3456 matches found
CVE-2025-1865
The kernel driver, accessible to low-privileged users, exposes a function that fails to properly validate the privileges of the calling process. This allows creating files at arbitrary locations with full user control, ultimately allowing for privilege escalation to SYSTEM...
CVE-2025-1865 Local Privilege Escalation in Virtual CloneDrive Kernel Driver
The kernel driver, accessible to low-privileged users, exposes a function that fails to properly validate the privileges of the calling process. This allows creating files at arbitrary locations with full user control, ultimately allowing for privilege escalation to SYSTEM...
Security Bulletin: IBM Workload Scheduler is vulnerable to arbitrary file creation vulnerability due to CVE-2022-22369 affecting JLOG component
Summary The Jlog component on the Master Domain Manager of IBM Workload Scheduler permits an unauthenticated user to interact with the system making it possible to modify the way the service works or modify system files. Vulnerability Details CVEID:CVE-2022-22369 DESCRIPTION: IBM Workload...
GHSA-JMGM-GX32-VP4W LlamaIndex vulnerable to Creation of Temporary File in Directory with Insecure Permissions
A vulnerability in the defaultjsonalyzer function of the JSONalyzeQueryEngine in the run-llama/llamaindex repository allows for SQL injection via prompt injection. This can lead to arbitrary file creation and Denial-of-Service DoS attacks. The vulnerability affects the latest version and is fixed...
LlamaIndex vulnerable to Creation of Temporary File in Directory with Insecure Permissions
A vulnerability in the defaultjsonalyzer function of the JSONalyzeQueryEngine in the run-llama/llamaindex repository allows for SQL injection via prompt injection. This can lead to arbitrary file creation and Denial-of-Service DoS attacks. The vulnerability affects the latest version and is fixed...
CVE-2024-12911
A vulnerability in the defaultjsonalyzer function of the JSONalyzeQueryEngine in the run-llama/llamaindex repository allows for SQL injection via prompt injection. This can lead to arbitrary file creation and Denial-of-Service DoS attacks. The vulnerability affects the latest version and is fixed...
CVE-2024-12911 SQL Injection in run-llama/llama_index
A vulnerability in the defaultjsonalyzer function of the JSONalyzeQueryEngine in the run-llama/llamaindex repository allows for SQL injection via prompt injection. This can lead to arbitrary file creation and Denial-of-Service DoS attacks. The vulnerability affects the latest version and is fixed...
CVE-2024-12911 SQL Injection in run-llama/llama_index
A vulnerability in the defaultjsonalyzer function of the JSONalyzeQueryEngine in the run-llama/llamaindex repository allows for SQL injection via prompt injection. This can lead to arbitrary file creation and Denial-of-Service DoS attacks. The vulnerability affects the latest version and is fixed...
CVE-2024-12911
CVE-2024-12911 affects the run-llama/llama_index project, targeting the default_jsonalyzer function in JSONalyzeQueryEngine. The issue enables SQL injection via prompt injection, enabling arbitrary file creation and DoS. The vulnerability is fixed in llama_index version 0.5.1 (and related notes i...
LlamaIndex 安全漏洞
LlamaIndex is a data framework for LLM applications from the LlamaIndex open source. A security vulnerability exists in LlamaIndex that stems from the defaultjsonalyzer function being susceptible to SQL injection attacks, which can lead to arbitrary file creation and denial of service attacks...
PT-2025-11566 · National Instruments · Ni Flexlogger
Name of the Vulnerable Software and Affected Versions: NI FlexLogger affected versions not specified Description: This vulnerability allows remote attackers to create arbitrary files on affected installations of NI FlexLogger. User interaction is required to exploit this vulnerability, as the...
WordPress GPX Viewer 2.2.8 Arbitrary File Creation Exploit
import argparse import requests from requests.sessions import Session import time banner = """ ██████╗██╗ ██╗███████╗ ██████╗ ██████╗ ██████╗ ██╗ ██╗ ██╗ ██████╗ ██████╗ ██████╗ █████╗ ██╔════╝██║ ██║██╔════╝ ╚════██╗██╔═████╗╚════██╗██║ ██║ ███║██╔═████╗██╔════╝ ╚════██╗██╔══██╗ ██║ ██║...
WordPress GPX Viewer 2.2.8 Arbitrary File Creation
WordPress GPX Viewer plugin versions 2.2.8 and below suffer from an arbitrary file creation vulnerability...
PT-2025-16666
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A vulnerability in the Linux kernel has been resolved. The issue is related to the nfsd proc stat init function ignoring the return value of svc proc register. If the procfile creation...
Exploit for CVE-2024-10629
🛠️ GPX Viewer Exploit CVE-2024-10629 This repository contai...
Low: ecs-init
Issue Overview: runc is a CLI tool for spawning and running containers according to the OCI specification. runc 1.1.13 and earlier, as well as 1.2.0-rc2 and earlier, can be tricked into creating empty files or directories in arbitrary locations in the host filesystem by sharing a volume between t...
Linux Distros Unpatched Vulnerability : CVE-2024-32152
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A blocklist bypass vulnerability exists in the LaTeX functionality of Ankitects Anki 24.04. A specially crafted malicious flashcard can lead to an arbitrary fil...
CVE-2022-49296 ceph: fix possible deadlock when holding Fwb to get inline_data
In the Linux kernel, the following vulnerability has been resolved: ceph: fix possible deadlock when holding Fwb to get inlinedata 1, mount with wsync. 2, create a file with ORDWR, and the request was sent to mds.0: cephatomicopen-- cephmdscdorequestopenc finishopenfile, dentry, cephopen--...
hornetq-core-client: Arbitrarily overwrite files or access sensitive information
A flaw was found in the createTempFile method of hornetq. Affected version of hornetq allows attackers to arbitrarily overwrite files or access sensitive information...
