CVE-2021-3519

A vulnerability was reported in some Lenovo Desktop models that could allow unauthorized access to the boot menu, when the "BIOS Password At Boot Device List" BIOS setting is Yes...

CVE-2021-3519

A vulnerability was reported in some Lenovo Desktop models that could allow unauthorized access to the boot menu, when the "BIOS Password At Boot Device List" BIOS setting is Yes...

Design/Logic Flaw

A vulnerability was reported in some Lenovo Desktop models that could allow unauthorized access to the boot menu, when the "BIOS Password At Boot Device List" BIOS setting is Yes...

CVE-2021-3719

A potential vulnerability in the SMI callback function that saves and restore boot script tables used for resuming from sleep state in some ThinkCentre and ThinkStation models may allow an attacker with local access and elevated privileges to execute arbitrary code...

CVE-2021-3519

CVE-2021-3519 affects some Lenovo Desktop models where enabling the BIOS setting “BIOS Password At Boot Device List” (Yes) can allow unauthorized access to the boot menu. The vulnerability is described as a physical-access issue with impact on confidentiality, integrity, and availability (CVSSv3....

ThinkStation 授权问题漏洞

Lenovo ThinkStation is a desktop workstation from the Chinese company Lenovo. An authorization issue vulnerability exists in ThinkStation, which can be exploited to gain unauthorized access to the boot menu when "BIOS Password At Boot Device List" is set to True...

Hands-On IoT Hacking: Rapid7 at DefCon 29 IoT Village, Part 4

The first 3 installments of our series on Rapid7's hands-on exercise from the IoT Village at this year's DefCon covered how to set up a UART header, how to determine UART status and baud rate, and how to log into single-user mode on the device. In this final post, we'll discuss how to gain full...

EulerOS 2.0 SP9 : uboot-tools (EulerOS-SA-2021-2701)

According to the versions of the uboot-tools packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - In Das U-Boot through 2020.01, a double free has been found in the cmd/gpt.c dorenamegptparts function. Double freeing may result in a...

Red Hat Enterprise Linux 安全漏洞

Red Hat Enterprise Linux is a Linux operating system for business users from Red Hat, Inc. A security vulnerability exists in Red Hat Enterprise Linux, which stems from a /sbin/kexec binary file that helps to boot a new kernel using the kernel's kexec functionality during a normal or emergency...

CVE-2021-26335

Improper input and range checking in the AMD Secure Processor ASP boot loader image header may allow an attacker to use attacker-controlled values prior to signature validation potentially resulting in arbitrary code execution...

kernel: powerpc: RTAS calls can be used to compromise kernel integrity

A flaw was found in the way RTAS handled memory accesses in userspace to kernel communication. On a locked down usually due to Secure Boot guest system running on top of PowerVM or KVM hypervisors pseries platform a root like local user could use this flaw to further increase their privileges to...

boom-boot bug fix and enhancement update

An update is available for boom-boot. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list For detailed information on changes in this release, see the Rocky Enterpri...

Hands-On IoT Hacking: Rapid7 at DefCon 29 IoT Village, Part 3

In our first post in this series, we covered the setup of Rapid7's hands-on exercise at Defcon 29's IoT Village. Last week, we discussed how to determine the UART status of the header we created and how to actually start hacking on the IoT device. The goal in this next phase of the IoT hacking...

CVE-2021-35535

Insecure Boot Image vulnerability in Hitachi Energy Relion Relion 670/650/SAM600-IO series allows an attacker who manages to get access to the front network port and to cause a reboot sequences of the device may exploit the vulnerability, where there is a tiny time gap during the booting process...

PVS Target Devices experience long boot times with HP servers and Virtual Connects

When streaming a vDisk to a target device on a hypervisor leveraging HP servers and virtual connects, admins may see longer than usual boot time...

Security Restriction Bypass

spring-boot-actuator is vulnerable to security restriction bypass. Lack of secure handling of HTTP resources implemented by custom controllers using a configured base API path and a controller type-level request mapping causes the exposure of those resources and request mapping, leading to...

Moderate: Red Hat Security Advisory: Red Hat support for Spring Boot 2.4.9 security update

An update is now available for Red Hat support for Spring Boot. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability. For more...

NewStart CGSL CORE 5.04 / MAIN 5.04 : grub2 Multiple Vulnerabilities (NS-SA-2021-0097)

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has grub2 packages installed that are affected by multiple vulnerabilities: - A flaw was found in grub2 in versions prior to 2.06, where it incorrectly enables the usage of the ACPI command when Secure Boot is enabled. This fla...

Target device boot failure "EFI system partition (ESP) error: Unsupported, Streaming aborted"

This PC has UEFI instead of BIOS, by leveraging Booting from the NIC using DHCP. PVSNBPX65.EFI is already downloaded. Now the error is:" Boot from local disk. "EFI system partition ESP error: Unsupported, Streaming aborted" The error disappears if PC inserts a local hard drive...

NewStart CGSL CORE 5.05 / MAIN 5.05 : fwupdate Vulnerability (NS-SA-2021-0136)

The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has fwupdate packages installed that are affected by a vulnerability: - A flaw was found in grub2, prior to version 2.06. An attacker may use the GRUB 2 flaw to hijack and tamper the GRUB verification process. This flaw also...