EDK2 Security Vulnerability

EDK2 is a cross-platform firmware development environment from the Tianocore community based on the UEFI and PI specifications. A security vulnerability exists in EDK2, which stems from the Network Package's susceptibility to an infinite lop vulnerability when parsing the PadN option in the IPv6...

PT-2023-8387 · D Link · D-Link Dir-822

Name of the Vulnerable Software and Affected Versions: D-Link DIR-822+ version 1.0.2 Description: The issue is related to a lack of authentication for a critical function in the HNAP1 interface of the D-Link DIR-822+ router's firmware. This allows a remote attacker to log in to administrator...

Google Using Clang Sanitizers to Protect Android Against Cellular Baseband Vulnerabilities

Google is highlighting the role played by Clang sanitizers in hardening the security of the cellular baseband in the Android operating system and preventing specific kinds of vulnerabilities. This comprises Integer Overflow Sanitizer IntSan and BoundsSanitizer BoundSan, both of which are part of...

CVE-2023-32460

Dell PowerEdge BIOS contains an improper privilege management security vulnerability. An unauthenticated local attacker could potentially exploit this vulnerability, leading to privilege escalation...

Moderate: Red Hat Security Advisory: linux-firmware security and enhancement update

An update for linux-firmware is now available for Red Hat Enterprise Linux 9.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is availab...

DLA-3596-1 firmware-nonfree - security update

Bulletin has no description...

CVE-2023-44020

Tenda AC10U v1.0 USAC10UV1.0RTLV15.03.06.49multiTDE01 was discovered to contain a stack overflow via the security parameter in the formWifiBasicSet function...

Insyde InsydeH2O 安全漏洞

The RUGGEDCOM APE1808 is a utility-grade application hosting platform that allows you to deploy a range of commercial edge computing and cybersecurity applications in harsh industrial environments. An Inside BIOS vulnerability exists in the Siemens RUGGEDCOM APE1808 product family, which is cause...

Insyde InsydeH2O Security Breach

Insyde InsydeH2O is a C-language source from Insyde Corporation of Taiwan that implements the new technology "EFI/UEFI" specification, designed to replace the traditional BIOS Basic Input/Output System. A security vulnerability exists in Insyde InsydeH2O kernel versions 5.0 through 5.5, which...

HP BIOS firmware 安全漏洞

HP BIOS firmware is a printer BIOS firmware from Hewlett-Packard HP in the United States. A security vulnerability exists in HP BIOS firmware that originates from arbitrary code execution, denial of service, and information disclosure...

CVE-2022-38787

Improper input validation in firmware for some IntelR FPGA products before version 2.7.0 Hotfix may allow an authenticated user to potentially enable escalation of privilege via local access...

MSI Data Breach: Private Code Signing Keys Leaked on the Dark Web

The threat actors behind the ransomware attack on Taiwanese PC maker MSI last month have leaked the company's private code signing keys on their dark website. "Confirmed, Intel OEM private key leaked, causing an impact on the entire ecosystem," Alex Matrosov, founder and CEO of firmware security...

Google Teams Up with Ecosystem Partners to Enhance Security of SoC Processors

Google said it's working with ecosystem partners to harden the security of firmware that interacts with Android. While the Android operating system runs on what's called the application processor AP, it's just one of the many processors of a system-on-chip SoC that cater to various tasks like...

Google Teams Up with Ecosystem Partners to Enhance Security of SoC Processors

Google said it's working with ecosystem partners to harden the security of firmware that interacts with Android. While the Android operating system runs on what's called the application processor AP, it's just one of the many processors of a system-on-chip SoC that cater to various tasks like...

CVE-2023-24236

TOTOlink A7100RUV7.4cu.2313B20191024 was discovered to contain a command injection vulnerability via the province parameter at setting/delStaticDhcpRules...

CVE-2020-23588

CVE-2020-23588 affects OPTILINK OP-XT71000N hardware (Version V2.2) with firmware OP_V3.3.1-191028. An unauthenticated, remote attacker can perform a CSRF attack via /rmtacc.asp to enable/disable ports and to change port numbers. Impact: unauthorized configuration changes. The Red Hat advisory an...

Insyde InsydeH2O 缓冲区错误漏洞

Insyde InsydeH2O is a C source from Insyde Corporation of Taiwan, which implements the new technology "EFI/UEFI" specification designed to replace the traditional BIOS Basic Input/Output System. A security vulnerability exists in Insyde InsydeH2O PcdSmmDxe, which arises from the vulnerability of...

CVE-2022-34152

Improper input validation in BIOS firmware for some IntelR NUC Boards, IntelR NUC Kits before version TY0070 may allow a privileged user to potentially enable escalation of privilege via local access...

Multiple race conditions due to TOCTOU flaws in various UEFI Implementations

Overview Multiple Unified Extensible Firmware Interface UEFI implementations are vulnerable to code execution in System Management Mode SMM by an attacker who gains administrative privileges on the local machine. An attacker can corrupt the memory using Direct Memory Access DMA timing attacks tha...

Intel(R) SSD DC 授权问题漏洞

IntelR SSD DC is an internal solid state drive from Intel Corporation USA. A security vulnerability exists in IntelR SSD DC Products that stems from improper authentication in its firmware that could allow an unauthenticated user to potentially escalate privileges through physical access...