UBUNTU-CVE-2020-25632

A flaw was found in grub2 in versions prior to 2.06. The rmmod implementation allows the unloading of a module used as a dependency without checking if any other dependent module is still loaded leading to a use-after-free scenario. This could allow arbitrary code to be executed or a bypass of...

UBUNTU-CVE-2020-14372

A flaw was found in grub2 in versions prior to 2.06, where it incorrectly enables the usage of the ACPI command when Secure Boot is enabled. This flaw allows an attacker with privileged access to craft a Secondary System Description Table SSDT containing code to overwrite the Linux kernel lockdow...

CVE-2020-26200

A component of Kaspersky custom boot loader allowed loading of untrusted UEFI modules due to insufficient check of their authenticity. This component is incorporated in Kaspersky Rescue Disk KRD and was trusted by the Authentication Agent of Full Disk Encryption in Kaspersky Endpoint Security KES...

CVE-2020-26200

CVE-2020-26200 affects a component of Kaspersky’s custom boot loader used by Kaspersky Rescue Disk (KRD) and trusted by the Authentication Agent of Full Disk Encryption in KES. The issue stems from insufficient checks of authenticity for loaded UEFI modules, enabling the loading of untrusted UEFI...

DEBIAN-CVE-2021-27097

The boot loader in Das U-Boot before 2021.04-rc2 mishandles a modified FIT...

CVE-2021-27138

The boot loader in Das U-Boot before 2021.04-rc2 mishandles use of unit addresses in a FIT...

Shining a Light on SolarCity: Practical Exploitation of the X2e IoT Device (Part Two)

In this post, we continue our analysis of the SolarCity ConnectPort X2e Zigbee device referred to throughout as X2e device. In Part One, we discussed the X2e at a high level, performed initial network-based attacks, then discussed the hardware techniques used to gain a remote shell on the X2e...

Multiple Cisco Products Data Forgery Issue Vulnerabilities

The Cisco 8000 Series Router and the Cisco Network Convergence System 540 Series Routers are both router devices from Cisco USA. A data forgery issue vulnerability exists in Cisco IOS XR on multiple Cisco routers. The vulnerability is caused due to an unlocked version of the GRUB bootloader on th...

PT-2021-1916

Name of the Vulnerable Software and Affected Versions Cisco Network Convergence System NCS 540 Series Routers versions running Cisco IOS XR NCS540L software images Cisco IOS XR Software for the Cisco 8000 Series Routers affected versions not specified Description The issue is related to multiple...

ahrightos-kernel (0.1.0), bootloader (>=0.10.0-alpha-01, <=0.10.13) +2 more potentially affected by CVE-2020-36208 via conquer-once (0.2.1)

conquer-once CARGO version 0.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on conquer-once and may be impacted: - ahrightos-kernel 0.1.0 - bootloader =0.10.0-alpha-01, =0.14.0, =0.1.0, =0.2.6 Source cves: CVE-2020-36208 Source advisory:...

Vulnerability fixed in Cisco IOS XR

A vulnerability in the Preboot eXecution Environment PXE bootloader for Cisco IOS XR 64-bit software could allow an unauthenticated, remote malicious agent to execute execute unsigned code during the PXE boot process on an affected device. The PXE bootloader is part of the BIOS and is executed...

scap-security-guide bug fix and enhancement update

The scap-security-guide project provides a guide for configuration of the system from the final system's security point of view. The guidance is specified in the Security Content Automation Protocol SCAP format and constitutes a catalog of practical hardening advice, linked to government...

CVE-2019-14715

Verifone Pinpad Payment Terminals allow undocumented physical access to the system via an SBI bootloader memory write operation...

Design/Logic Flaw

Verifone Pinpad Payment Terminals allow undocumented physical access to the system via an SBI bootloader memory write operation...

CVE-2019-14715

Verifone Pinpad Payment Terminals allow undocumented physical access to the system via an SBI bootloader memory write operation...

CVE-2019-14715

CVE-2019-14715 affects Verifone Pinpad Payment Terminals. The root cause is an undocumented physical access path via an SBI bootloader memory write operation, enabling local access that can impact confidentiality, integrity, and availability as reflected by CVSS metrics (CVSSv3.1: AV=Physical, AC...

CVE-2019-14715: Out-of-bounds Write

Verifone Pinpad Payment Terminals allow undocumented physical access to the system via an SBI bootloader memory write operation...

PT-2020-9587

Name of the Vulnerable Software and Affected Versions: Verifone Pinpad Payment Terminals affected versions not specified Description: The issue allows undocumented physical access to the system via an SBI bootloader memory write operation. Recommendations: At the moment, there is no information...

[SECURITY] Fedora 31 Update: grub2-2.02-110.fc31

The GRand Unified Bootloader GRUB is a highly configurable and customizable bootloader with modular architecture. It supports a rich variety of kernel formats, file systems, computer architectures and hardware devices...

Fedora: Security Advisory for grub2 (FEDORA-2020-e19b87f4f5)

The remote host is missing an update for the Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...