CVE-2012-5519

cups-root-file-read.sh ⭐ 一个针对渗透测试和CTF的bash实现，基于metasploit的'cupsrootfileread.rb'模块。 主要是bash脚本的一个简短练习。旨在成为一个自包含的程序，用于在Linux系统上利用CVE-2012-5519； 它为用户提供一个交互式提示，允许他们快速读取多个受限文件。 漏洞 - CVE-2012-5519 ❗ 该脚本利用了CUPS（通用UNIX打印系统） 1.6.2 中的一个漏洞。 CUPS允许lpadmin组内的用户使用cupsctl命令更改cupsd.conf文件。 此命令还允许用户指定一个ErrorLog路径。...

CVE-2026-21099

CVE-2026-21099 is an improper access control vulnerability in SettingsProvider on Samsung mobile devices. A local attacker with no privileges required and no user interaction can access sensitive information on the vulnerable system. The CVSS 4.0 base score is 5.1 (MEDIUM) , reflecting the local ...

CVE-2026-49883

In checkReadPermission of PermissionsManager.java, there is a possible way to monitor sensitive device state data due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

EUVD-2026-74183

The Okta Hyperdrive Agent writes the decoded SAML bearer assertion to a local application log file at the default log level on every successful MFA completion. This insertion of sensitive information into the log file makes a live authentication credential readable by any local user with access t...

CVE-2026-45519

In screenArgsForPermissionCheckIfAny of multiple locations there is a possible risk of unauthorized access due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-28638

In multiple functions of XmpDataParser.java, there is a possible improper data sanitization due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-28622

In getQueryBuilderInternal of MediaProvider.java, there is a possible way to retrieve location metadata due to a permissions bypass. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-28582

In onCreate of ConfirmDeviceCredentialActivity.java, there is a possible unauthorized access to and modification of device credentials due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed...

CVE-2026-0054

In isCallerAllowed of WalletContextualLocationsService.kt, there is a possible way to get wallet information due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

EUVD-2026-74020

In setTo of ResourceTypes.cpp, there is a possible out-of-bounds heap read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-45525

CVE-2026-45525 is an improper data sanitization flaw (CWE-200) in the Android Media Provider component (Project Mainline), caused by a logic error in the code. It allows local information disclosure of internal database state records with low privileges and no user interaction required. The vulne...

EUVD-2026-73998

In screenArgsForPermissionCheckIfAny of multiple locations there is a possible risk of unauthorized access due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-45519

CVE-2026-45519 is a local information disclosure vulnerability in Android's Media Provider (a Project Mainline component), affecting Android 14, 15, and 16 . The root cause is a confused deputy flaw in screenArgsForPermissionCheckIfAny, where incorrect permission checks allow a local app to bypas...

CVE-2026-45519

In screenArgsForPermissionCheckIfAny of multiple locations there is a possible risk of unauthorized access due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-28671

In updateInternal of MediaProvider.java, there is a possible expose contents of files due to a race condition. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-28660

In getAllSessions of multiple files, there is a possible confused deputy due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-28660

CVE-2026-28660 is a local information disclosure vulnerability in the Android Framework component, caused by a confused deputy due to a logic error in the getAllSessions function across multiple files (AOSP bug A-498588487 ). A local attacker with low privileges can exploit it without user intera...

EUVD-2026-73946

In onCreate of ConfirmDeviceCredentialActivity.java, there is a possible unauthorized access to and modification of device credentials due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed...

CVE-2026-28582

CVE-2026-28582 is a missing permission check in the onCreate method of ConfirmDeviceCredentialActivity.java on Android , allowing a local attacker with low privileges (no user interaction required) to read or modify device credentials , resulting in local information disclosure. NVD rates it CVSS...

EUVD-2026-74046

In isCallerAllowed of WalletContextualLocationsService.kt, there is a possible way to get wallet information due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...