CVE-2023-48424

U-Boot shell vulnerability resulting in Privilege escalation in a production device...

Design/Logic Flaw

there is a possible permanent DoS or way for the modem to boot unverified firmware due to a logic error in the code. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation...

OESA-2023-1899 arm-trusted-firmware security update

Trusted Firmware-A is a reference implementation of secure world software for Arm A-Profile architectures Armv8-A and Armv7-A, including an Exception Level 3 EL3 Secure Monitor. Security Fixes: Trusted Firmware-A through 2.8 has an out-of-bounds read in the X.509 parser for parsing boot...

PT-2023-30826 · Google · Android

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: The issue is related to a logic error in the code that could lead to a permanent DoS or allow the modem to boot unverified firmware. This could result i...

CVE-2023-5058

Improper Input Validation in the processing of user-supplied splash screen during system boot in Phoenix SecureCore™ Technology™ 4 potentially allows denial-of-service attacks or arbitrary code execution...

CVE-2023-5058

Improper Input Validation in the processing of user-supplied splash screen during system boot in Phoenix SecureCore™ Technology™ 4 potentially allows denial-of-service attacks or arbitrary code execution...

CVE-2023-5058

Phoenix SecureCore Technology 4 is affected by an improper input validation issue in the processing of user-supplied splash screens during system boot, which could allow denial-of-service or arbitrary code execution. Affected product: Phoenix SecureCore Technology 4 firmware. Root cause: improper...

PT-2023-30844 · U-Boot · U-Boot

Name of the Vulnerable Software and Affected Versions: U-Boot affected versions not specified Description: The issue is related to a U-Boot shell vulnerability that results in privilege escalation in a production device. Recommendations: At the moment, there is no information about a newer versio...

Dalmann OCPP.Core Security Vulnerability

Dalmann OCPP.Core is an OCPP Open Charge Point Protocol server written in .NET 6 by Ulrich Personal Developer. A security vulnerability exists in Dalmann OCPP.Core versions prior to 1.2.0, which stems from the server not validating the length of the chargePointVendor field in BootNotification...

Important: Red Hat Security Advisory: Red Hat AMQ Streams 2.6.0 release and security update

Red Hat AMQ Streams 2.6.0 is now available from the Red Hat Customer Portal. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability...

spring-boot: Security Bypass With Wildcard Pattern Matching on Cloud Foundry

A flaw was found in Spring Boot. This targets specifically 'spring-boot-actuator-autoconfigure' package. This issue occurs when an application is deployed to Cloud Foundry, which could be susceptible to a security bypass. Specifically, an application is vulnerable when all of the following are...

The vulnerability of the BIOS configuration software Phoenix SecureCore Technology lies in errors during the processing of the user’s startup screen during system boot. This allows a malicious actor to cause a service failure or execute arbitrary code.

The vulnerability of the BIOS configuration software Phoenix SecureCore Technology is related to errors in processing the user’s startup screen during system boot-up. Exploiting this vulnerability can allow an attacker to cause a service failure or execute arbitrary code...

Image files in UEFI can be abused to modify boot behavior

Overview Implementation of Unified Extensible Firmware Interface UEFI by Vendors provide a way to customize logo image displayed during the early boot phase. Binarly has uncovered vulnerabilities in the image parsing libraries that provide this capability. An attacker with local privileged access...

Advisory ROSA-SA-2023-2300

Software: grub2 2.02 OS: ROSA Virtualization 2.1 packageevrstring: grub2-2.02-106.0.3.rv3.src.rpm CVE-ID: CVE-2020-14372 BDU-ID: 2022-00326 CVE-Crit: HIGH CVE-DESC.: A vulnerability in the Secure Boot protocol implementation of the Grub2 operating system boot loader is related to an incorrect...

CVE-2023-33017

Memory corruption in Boot while running a ListVars test in UEFI Menu during boot...

Memory corruption

Memory corruption in Boot while running a ListVars test in UEFI Menu during boot...

CVE-2023-33017 Buffer Copy Without Checking Size of Input in Boot

Memory corruption in Boot while running a ListVars test in UEFI Menu during boot...

CVE-2023-33017

CVE-2023-33017 describes memory corruption in Boot during a ListVars test in the UEFI Menu on Qualcomm chipsets. The affected component is the UEFI/boot path, with the root cause cited as a memory corruption issue during boot testing. Documented impact scores indicate high potential for confident...

IceCMS Cross-Site Scripting Vulnerability (CNVD-2023-98191)

IceCMS is a content management system based on Spring Boot + Vue front-end and back-end separation . A cross-site scripting vulnerability exists in IceCMS version 2.0.1. The vulnerability stems from the application's lack of effective filtering and escaping of user-supplied data, which can be...

Qualcomm Chipsets Security Vulnerability

Qualcomm Chipsets are a family of chipsets from Qualcomm Incorporated USA. A security vulnerability exists in Qualcomm Chipsets that stems from a buffer copy in the boot that does not check the input size...