Vendor
ail-project
15 known vulnerabilities.
Products
7 results · Clear filters · Feed
-
High 8.5
Stored Cross-Site Scripting (XSS) in AIL Framework Username Timeline Tooltip
The AIL Framework's username timeline feature is vulnerable to stored cross-site scripting (XSS). Usernames imported from chats and crawled forums are stored without character restrictions. When an authenticated analyst views the username timeline, the applic…
-
High 8.5
Stored XSS in AIL Framework extracted-match popovers via unescaped dynamic values in HTML-enabled data-content attributes
The AIL Framework (ail-project/ail-framework) contains a stored cross-site scripting (XSS) vulnerability in two Jinja2 templates that render popovers for matched, tracked, or tagged content: var/www/templates/chats_explorer/block_message.html and var/www/temp…
-
High 7.1
Authenticated Server-Side Request Forgery in AIL Framework Crawler Allows Access to Internal Network Resources
AIL Framework contains a server-side request forgery (SSRF) vulnerability in its crawler submission functionality. A low-privileged authenticated user with access to the crawler interface can submit an arbitrary URL for crawling without adequate validation of…
-
High 8.2
Authenticated Reflected Cross-Site Scripting in Tag Error Responses in ail-framework
AIL Framework contained a reflected cross-site scripting vulnerability in the /tag/add_tags endpoint. When an error occurred while processing a tag operation, the application returned the error value directly as an HTML response using str(res[0]). If attacker…
-
High 7.1
Authenticated Path Traversal in AIL Framework PDF Object Handling Enables Potential Arbitrary File Read
AIL Framework contains a path traversal vulnerability in its PDF object handling. Prior to commit 14c618fce4d1df02358717c48ea903706abecdf2, the PDF.get_filepath() function constructed a file path by joining the configured PDF storage directory with a path der…
-
High 8.3
Authenticated Path Traversal in AIL Framework Investigation Downloads Allows Arbitrary File Read
A path traversal vulnerability exists in AIL Framework before the release containing commit 0041456af25da0cdea1c1c4624e46baff2731d8f. An authenticated AIL user can supply crafted object identifiers through the investigation workflow to cause file paths to res…
-
High 8.5
Stored XSS in modal item preview for long item content in AIL Framework
AIL framework is an open-source platform to collect, crawl, process and analyse unstructured data. Prior to 6.8, a stored cross-site scripting (XSS) vulnerability was identified in the modal item preview functionality. When item content longer than 800 charac…