CVE-2024-33659

The CVE-2024-33659 entry concerns AMI AptioV BIOS with an Improper Input Validation flaw that allows a local attacker to overwrite memory and execute arbitrary code at the System Management Mode (SMM) level, impacting confidentiality, integrity, and availability. Documents consistently identify t...

AMI AptioV 安全漏洞

AMI AptioV is a firmware-related editor from AMI USA. A security vulnerability exists in AMI AptioV that stems from the inclusion of a BIOS vulnerability that can be exploited by an attacker to cause incorrect input validation by a local attacker...

CVE-2022-2827

AMI MegaRAC User Enumeration Vulnerability...

CVE-2022-26872

AMI Megarac Password reset interception via API...

Amazon Linux AMI : kernel (ALAS-2025-1957)

The version of kernel installed on the remote host is prior to 4.14.355-195.582. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2025-1957 advisory. In the Linux kernel, the following vulnerability has been resolved: net/ipv6: avoid possible UAF in...

Amazon Linux AMI : rsync (ALAS-2025-1954)

The version of rsync installed on the remote host is prior to 3.0.6-12.15. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2025-1954 advisory. Placeholder CVE. Details forthcoming CVE-2024-12085 Placeholder CVE. Details forthcoming CVE-2024-12086 Placeholder CVE...

Amazon Linux AMI : expat (ALAS-2025-1953)

The version of expat installed on the remote host is prior to 2.1.0-15.35. It is, therefore, affected by a vulnerability as referenced in the ALAS-2025-1953 advisory. An issue was discovered in libexpat before 2.6.3. xmlparse.c does not reject a negative length for XMLParseBuffer. CVE-2024-45490...

CVE-2022-29974

AMI aka American Megatrends NTFS driver 1.0.0 fixed in late 2021 or early 2022 has a buffer overflow. This driver is, for example, used in certain ASUS devices...

CVE-2022-29974

AMI aka American Megatrends NTFS driver 1.0.0 fixed in late 2021 or early 2022 has a buffer overflow. This driver is, for example, used in certain ASUS devices...

CVE-2022-29974

AMI aka American Megatrends NTFS driver 1.0.0 fixed in late 2021 or early 2022 has a buffer overflow. This driver is, for example, used in certain ASUS devices...

CVE-2022-29974

AMI NTFS driver 1.0.0 contains a buffer overflow vulnerability. The driver is used in certain ASUS devices. The issue was fixed by AMI in late 2021 or early 2022; downstream products may not reflect the fix yet. Red Hat records the same description. Practical impact is a potential overflow in the...

Asterisk AMI Originate Authenticated Remote Code Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Asterisk AMI Originate Authenticated RCE', 'Description' = %q On Asterisk, prior to versions 18.24.2, 20.9.2, and 21.4.2 and certified-asterisk...

Asterisk AMI Originate Authenticated Remote Code Execution Exploit

On Asterisk, prior to versions 18.24.2, 20.9.2, and 21.4.2 and certified-asterisk versions 18.9-cert11 and 20.7-cert2, an AMI user with write=originate may change all configuration files in the /etc/asterisk/ directory. Writing a new extension can be created which performs a system command to...

Unable to encrypt Identity disk on AWS when using encrypted master image

The AMI was created using an encrypted instance\snapshot. However, the MCS machines appear with identity disk "Not encrypted"...

Multi-vendor BIOS Security Vulnerabilities (November, 2024) - Lenovo Support US

No description provided...

Amazon Linux AMI : amazon-ssm-agent (ALAS-2024-1948)

The version of amazon-ssm-agent installed on the remote host is prior to 3.3.859.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2024-1948 advisory. An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive numb...

Amazon Linux AMI : kernel (ALAS-2024-1947)

The version of kernel installed on the remote host is prior to 4.14.352-190.568. It is, therefore, affected by a vulnerability as referenced in the ALAS-2024-1947 advisory. In the Linux kernel, the following vulnerability has been resolved: ima: Fix use-after-free on a dentry's dname.name...

Amazon Linux AMI : microcode_ctl (ALAS-2024-1946)

The version of microcodectl installed on the remote host is prior to 2.1-47.43. It is, therefore, affected by a vulnerability as referenced in the ALAS-2024-1946 advisory. Improper isolation in some IntelR Processors stream cache mechanism may allow an authenticated user to potentially enable...

CVE-2024-42365

Asterisk is an open source private branch exchange PBX and telephony toolkit. Prior to asterisk versions 18.24.2, 20.9.2, and 21.4.2 and certified-asterisk versions 18.9-cert11 and 20.7-cert2, an AMI user with write=originate may change all configuration files in the /etc/asterisk/ directory. Thi...

CVE-2024-42365

Asterisk is an open source private branch exchange PBX and telephony toolkit. Prior to asterisk versions 18.24.2, 20.9.2, and 21.4.2 and certified-asterisk versions 18.9-cert11 and 20.7-cert2, an AMI user with write=originate may change all configuration files in the /etc/asterisk/ directory. Thi...