CVE-2021-21571

CVE-2021-21571 concerns the Dell BIOSConnect/HTTPS Boot stack in Dell UEFI BIOS. The vulnerability is due to improper certificate validation in the BIOSConnect HTTPS path, enabling a MITM attacker to remotely deliver content and potentially cause denial of service and payload tampering. Affected ...

BIOS Disconnect: New High-Severity Bugs Affect 128 Dell PC and Tablet Models

Cybersecurity researchers on Thursday disclosed a chain of vulnerabilities affecting the BIOSConnect feature within Dell Client BIOS that could be abused by a privileged network adversary to gain arbitrary code execution at the BIOS/UEFI level of the affected device. "As the attacker has the...

30M Dell Devices at Risk for Remote BIOS Attacks, RCE

UPDATE A high-severity series of four vulnerabilities can allow remote adversaries to gain arbitrary code execution in the pre-boot environment on Dell devices, researchers said. They affect an estimated 30 million individual Dell endpoints worldwide. According to an analysis from Eclypsium, the...

Fixed vulnerabilities in Dell boot functionality.

Eclypsium has discovered vulnerabilities in Dell SupportAssist for Windows. The vulnerabilities allow an unauthenticated remote malicious person able to execute arbitrary code in the BIOS before the operating system is booted. The malicious must perform a man-in-the-middle attack to do so and...

SQL Injection Vulnerability in Jeecg Boot of Beijing Guo Torch Information Technology Co.

Jeecg Boot is a low-code BPM-based platform. A SQL injection vulnerability exists in Jeecg Boot, which can be exploited by an attacker to obtain sensitive database information...

SQL Injection Vulnerability in Jeecg Boot of Beijing National Torch Information Technology Co. Ltd (CNVD-2021-47665)

Jeecg Boot is a low-code BPM-based platform. A SQL injection vulnerability exists in JeecgBoot of Beijing National Torch Information Technology Co. Ltd, which can be exploited by an attacker to obtain sensitive information from a database...

How to determine XenServer is booted in uefi or legacy mode

Determine XenServer is booted in uefi or legacy mode...

CVE-2021-34388

Bootloader contains a vulnerability in NVIDIA TegraBoot where a potential heap overflow might allow an attacker to control all the RAM after the heap block, leading to denial of service or code execution...

NVIDIA MB2 缓冲区错误漏洞

Nvidia NVIDIA MB2 is a component of Nvidia Corporation, USA. NVIDIA MB2 suffers from a buffer error vulnerability that stems from the boot loader containing a vulnerability in NVIDIA MB2, where a potential heap overflow could result in heap metadata corruption. An attacker could exploit the...

Nvidia NVIDIA MB2 缓冲区错误漏洞

Nvidia NVIDIA MB2 is a component of Nvidia Corporation, USA. A security vulnerability exists in NVIDIA MB2 that stems from a boot loader containing a vulnerability in NVIDIA MB2, where a potential heap overflow could result in heap metadata corruption. An attacker can exploit the vulnerability to...

Nvidia NVIDIA MB2 缓冲区错误漏洞

Nvidia NVIDIA MB2 is a component of Nvidia Corporation, USA. A security vulnerability exists in NVIDIA MB2 that stems from a boot loader containing a vulnerability in NVIDIA MB2, where a potential heap overflow could result in heap metadata corruption. An attacker can exploit the vulnerability to...

Nvidia NVIDIA MB2 缓冲区错误漏洞

Nvidia NVIDIA MB2 is a component of Nvidia Corporation, USA. NVIDIA MB2 suffers from a buffer error vulnerability that stems from the boot loader containing a vulnerability in NVIDIA MB2, where a potential heap overflow could result in heap metadata corruption. An attacker could exploit the...

NVIDIA MB2 访问控制错误漏洞

Nvidia NVIDIA MB2 is a component of Nvidia Corporation, USA. NVIDIA MB2 suffers from an Access Control Error vulnerability that stems from the boot loader containing a vulnerability in NVIDIA MB2, where a potential heap overflow could lead to heap metadata corruption. An attacker could use this...

Nvidia NVIDIA MB2 缓冲区错误漏洞

Nvidia NVIDIA MB2 is a component of Nvidia Corporation, USA. A security vulnerability exists in NVIDIA MB2 that stems from a boot loader containing a vulnerability in NVIDIA MB2, where a potential heap overflow could result in heap metadata corruption. An attacker can exploit the vulnerability to...

Ubuntu: Security Advisory (USN-4992-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

USN-4992-1: GRUB 2 vulnerabilities

Máté Kukri discovered that the acpi command in GRUB 2 allowed privileged users to load crafted ACPI tables when secure boot is enabled. An attacker could use this to bypass UEFI Secure Boot restrictions. CVE-2020-14372 Chris Coulson discovered that the rmmod command in GRUB 2 contained a use-...

Ubuntu 18.04 LTS / 20.04 LTS : GRUB 2 vulnerabilities (USN-4992-1)

The remote Ubuntu 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4992-1 advisory. Mt Kukri discovered that the acpi command in GRUB 2 allowed privileged users to load crafted ACPI tables when secure boot is enabled. An...

[SECURITY] Fedora 33 Update: microcode_ctl-2.1-43.2.fc33

The microcodectl utility is a companion to the microcode driver written by Tigran Aivazian . The microcode update is volatile and needs to be uploaded on each system boot i.e. it doesn't reflash your cpu permanently, reboot and it reverts back to the old microcode...

SpringBootVulExploit

It is an offensive tool for Spring Boot exploitation. The repository contains a collection of exploits and techniques for exploiting Spring Boot applications, including: Spring Boot Vulnerability Exploit Check List: a checklist for identifying vulnerabilities in Spring Boot applications...

Improper Authentication in Atlassian Connect Spring Boot

Broken Authentication in Atlassian Connect Spring Boot ACSB in version 1.1.0 before 2.1.3 and from version 2.1.4 before 2.1.5: Atlassian Connect Spring Boot is a Java Spring Boot package for building Atlassian Connect apps. Authentication between Atlassian products and the Atlassian Connect Sprin...