Improper access control

Improper access control vulnerability in Nearby device scanning prior version 11.1.14.7 allows local attacker to access data...

CVE-2023-44296

Dell ELab-Navigator, version 3.1.9 contains a hard-coded credential vulnerability. A local attacker could potentially exploit this vulnerability, leading to unauthorized access to sensitive data. Successful exploitation may result in the compromise of confidential user information...

PT-2023-22905 · Samsung · Galaxy Store

Name of the Vulnerable Software and Affected Versions: Galaxy Store versions prior to 4.5.56.6 Description: The issue is related to improper sanitization of incoming intent in Galaxy Store, allowing local attackers to access privileged content providers as Galaxy Store permission. Recommendations...

PT-2023-22856 · Unknown · Uwbaospadapterservice

Name of the Vulnerable Software and Affected Versions: UwbAospAdapterService versions prior to SMR Jul-2023 Release 1 Description: The issue allows local attackers to access the UWB chipset Identifier due to an Exposure of Sensitive Information vulnerability in the getDefaultChipId function. This...

CVE-2022-4048 CODESYS V3 prone to Inadequate Encryption Stregth

Inadequate Encryption Strength in CODESYS Development System V3 versions prior to V3.5.18.40 allows an unauthenticated local attacker to access and manipulate code of the encrypted boot application...

PT-2023-22432

Name of the Vulnerable Software and Affected Versions Webroot SecureAnywhere Endpoint Protection CE versions 9.0.33.39 and earlier Description An issue in Webroot SecureAnywhere Endpoint Protection CE allows a local attacker to access sensitive information via the EXE installer. Recommendations F...

apache-james-mime4j: Temporary File Information Disclosure in MIME4J TempFileStorageProvider

A flaw was found in Apache James's Mime4j TempFileStorageProvider class, where it may set improper permissions when utilizing temporary files. This flaw allows a locally authorized attacker to access information outside their intended permissions...

CVE-2022-45859

An insufficiently protected credentials vulnerability CWE-522 in FortiNAC-F 7.2.0, FortiNAC 9.4.1 and below, 9.2.6 and below, 9.1.8 and below, 8.8.0 all versions, 8.7.0 all versions may allow a local attacker with system access to retrieve users' passwords...

CVE-2021-3923

A flaw was found in the Linux kernel's implementation of RDMA over infiniband. An attacker with a privileged local account can leak kernel stack information when issuing commands to the /dev/infiniband/rdmacm device node. While this access is unlikely to leak sensitive user information, it can be...

PT-2023-13026

Name of the Vulnerable Software and Affected Versions tripleo-ansible affected versions not specified Description A flaw in the default configuration of tripleo-ansible allows a local attacker to potentially disclose important configuration details from an OpenStack deployment through brute force...

CVE-2021-44862 Sensitive Information store in NSClient logs

Netskope client is impacted by a vulnerability where an authenticated, local attacker can view sensitive information stored in NSClient logs which should be restricted. The vulnerability exists because the sensitive information is not masked/scrubbed before writing in the logs. A malicious user c...

CVE-2022-36830

PendingIntent hijacking vulnerability in cancelAlarmManager in Charm by Samsung prior to version 1.2.3 allows local attackers to access files without permission via implicit intent...

CVE-2022-33699

Exposure of Sensitive Information in getDsaSimImsi in TelephonyUI prior to SMR Jul-2022 Release 1 allows local attacker to access imsi via log...

CVE-2022-33698

Exposure of Sensitive Information in Telecom application prior to SMR Jul-2022 Release 1 allows local attackers to access ICCID via log...

CVE-2022-0013

A file information exposure vulnerability exists in the Palo Alto Networks Cortex XDR agent that enables a local attacker to read the contents of arbitrary files on the system with elevated privileges when generating a support file. This issue impacts: Cortex XDR agent 5.0 versions earlier than...

CVE-2021-30815

CVE-2021-30815 affects Apple iOS/iPadOS 15 (and prior) where Siri/lock-screen interaction could allow a local attacker to view contacts from a locked device. Root cause cited as improper state management; Apple fixed the issue in iOS 15/iPadOS 15. Remediation: update to those versions. Exploitati...

CVE-2021-34771

A vulnerability in the Cisco IOS XR Software CLI could allow an authenticated, local attacker to view more information than their privileges allow. This vulnerability is due to insufficient application of restrictions during the execution of a specific command. An attacker could exploit this...

AZL-7195 CVE-2021-29157 affecting package dovecot for versions less than 2.3.20-1

Dovecot before 2.3.15 allows ../ Path Traversal. An attacker with access to the local filesystem can trick OAuth2 authentication into using an HS256 validation key from an attacker-controlled location. This occurs during use of local JWT validation with the posix fs driver...

Nuvoton NPCT 安全漏洞

Intel Nuvoton Consumer Infrared CIR Driver is an infrared driver from Intel Corporation USA. A security vulnerability in the Nuvoton NPCT75x TPM 1.2 firmware version 7.4.0.0, which stems from incorrect access control, allows a highly privileged, locally authenticated attacker to gain unauthorized...

USN-4705-2 sudo vulnerability

USN-4705-1 fixed a vulnerability in Sudo. This update provides the corresponding update for Ubuntu 12.04 ESM and Ubuntu 14.04 ESM. Original advisory details: It was discovered that Sudo incorrectly handled memory when parsing command lines. A local attacker could possibly use this issue to obtain...