16075 matches found
CVE-2025-6211 MD5 Hash Collision in run-llama/llama_index
A vulnerability in the DocugamiReader class of the run-llama/llamaindex repository, up to version 0.12.28, involves the use of MD5 hashing to generate IDs for document chunks. This approach leads to hash collisions when structurally distinct chunks contain identical text, resulting in one chunk...
Use of a Broken or Risky Cryptographic Algorithm
Overview hydrolib-core is a Python wrappers around D-HYDRO Suite. Affected versions of this package are vulnerable to Use of a Broken or Risky Cryptographic Algorithm via the use of the MD5 hash algorithm in security-sensitive contexts. An attacker can exploit this vulnerability to trigger securi...
LlamaIndex security vulnerability
LlamaIndex is a data framework for LLM applications open-sourced by LlamaIndex. A security vulnerability exists in LlamaIndex version 0.12.28 and earlier, which stems from the use of MD5 hashing to generate document block IDs, which could lead to hash conflicts...
Apache HTTP Server code-related vulnerabilities
Apache HTTP Server is the United States Apache Apache Foundation of an open source web server . The server is fast, reliable and can be expanded through a simple API. Apache HTTP Server suffers from a server-side request forgery vulnerability that can be exploited by an attacker to disclose NTLM...
CVE-2025-6211: Expected Behavior Violation
A vulnerability in the DocugamiReader class of the run-llama/llamaindex repository, up to version 0.12.28, involves the use of MD5 hashing to generate IDs for document chunks. This approach leads to hash collisions when structurally distinct chunks contain identical text, resulting in one chunk...
CVE-2025-7204 Exposure of password hashes via API responses in ConnectWise PSA
In ConnectWise PSA versions older than 2025.9, a vulnerability exists where authenticated users could gain access to sensitive user information. Specific API requests were found to return an overly verbose user object, which included encrypted password hashes for other users. Authenticated users...
CVE-2025-7204 Exposure of password hashes via API responses in ConnectWise PSA
In ConnectWise PSA versions older than 2025.9, a vulnerability exists where authenticated users could gain access to sensitive user information. Specific API requests were found to return an overly verbose user object, which included encrypted password hashes for other users. Authenticated users...
ConnectWise PSA security vulnerabilities
ConnectWise PSA is a specialized service automation software from ConnectWise USA. A security vulnerability exists in ConnectWise PSA versions prior to 2025.9 that stems from the API returning too much user information, which could lead to an authenticated user obtaining an encrypted password has...
Device Admin App Password Recovery
The vulnerability of the Device Admin App on the ctrlX OS operating system is related to insufficient calculation of the password hash. Exploiting this vulnerability allows a malicious actor to retrieve passwords of other users by sending specially crafted HTTP requests...
NetAlert X Bypass Access
The vulnerability in the front/index.php script of the NetAlert X network alerting infrastructure is related to incorrect password comparison based on hashes. Exploiting this vulnerability allows an attacker to bypass security restrictions and gain unauthorized access to protected information...
Description of the security update for Visual Studio 2015 Update 3: July 8, 2025 (KB5063035)
Description of the security update for Visual Studio 2015 Update 3: July 8, 2025 KB5063035 Applies To Visual Studio 2015 Update 3 Applies to: All Visual Studio 2015 Update 3 editions except Build Tools Summary An elevation of privilege vulnerability exists in the Diagnostics Hub Standard Collecto...
End of support for Office 2016 and Office 2019
End of support for Office 2016 and Office 2019 Applies To Office 2019 Office 2016 Get help with Copilot Tell me about end of support for Office 2016 for Mac. Show me how to remove the conflicting 2013 app. Support for Office 2016 and Office 2019 ended on October 14, 2025. While your Office 2016 a...
Description of the security update for PowerPoint 2016: July 8, 2025 (KB5002746)
Description of the security update for PowerPoint 2016: July 8, 2025 KB5002746 Applies To PowerPoint 2016 Summary This security update resolves a Microsoft PowerPoint remote code execution vulnerability and Microsoft Office remote code execution vulnerability. To learn more about the...
Hash Collision
llamaindexreaderspapers is vulnerable to Hash Collision. The vulnerability is due to the use of MD5 hashing to generate filenames for downloaded papers, which allows an attacker to exploit hash collisions by submitting papers with identical titles but different content...
LlamaIndex vulnerability in ArxivReader class can cause MD5 hash collisions
A vulnerability in the ArxivReader class of the run-llama/llamaindex repository allows for MD5 hash collisions when generating filenames for downloaded papers. This can lead to data loss as papers with identical titles but different contents may overwrite each other, preventing some papers from...
GHSA-P7J4-JWJF-5X9W LlamaIndex vulnerability in ArxivReader class can cause MD5 hash collisions
A vulnerability in the ArxivReader class of the run-llama/llamaindex repository allows for MD5 hash collisions when generating filenames for downloaded papers. This can lead to data loss as papers with identical titles but different contents may overwrite each other, preventing some papers from...
Expected Behavior Violation
Overview llama-index-readers-papers is a llama-index readers papers integration Affected versions of this package are vulnerable to Expected Behavior Violation via the ArxivReader process. An attacker can cause data loss by uploading papers with identical titles but different contents, resulting ...
Expected Behavior Violation
Overview llama-index is an Interface between LLMs and your data Affected versions of this package are vulnerable to Expected Behavior Violation via the ArxivReader process. An attacker can cause data loss by uploading papers with identical titles but different contents, resulting in one paper...
CVE-2025-3044
A vulnerability in the ArxivReader class of the run-llama/llamaindex repository, versions up to v0.12.22.post1, allows for MD5 hash collisions when generating filenames for downloaded papers. This can lead to data loss as papers with identical titles but different contents may overwrite each othe...
PYSEC-2025-247
A vulnerability in the ArxivReader class of the run-llama/llamaindex repository, versions up to v0.12.22.post1, allows for MD5 hash collisions when generating filenames for downloaded papers. This can lead to data loss as papers with identical titles but different contents may overwrite each othe...