CVE-2024-2195

A critical Remote Code Execution (RCE) vulnerability was identified in the aimhubio/aim project, specifically within the `/api/runs/search/run/` endpoint, affecting versions >= 3.0.0. The vulnerability resides in the `run_search_api` function of the `aim/web/api/runs/views.py` file, where improper restriction of user access to the `RunView` object allows for the execution of arbitrary code via the `query` parameter. This issue enables attackers to execute arbitrary commands on the server, potentially leading to full system compromise.

• CWE-94

• https://huntr.com/bounties/22f2355e-b875-4c01-b454-327e5951c018Exploit, Third Party Advisory
• https://huntr.com/bounties/22f2355e-b875-4c01-b454-327e5951c018Exploit, Third Party Advisory

Published

Apr 10, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-2194The WP Statistics plugin for WordPress is vulnerable to Stor…7.2
• CVE-2024-21944Improper input validation for DIMM serial presence detect (S…5.3
• CVE-2024-21945Incorrect default permissions in the AMD RyzenTM Master moni…7.3
• CVE-2024-21946Incorrect default permissions in the AMD RyzenTM Master Util…7.3
• CVE-2024-21947Improper input validation in the system management mode (SMM…7.5
• CVE-2024-21949Improper validation of user input in the NPU driver could al…5.5
• CVE-2024-21950An out of bounds read in the remote management firmware coul…1.8
• CVE-2024-21953Improper input validation in IOMMU could allow a malicious h…5.9
• CVE-2024-21957Incorrect default permissions in the AMD Management Console …7.3
• CVE-2024-21958Incorrect default permissions in the AMD Provisioning Consol…7.3
• CVE-2024-2196aimhubio/aim is vulnerable to Cross-Site Request Forgery (CS…8.8
• CVE-2024-21960Incorrect default permissions in the AMD Optimizing CPU Libr…7.3