AI’s open-source version of ClearML stores passwords in plaintext within the MongoDB instance, resulting in a compromised server leaking all user emails and passwords. Published: 2024-02-05T21:15:19.026Z Updated: 2025-05-15T19:47:08.697Z Open on db.gcve.eu Reference links https://hiddenlayer.com/research/not-so-clear-how-mlops-solutions-can-muddy-the-waters-of-your-supply-chain/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-24594`	vulnerable	2026-06-08 06:29:41.527020	Details available CRITICAL (9.9) A cross-site scripting (XSS) vulnerability in all versions of the web server component of Allegro AI’s ClearML platform allows a remote attacker to execute a JavaScript payload when a user views the Debug Samples tab in the web UI. Published: 2024-02-06T14:42:08.052Z Updated: 2024-08-01T23:28:11.107Z Open on db.gcve.eu Reference links https://hiddenlayer.com/research/not-so-clear-how-mlops-solutions-can-muddy-the-waters-of-your-supply-chain/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-24593`	vulnerable	2026-06-08 06:29:41.526582	Details available CRITICAL (9.6) A cross-site request forgery (CSRF) vulnerability in all versions up to 1.14.1 of the api server component of Allegro AI’s ClearML platform allows a remote attacker to impersonate a user by sending API requests via maliciously crafted html. Exploitation of the vulnerability allows an attacker to compromise confidential workspaces and files, leak sensitive information, and target instances of the ClearML platform within closed off networks. Published: 2024-02-06T14:41:44.470Z Updated: 2025-06-17T14:25:25.374Z Open on db.gcve.eu Reference links https://hiddenlayer.com/research/not-so-clear-how-mlops-solutions-can-muddy-the-waters-of-your-supply-chain/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-24592`	vulnerable	2026-06-08 06:29:41.525835	Details available CRITICAL (9.8) Lack of authentication in all versions of the fileserver component of Allegro AI’s ClearML platform allows a remote attacker to arbitrarily access, create, modify and delete files. Published: 2024-02-06T14:41:24.002Z Updated: 2024-08-22T19:15:24.399Z Open on db.gcve.eu Reference links https://hiddenlayer.com/research/not-so-clear-how-mlops-solutions-can-muddy-the-waters-of-your-supply-chain/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-24591`	vulnerable	2026-06-08 06:29:41.523947	Details available HIGH (8) A path traversal vulnerability in versions 1.4.0 to 1.14.1 of the client SDK of Allegro AI’s ClearML platform enables a maliciously uploaded dataset to write local or remote files to an arbitrary location on an end user’s system when interacted with. Published: 2024-02-06T14:40:56.097Z Updated: 2025-05-15T19:44:27.786Z Open on db.gcve.eu Reference links https://hiddenlayer.com/research/not-so-clear-how-mlops-solutions-can-muddy-the-waters-of-your-supply-chain/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-24590`	vulnerable	2026-06-08 06:29:41.522833	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.