ResourcePoison

此问题的修复已作为 CVE-2025-22441 发布：公告 补丁 后续修复 传递 ApplicationInfo ApplicationInfo 是定义已安装应用各种信息（最显著的是加载资源和代码的 apk 文件路径）的结构体 通常它由系统传递给应用，但有时也存在非系统调用方可以提供自己的 ApplicationInfo 的情况。例如，过去 bindBackupAgent 方法中就存在漏洞，攻击者可以在参数中传入自己的 ApplicationInfo 对象，其中包含 uid 和 sourceDir 值，而这些值并未与系统中实际安装的应用进行核对，因为该方法本应由 systemserve...

CVE-2026-12261

A flaw was found in the nltk.downloader component of NLTK. This vulnerability allows for cross-package resource and model poisoning. The downloader extracts package archives into shared namespaces and only validates package integrity after extraction. This design flaw enables one package to...

CVE-2026-12261

A vulnerability in nltk.downloader in nltk/nltk versions = 3.9.4 allows for cross-package resource and model poisoning. The downloader extracts package archives into shared namespaces such as corpora/ and taggers/ instead of package-isolated roots, and validates package integrity only after the...

CVE-2026-12261

The CVE concerns nltk.downloader in nltk/nltk ≤ 3.9.4. The downloader extracts package archives into shared namespaces (corpora/ and taggers/) instead of package-isolated roots and validates integrity only after extraction. This design flaw enables one package to overwrite another package’s trust...

CVE-2026-12261

A vulnerability in nltk.downloader in nltk/nltk versions = 3.9.4 allows for cross-package resource and model poisoning. The downloader extracts package archives into shared namespaces such as corpora/ and taggers/ instead of package-isolated roots, and validates package integrity only after the...

GO-2026-4924 Juju has a resource poisoning vulnerability in github.com/juju/juju

Juju has a resource poisoning vulnerability in github.com/juju/juju. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, please suggest ...

Juju has a resource poisoning vulnerability

Summary Any authenticated user, machine or controller under a Juju controller can modify the resources of an application within the entire controller. This one is very straightforward to just read in the code: Step 1: The authorisation mechanism for the resource handler is defined here. One is on...

CVE-2025-68153 Juju: Resource poisoning

Juju is an open source application orchestration engine that enables any application operation on any infrastructure at any scale through special operators called ‘charms’. From versions 2.9 to before 2.9.56 and 3.6 to before 3.6.19, any authenticated user, machine or controller under a Juju...

CVE-2025-68153 Juju: Resource poisoning

Juju is an open source application orchestration engine that enables any application operation on any infrastructure at any scale through special operators called ‘charms’. From versions 2.9 to before 2.9.56 and 3.6 to before 3.6.19, any authenticated user, machine or controller under a Juju...

CVE-2025-68153 Juju: Resource poisoning

Juju is an open source application orchestration engine that enables any application operation on any infrastructure at any scale through special operators called ‘charms’. From versions 2.9 to before 2.9.56 and 3.6 to before 3.6.19, any authenticated user, machine or controller under a Juju...