CVE-2021-26363

CVE-2021-26363 affects AMD ASP/SMU firmware where a malicious or compromised UApp or ABL could modify the ASP’s reserved DRAM value outside the fenced area, potentially exposing data. The vulnerability is documented in AMD SB-1027 with platform-specific mitigations (e.g., Raven Ridge AM4 family),...

CVE-2021-26363

A malicious or compromised UApp or ABL could potentially change the value that the ASP uses for its reserved DRAM, to one outside of the fenced area, potentially leading to data exposure...

CVE-2021-26361

A malicious or compromised User Application UApp or AGESA Boot Loader ABL could be used by an attacker to exfiltrate arbitrary memory from the ASP stage 2 bootloader potentially leading to information disclosure...

Information disclosure

A malicious or compromised User Application UApp or AGESA Boot Loader ABL could be used by an attacker to exfiltrate arbitrary memory from the ASP stage 2 bootloader potentially leading to information disclosure...

CVE-2021-26361

A malicious or compromised User Application UApp or AGESA Boot Loader ABL could be used by an attacker to exfiltrate arbitrary memory from the ASP stage 2 bootloader potentially leading to information disclosure...

CVE-2021-26361

The CVE-2021-26361 vulnerability affects AMD ASP/AGESA Boot Loader where a malicious or compromised UApp or ABL could exfiltrate arbitrary memory from the ASP stage 2 bootloader, leading to information disclosure. The issue is tied to the boot firmware stack (AGESA PI) across multiple AMD platfor...

CVE-2021-26363: Undefined Security Weakness

A malicious or compromised UApp or ABL could potentially change the value that the ASP uses for its reserved DRAM, to one outside of the fenced area, potentially leading to data exposure...

CVE-2021-26361: Undefined Security Weakness

A malicious or compromised User Application UApp or AGESA Boot Loader ABL could be used by an attacker to exfiltrate arbitrary memory from the ASP stage 2 bootloader potentially leading to information disclosure...

dotnet: parsing HTML causes Denial of Service

A flaw was found in dotnet. The Microsoft Security Advisory describes the issue of the ASP.NET FormFeature.cs causing a denial of service when HTML forms are parsed...

CVE-2021-26347

Failure to validate the integer operand in ASP AMD Secure Processor bootloader may allow an attacker to introduce an integer overflow in the L2 directory table in SPI flash resulting in a potential denial of service...

Integer overflow

Failure to validate the integer operand in ASP AMD Secure Processor bootloader may allow an attacker to introduce an integer overflow in the L2 directory table in SPI flash resulting in a potential denial of service...

CVE-2021-26347

CVE-2021-26347 is referenced in several advisories as part of AMD/ kernel-firmware updates. The description states a failure to validate the integer operand in the AMD Secure Processor bootloader could allow an integer overflow in the L2 directory table in SPI flash, potentially causing a denial ...

CVE-2021-26361

A malicious or compromised User Application UApp or AGESA Boot Loader ABL could be used by an attacker to exfiltrate arbitrary memory from the ASP stage 2 bootloader potentially leading to information disclosure...

Input validation

Insufficient validation of addresses in AMD Secure Processor ASP firmware system call may potentially lead to arbitrary code execution by a compromised user application...

CVE-2021-46771: Improper Input Validation

Insufficient validation of addresses in AMD Secure Processor ASP firmware system call may potentially lead to arbitrary code execution by a compromised user application...

PT-2022-6203

Name of the Vulnerable Software and Affected Versions InHand Networks InRouter302 version 3.5.4 Description An OS command injection issue exists in the httpd wlscan ASP functionality, allowing a specially-crafted HTTP request to lead to arbitrary command execution. An attacker can make an...

PT-2022-3461

Name of the Vulnerable Software and Affected Versions AMD Secure Processor ASP firmware affected versions not specified Description The issue is related to insufficient validation of addresses in the AMD Secure Processor ASP firmware system call, which may lead to arbitrary code execution by a...

TotoLink A3100R 访问控制错误漏洞

TotoLink A3100R is a series of wireless router TotoLink A3100R V5.9c.4577 from TotoLink Electronics Taiwan, China has an access control error vulnerability, which stems from test.asp contains an API-like function that is not authenticated and can be exploited by an attacker without authentication...

PT-2022-12189

Name of the Vulnerable Software and Affected Versions TOTOLINK A3100R versions =V4.1.2cu.5050 B20200504 Description A Command Injection issue exists, allowing potential exploitation via the hosTime parameter in the 'adm/ntm.asp' endpoint. Recommendations For TOTOLINK A3100R versions =V4.1.2cu.505...

TotoLink A3100R 命令注入漏洞

Totolink A3100R is a series of wireless routers from Totolink China.A command injection vulnerability exists in Totolink A3100R V4.1.2cu.5050B20200504 and prior versions, which stems from a lack of filtering and escaping of command data in the hostTime parameter in adm/ntm.asp. escaping. An...