PT-2023-13062 · Insyde · Insydeh2O

Name of the Vulnerable Software and Affected Versions: Insyde InsydeH2O versions 5.0 through 5.5 Description: An issue was discovered in Insyde InsydeH2O where DMA attacks on the PnpSmm shared buffer could cause TOCTOU race-condition issues, leading to corruption of SMRAM and escalation of...

CVE-2022-32473: Time-of-check Time-of-use (TOCTOU) Race Condition

An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. DMA attacks on the HddPassword shared buffer used by SMM and non-SMM code could cause TOCTOU race-condition issues that could lead to corruption of SMRAM and escalation of privileges. This attack can be mitigated using IOMMU...

PT-2023-13066

Name of the Vulnerable Software and Affected Versions Insyde InsydeH2O versions 5.0 through 5.5 Description An issue was discovered in Insyde InsydeH2O where DMA attacks on the HddPassword shared buffer could cause TOCTOU race-condition issues, leading to corruption of SMRAM and escalation of...

PT-2023-13223

Name of the Vulnerable Software and Affected Versions Insyde InsydeH2O versions 5.0 through 5.5 Description An issue was discovered in Insyde InsydeH2O that could cause TOCTOU race-condition issues due to DMA attacks on the NvmExpressDxe buffer used by SMM and non-SMM code, potentially leading to...

PT-2023-13221

Name of the Vulnerable Software and Affected Versions Insyde InsydeH2O with kernel 5.0 through 5.5 Description An issue was discovered in Insyde InsydeH2O that could cause TOCTOU race-condition issues due to DMA attacks on the SdHostDriver buffer used by SMM and non-SMM code, potentially leading ...

PT-2023-13222

Name of the Vulnerable Software and Affected Versions Insyde InsydeH2O with kernel 5.1 through 5.5 Description An issue was discovered in Insyde InsydeH2O that could cause TOCTOU race-condition issues due to DMA attacks on the SdMmcDevice buffer used by SMM and non-SMM code, potentially leading t...

PT-2023-13071

Name of the Vulnerable Software and Affected Versions Insyde InsydeH2O versions 5.0 through 5.5 Description An issue was discovered in Insyde InsydeH2O that could cause TOCTOU race-condition issues due to DMA attacks on the IdeBusDxe shared buffer used by SMM and non-SMM code, potentially leading...

PT-2023-13069

Name of the Vulnerable Software and Affected Versions Insyde InsydeH2O versions 5.0 through 5.5 Description An issue was discovered in Insyde InsydeH2O that could cause TOCTOU race-condition issues due to DMA attacks on the AhciBusDxe shared buffer used by SMM and non-SMM code, potentially leadin...

Siemens RUGGEDCOM APE1808 Product Family Competitive Conditions Vulnerability (CNVD-2023-09125)

RUGGEDCOM APE1808 is a utility-level application hosting platform that allows you to deploy a range of commercial applications for edge computing and network security in harsh industrial environments.A competitive condition vulnerability exists in the Siemens RUGGEDCOM APE1808 product family, whi...

Siemens RUGGEDCOM APE1808 product family competitive conditions vulnerability

RUGGEDCOM APE1808 is a utility-level application hosting platform that allows you to deploy a range of commercial applications for edge computing and network security in harsh industrial environments.A competitive condition vulnerability exists in the Siemens RUGGEDCOM APE1808 product family, whi...

Siemens RUGGEDCOM APE1808 product family competitive conditions vulnerability

RUGGEDCOM APE1808 is a utility-level application hosting platform that allows you to deploy a range of commercial applications for edge computing and network security in harsh industrial environments.A competitive condition vulnerability exists in the Siemens RUGGEDCOM APE1808 product family, whi...

Siemens SIMATIC Industrial Products

As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please seeSiemens' ProductCERT Security Advisories CERT Services | Services |...

Siemens RUGGEDCOM APE1808

As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please seeSiemens' ProductCERT Security Advisories CERT Services | Services |...

CVE-2022-43779

A potential Time-of-Check to Time-of-Use TOCTOU vulnerability has been identified in certain HP PC products using AMI UEFI Firmware system BIOS which might allow arbitrary code execution, denial of service, and information disclosure. AMI has released updates to mitigate the potential vulnerabili...

Information disclosure

A potential Time-of-Check to Time-of-Use TOCTOU vulnerability has been identified in certain HP PC products using AMI UEFI Firmware system BIOS which might allow arbitrary code execution, denial of service, and information disclosure. AMI has released updates to mitigate the potential vulnerabili...

Ubuntu 18.04 ESM / 20.04 ESM / 22.04 ESM : Grunt vulnerabilities (USN-5847-1)

The remote Ubuntu 18.04 ESM / 20.04 ESM / 22.04 ESM host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-5847-1 advisory. It was discovered that Grunt was not properly loading YAML files before parsing them. An attacker could possibly use this issue t...

CVE-2022-43779

CVE-2022-43779 is a TOCTOU vulnerability affecting certain HP PC products utilizing AMI UEFI Firmware (system BIOS). The issue could allow arbitrary code execution, denial of service, and information disclosure. The root cause is a Time-of-Check to Time-of-Use weakness in the firmware. AMI and HP...

CVE-2022-43779: Time-of-check Time-of-use (TOCTOU) Race Condition

A potential Time-of-Check to Time-of-Use TOCTOU vulnerability has been identified in certain HP PC products using AMI UEFI Firmware system BIOS which might allow arbitrary code execution, denial of service, and information disclosure. AMI has released updates to mitigate the potential vulnerabili...

PT-2023-14319

Name of the Vulnerable Software and Affected Versions HP PC products using AMI UEFI Firmware system BIOS affected versions not specified Description A potential Time-of-Check to Time-of-Use TOCTOU issue has been identified, which might allow arbitrary code execution, denial of service, and...

CVE-2022-27538

A potential Time-of-Check to Time-of-Use TOCTOU vulnerability has been identified in the BIOS for certain HP PC products which may allow arbitrary code execution, denial of service, and information disclosure. HP is releasing BIOS updates to mitigate the potential vulnerability...