UBUNTU-CVE-2022-49883

In the Linux kernel, the following vulnerability has been resolved: KVM: x86: smm: number of GPRs in the SMRAM image depends on the image format On 64 bit host, if the guest doesn't have X86FEATURELM, KVM will access 16 gprs to 32-bit smram image, causing out-ouf-bound ram access. On 32 bit host,...

PT-2025-17632 · Insyde · Insydeh2O

Name of the Vulnerable Software and Affected Versions: Insyde InsydeH2O kernel versions 5.2 through 5.7 before version 05.70.50 Description: An issue was discovered in the InsydeH2O kernel, where the SmmUpdateVariablePropertySmi function, a SMM callback function in the VariableRuntimeDxe driver,...

CVE-2025-31855

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in softnwords SMM API smm-api allows Stored XSS.This issue affects SMM API: from n/a through = 6.0.31...

CVE-2025-31855

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in softnwords SMM API smm-api allows Stored XSS.This issue affects SMM API: from n/a through = 6.0.31...

CVE-2025-31855 WordPress SMM API plugin <= 6.0.27 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in softnwords SMM API allows Stored XSS. This issue affects SMM API: from n/a through 6.0.27...

CVE-2025-31855 WordPress SMM API plugin <= 6.0.31 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in softnwords SMM API smm-api allows Stored XSS.This issue affects SMM API: from n/a through = 6.0.31...

CVE-2025-31855

CVE-2025-31855 is a Stored XSS in the WordPress SMM API plugin. Affected: SMM API versions up to 6.0.30 (per Wordfence listing shows Unpatched

HPESBCR04827 rev.1 - Certain HPE Cray Servers Using Certain AMD EPYC Processors, AMD-SB-7027: AMD System Management Mode (SMM) Vulnerabilities, Local Arbitrary Code Execution Vulnerability

Potential Security Impact: Local: Arbitrary Code Execution SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE Cray EX235a Accelerator Blade - Prior to v2.1.0 HFP 25.1.2 HPE Cray EX235n Server - Prior to v1.5.1 HFP 24.10.1 HPE Cray EX255a Accelerator Blade - Prior to v1.4.0 HFP...

CVE-2024-54084 SMM Arbitrary Write via TOCTOU Vulnerability

APTIOV contains a vulnerability in BIOS where an attacker may cause a Time-of-check Time-of-use TOCTOU Race Condition by local means. Successful exploitation of this vulnerability may lead to arbitrary code execution...

SUSE CVE-2024-36347

Improper signature verification in AMD CPU ROM microcode patch loader may allow an attacker with local administrator privilege to load malicious microcode, potentially resulting in loss of integrity of x86 instruction execution, loss of confidentiality and integrity of data in x86 CPU privileged...

microcode_ctl: Improper input validation in UEFI firmware CseVariableStorageSmm

Improper input validation in UEFI firmware CseVariableStorageSmm for some IntelR Processors may allow a privileged user to potentially enable escalation of privilege via local access...

CVE-2024-27353

A memory corruption vulnerability in SdHost and SdMmcDevice in Insyde InsydeH2O kernel 5.2 before 05.29.09, kernel 5.3 before 05.38.09, kernel 5.4 before 05.46.09, kernel 5.5 before 05.54.09, and kernel 5.6 before 05.61.09 could lead to escalating privileges in SMM...

CVE-2023-31342

Improper input validation in the SMM handler may allow a privileged attacker to overwrite SMRAM, potentially leading to arbitrary code execution...

CVE-2024-21924

SMM callout vulnerability within the AmdPlatformRasSspSmm driver could allow a ring 0 attacker to modify boot services handlers, potentially resulting in arbitrary code execution...

CVE-2024-0179

A flaw was found in the UEFI module's System Management Mode SMM. SMM callout within the AmdCpmDisplayFeatureSMM driver could allow locally authenticated attackers to overwrite SMRAM, potentially resulting in arbitrary code execution. Mitigation Available mitigation requires updating the BIOS...

CVE-2023-31345

CVE-2023-31345 is an AMD SMM-handling vulnerability in AMD Secure Processor firmware. The issue stems from improper input validation in the SMM handler, which could allow a privileged attacker to overwrite SMRAM and potentially achieve arbitrary code execution. Affected context is AMD client/serv...

CVE-2023-31345

Improper input validation in the SMM handler may allow a privileged attacker to overwrite SMRAM, potentially leading to arbitrary code execution...

CVE-2023-31342

Improper input validation in the SMM handler may allow a privileged attacker to overwrite SMRAM, potentially leading to arbitrary code execution...

CVE-2023-31343

Improper input validation in the SMM handler may allow a privileged attacker to overwrite SMRAM, potentially leading to arbitrary code execution...

CVE-2024-0179

SMM Callout vulnerability within the AmdCpmDisplayFeatureSMM driver could allow locally authenticated attackers to overwrite SMRAM, potentially resulting in arbitrary code execution...