566 matches found
PT-2025-49581
Name of the Vulnerable Software and Affected Versions SettingsProvider.java affected versions not specified Description A flaw exists in the isValidMediaUri function within SettingsProvider.java that may allow cross-user media reading due to a missing permission check. This could result in local...
ASB-A-412662901
In ProcessArea of dngmiscopcodes.cpp, there is a possible out of bounds read due to a buffer overflow. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...
HP Integrated Lights-Out Exposure of Sensitive Information to an Unauthorized Actor (CVE-2022-28633)
A local disclosure of sensitive information and a local unauthorized data modification vulnerability were discovered in HPE Integrated Lights-Out 5 iLO 5 firmware versions: Prior to 2.71. An unprivileged user could locally exploit this vulnerability to read and write to the iLO 5 firmware file...
CVE-2025-21076
CVE-2025-21076 affects Samsung Account prior to version 15.5.00.18. The issue is caused by improper handling of permissions/privileges, enabling a local attacker to access data within Samsung Account with user interaction required to trigger. Documented impact in multiple sources confirms local a...
PT-2025-45076
Name of the Vulnerable Software and Affected Versions Samsung Account versions prior to 15.5.00.18 Description Improper handling of insufficient permissions or privileges in Samsung Account allows local attackers to access data within the application. User interaction is required to trigger this...
Samsung Account security vulnerabilities
SAMSUNG Account is an account management software from Samsung South Korea. A security vulnerability exists in SAMSUNG Account versions prior to 15.5.00.18, which stems from improper handling of permissions and could allow a local attacker to access Samsung Account data...
CVE-2025-20740
In wlan STA driver, there is a possible out of bounds read due to a race condition. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00435337; Issue ID: MSV-4036...
CVE-2025-36083 Multiple Vulnerabilities in IBM Concert Software.
IBM Concert Software 1.0.0 through 2.0.0 could allow a local user to obtain sensitive information from buffers due to improper clearing of heap memory before release...
SUSE CVE-2025-59956
AgentAPI is an HTTP API for Claude Code, Goose, Aider, Gemini, Amp, and Codex. Versions 0.3.3 and below are susceptible to a client-side DNS rebinding attack when hosted over plain HTTP on localhost. An attacker can gain access to the /messages endpoint served by the Agent API. This allows for th...
Windows Push Notification Information Disclosure Vulnerability
Exposure of sensitive information to an unauthorized actor in Windows Push Notification Core allows an authorized attacker to disclose information locally...
Microsoft Failover Cluster Virtual Driver Information Disclosure Vulnerability
Exposure of sensitive information to an unauthorized actor in Microsoft Failover Cluster Virtual Driver allows an authorized attacker to disclose information locally...
EUVD-2025-34168
In gnss driver, there is a possible out of bounds read due to an integer overflow. This could lead to local information disclosure if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS09920036; Issue ID: MSV-3798...
CVE-2025-20722
In gnss driver, there is a possible out of bounds read due to an integer overflow. This could lead to local information disclosure if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS09920036; Issue ID: MSV-3798...
PT-2025-41878
Name of the Vulnerable Software and Affected Versions gnss driver affected versions not specified Description An out-of-bounds read issue exists in the gnss driver due to an integer overflow. Successful exploitation could lead to local information disclosure, requiring an attacker to already...
EUVD-2025-34071
llama-index has Insecure Temporary File...
CVE-2025-7707 World-Writable NLTK Cache Directory Vulnerability in run-llama/llama_index
The llamaindex library version 0.12.33 sets the NLTK data directory to a subdirectory of the codebase by default, which is world-writable in multi-user environments. This configuration allows local users to overwrite, delete, or corrupt NLTK data files, leading to potential denial of service, dat...
CVE-2025-7707: Insecure Temporary File
The llamaindex library version 0.12.33 sets the NLTK data directory to a subdirectory of the codebase by default, which is world-writable in multi-user environments. This configuration allows local users to overwrite, delete, or corrupt NLTK data files, leading to potential denial of service, dat...
CVE-2025-21050
CVE-2025-21050 affects Samsung Mobile devices in the Contacts component prior to SMR Oct-2025 Release 1. The root cause is improper input validation, enabling a local attacker to access data across multiple user profiles. Impact is confidentiality-focused (high), with local, low-complexity access...
EUVD-2025-33682
Improper access control in SecSettings prior to SMR Oct-2025 Release 1 allows local attackers to access sensitive information. User interaction is required for triggering this vulnerability...