11754 matches found
PT-2025-42014
Name of the Vulnerable Software and Affected Versions Microsoft Windows Hyper-V affected versions not specified Description A race condition exists in Windows Hyper-V during concurrent execution using shared resources with improper synchronization. This allows a locally authorized attacker to...
Insecure Temporary File
Overview llama-index-core is an Interface between LLMs and your data Affected versions of this package are vulnerable to Insecure Temporary File due to setting the NLTK data directory to a shared, world-writable subdirectory. An attacker can overwrite, delete, or corrupt data files by exploiting...
EUVD-2025-34071
llama-index has Insecure Temporary File...
CVE-2025-7707
The CVE-2025-7707 entry concerns llama_index 0.12.33, where NLTK data directory is set to a subdirectory of the codebase, creating a world-writable shared cache and enabling local data tampering, DoS, or privilege escalation. Connected disclosures confirm the issue and point to fixes/upgrades: re...
CVE-2025-7707 World-Writable NLTK Cache Directory Vulnerability in run-llama/llama_index
The llamaindex library version 0.12.33 sets the NLTK data directory to a subdirectory of the codebase by default, which is world-writable in multi-user environments. This configuration allows local users to overwrite, delete, or corrupt NLTK data files, leading to potential denial of service, dat...
PT-2025-41794
Name of the Vulnerable Software and Affected Versions llama index version 0.12.33 Description The software sets the NLTK data directory to a subdirectory of the codebase by default, which is world-writable in multi-user environments. This configuration allows local users to overwrite, delete, or...
The vulnerability of the put_pasid_state() function in the drivers/iommu/amd/iommu_v2.c file of the Linux kernel’s IOMMU driver allows a hacker to trigger a service failure.
The vulnerability of the putpasidstate function in the drivers/iommu/amd/iommuv2.c file of the Linux kernel’s IOMMU driver is related to synchronization errors when using shared resources. Exploiting this vulnerability could allow an attacker to cause a service failure...
CVE-2025-11518
The WPC Smart Wishlist for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.0.3 via several wishlist AJAX functions due to missing validation on a user controlled key that is exposed when wishlists are shared. This makes it...
CVE-2025-11518
The WPC Smart Wishlist for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.0.3 via several wishlist AJAX functions due to missing validation on a user controlled key that is exposed when wishlists are shared. This makes it...
CVE-2025-11518
The CVE-2025-11518 issue affects the WPC Smart Wishlist for WooCommerce plugin for WordPress (versions ≤ 5.0.3). It is caused by an Insecure Direct Object Reference due to missing validation on a user-controlled key exposed when wishlists are shared, enabling unauthenticated attackers to manipula...
CVE-2025-21057
Use of implicit intent for sensitive communication in Samsung Notes prior to version 4.4.30.63 allows local attackers to access shared notes...
PT-2025-41649
Name of the Vulnerable Software and Affected Versions WPC Smart Wishlist for WooCommerce plugin for WordPress versions up to and including 5.0.3 Description The software is susceptible to an Insecure Direct Object Reference issue in several wishlist AJAX functions. This is due to a lack of...
CVE-2025-35052
Newforma Info Exchange NIX uses a hard-coded key to encrypt certain query parameters. Some encrypted parameter values can specify paths to download files, potentially bypassing authentication and authorization, for example, the 'qs' parameter used in '/DownloadWeb/download.aspx'. This key is shar...
CVE-2025-55200
BigBlueButton is an open-source virtual classroom. In versions prior to 3.0.13, the "Shared Notes" feature contains a Stored Cross-Site Scripting XSS vulnerability with the input location being the "Username" field and the output location on the "Shared Notes" page, when a user with a malicious...
CVE-2025-21057
Use of implicit intent for sensitive communication in Samsung Notes prior to version 4.4.30.63 allows local attackers to access shared notes...
CVE-2025-21054
Out-of-bounds read in the parsing header for JPEG decoding in libpadm.so prior to SMR Oct-2025 Release 1 allows local attackers to potentially access out-of-bounds memory...
CVE-2025-21057
Use of implicit intent for sensitive communication in Samsung Notes prior to version 4.4.30.63 allows local attackers to access shared notes...
CVE-2025-21057
Use of implicit intent for sensitive communication in Samsung Notes prior to version 4.4.30.63 allows local attackers to access shared notes...
CVE-2025-21057
CVE-2025-21057 affects Samsung Notes with vulnerable versions prior to 4.4.30.63. The root cause is use of implicit intents for sensitive communication, enabling a local attacker to access shared notes. The issue is documented across multiple sources (NVD, RH, CNVD, and PT Security) confirming th...