CVSS (http://www.first.org/cvss/) provides the keyword local in the base vector. The definition given by FIRST is somehow not so clear for me: Local: Exploiting the vulnerability requires either physical access to the target or a local (shell) account on the target. Can anyone provide me with clear definition for it? I mean is it localhost? is it desktop application that are not available through HTTP?
Simply put a local vulnerability means the attacker has prior access to the target. That may mean already having an account on the machine. With an account already on the machine an attacker could raise their level of privileges with an exploit.
A good example of this being the latest Linux kernel exploit CVE-2010-3081. The exploit allows for a local, unprivileged user to escalate their privileges to that of root.