Collection
Monthly
Improper access control in Samsung's Collection app on Android allows local unprivileged attackers to read sensitive information stored by the application. Affected versions are Collection prior to 1.0.1.14 on Android 15 and prior to 2.0.02.7 on Android 16. The flaw is limited to local access (AV:L) but requires no privileges, suggesting an exported Android component - such as a Content Provider, Activity, or Service - is reachable by any co-resident app without proper permission enforcement. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
zenstruck/collections is a set of helpers for iterating/paginating/filtering collections. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity.
Improper access control in Samsung's Collection app on Android allows local unprivileged attackers to read sensitive information stored by the application. Affected versions are Collection prior to 1.0.1.14 on Android 15 and prior to 2.0.02.7 on Android 16. The flaw is limited to local access (AV:L) but requires no privileges, suggesting an exported Android component - such as a Content Provider, Activity, or Service - is reachable by any co-resident app without proper permission enforcement. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
zenstruck/collections is a set of helpers for iterating/paginating/filtering collections. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity.