74 matches found
CVE-2025-7707 World-Writable NLTK Cache Directory Vulnerability in run-llama/llama_index
The llamaindex library version 0.12.33 sets the NLTK data directory to a subdirectory of the codebase by default, which is world-writable in multi-user environments. This configuration allows local users to overwrite, delete, or corrupt NLTK data files, leading to potential denial of service, dat...
CVE-2025-7707 World-Writable NLTK Cache Directory Vulnerability in run-llama/llama_index
The llamaindex library version 0.12.33 sets the NLTK data directory to a subdirectory of the codebase by default, which is world-writable in multi-user environments. This configuration allows local users to overwrite, delete, or corrupt NLTK data files, leading to potential denial of service, dat...
PT-2025-41794
Name of the Vulnerable Software and Affected Versions llama index version 0.12.33 Description The software sets the NLTK data directory to a subdirectory of the codebase by default, which is world-writable in multi-user environments. This configuration allows local users to overwrite, delete, or...
EUVD-2025-20623
Malicious code in bioql PyPI...
Cudy WR1200EA 安全漏洞
The Cudy WR1200EA is a WiFi router from the Chinese company Cudy. A security vulnerability exists in the Cudy WR1200EA version 2.3.7-20250113-121810, which originates from the /etc/shadow file that can be locally tampered with, resulting in the restoration of the default password...
CVE-2025-49723
Missing authorization in Windows StateRepository API allows an authorized attacker to perform tampering locally...
CVE-2025-49723
Missing authorization in Windows StateRepository API allows an authorized attacker to perform tampering locally...
CVE-2025-49723
Missing authorization in Windows StateRepository API allows an authorized attacker to perform tampering locally...
CVE-2025-49723
CVE-2025-49723 affects Windows StateRepository API, enabling local tampering of data due to missing authorization in the Server file path. The CNVD/NCSC entries confirm impact as manipulation of data with a high CVSS (8.8) and local attack vector; no public exploitation details are provided in th...
PT-2025-28612 · Microsoft · Windows
Name of the Vulnerable Software and Affected Versions: Windows affected versions not specified Description: The issue concerns missing authorization in the Windows StateRepository API, allowing an authorized attacker to perform local tampering. This means that an attacker with certain privileges...
PT-2024-14845 · Arc · Arc
Name of the Vulnerable Software and Affected Versions: Arc affected versions not specified Description: The issue concerns the use of a temporary file with unsafe privileges on Unix systems, including Linux and MacOS. A malicious local user may be able to tamper with this file, potentially...
UBUNTU-CVE-2024-34490
In Maxima through 5.47.0 before 51704c, the plotting facilities make use of predictable names under /tmp. Thus, the contents may be controlled by a local attacker who can create files in advance with these names. This affects, for example, plot2d...
AZL-28510 CVE-2023-38497 affecting package rust for versions less than 1.72.0-2
Cargo downloads the Rust project’s dependencies and compiles the project. Cargo prior to version 0.72.2, bundled with Rust prior to version 1.71.1, did not respect the umask when extracting crate archives on UNIX-like systems. If the user downloaded a crate containing files writeable by any local...