PongoOS

pongoOS A pre-boot execution environment for Apple boards built on top of checkra1n. Building on macOS Install Xcode + command-line utilities Run make all Building on Linux Install clang if in doubt, from apt.llvm.org Install ld64 and cctools' strip. On Debian/Ubuntu these can be installed from t...

dubiousdisk

dubious disk - セキュアブートに抜群の効果を発揮するポリゴンZ! CVE-2022-30203、CVE-2023-21560、CVE-2023-28269、CVE-2023-28249、その他多数... Windows ブート環境の過度に寛容なコードは、任意のメモリの上書き、 ひいては任意のコード実行を可能にします。 Exploitro は Field-FX 2024 ワイルドコンポで第3位に入賞しました。 コード: Rairii エンジンコード: NoNameNo XM プレイヤー: a1k0n リメイク版 TopazPlus フォント: dMG/Up Rough &...

UEFI Shell module embedded in SPI Flash can be used to bypass Secure Boot

Overview The UEFI Shell program may expose raw memory access capabilities that, if present in platform firmware for debugging or advanced support use cases, could be abused to undermine UEFI Secure Boot protections. When the UEFI Shell is included in SPI flash, an attacker with the ability to...

CVE-2026-82017

IGEL OS 12 before 12.7.6 and IGEL OS 11 before 11.11.150 contain a boot registry parameter injection vulnerability that allows attackers with physical access to execute arbitrary Linux loader parameters by writing to an unencrypted and unsigned configuration area read by the signed bootloader...

CVE-2026-82017: Insufficient Verification of Data Authenticity

IGEL OS 12 before 12.7.6 and IGEL OS 11 before 11.11.150 contain a boot registry parameter injection vulnerability that allows attackers with physical access to execute arbitrary Linux loader parameters by writing to an unencrypted and unsigned configuration area read by the signed bootloader...

OESA-2026-2079 shim security update

Initial UEFI bootloader that handles chaining to a trusted full \ bootloader under secure boot environments. Security Fixes: Issue summary: When a delta CRL that contains a Delta CRL Indicator extension is processed a NULL pointer dereference might happen if the required CRL Number extension is...

Linux Distros Unpatched Vulnerability : CVE-2017-3226

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Das U-Boot is a device bootloader that can read its configuration from an AES encrypted file. Devices that make use of Das U-Boot's AES-CBC encryption feature...

Linux Distros Unpatched Vulnerability : CVE-2023-39950

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - efibootguard is a simple UEFI boot loader with support for safely switching between current and updated partition sets. Insufficient or missing validation and...

CVE-2024-22013

U-Boot environment is read from unauthenticated partition...

CVE-2024-22013

U-Boot environment is read from unauthenticated partition...

CVE-2024-22013

The Google Nest Wifi Point and Google Nest Wifi Router are affected by a security vulnerability where the U-Boot environment is read from an unauthenticated partition . This lack of proper authentication or access control may allow unauthorized access to sensitive information. No specific version...

Google Nest Wifi Point和Google Nest Wifi Router 安全漏洞

Google Nest Wifi Point and Google Nest Wifi Router are both products of Google Inc.Google Nest Wifi Point is a device that extends an existing Wi-Fi network and has a built-in Google Assistant.Google Nest Wifi Router is a smart router. The Google Nest Wifi Point is a device that extends an existi...

PT-2023-24730 · Insyde · Insydeh2O

Name of the Vulnerable Software and Affected Versions: Insyde InsydeH2O versions 5.0 through 5.5 Description: An issue was discovered in SystemFirmwareManagementRuntimeDxe. The implementation of the GetImage method retrieves the value of a runtime variable named GetImageProgress, and later uses...

CVE-2022-40080

Stack overflow vulnerability in Aspire E5-475G 's BIOS firmware, in the FpGui module, a second call to GetVariable services allows local attackers to execute arbitrary code in the UEFI DXE phase and gain escalated privileges...

Abode Systems, Inc. iota All-In-One Security Kit web interface util_set_serial_mac OS command injection vulnerability

Talos Vulnerability Report TALOS-2022-1566 Abode Systems, Inc. iota All-In-One Security Kit web interface utilsetserialmac OS command injection vulnerability October 20, 2022 CVE Number CVE-2022-29472 SUMMARY An OS command injection vulnerability exists in the web interface utilsetserialmac...

[SECURITY] Fedora 36 Update: uboot-tools-2022.04-2.fc36

This package contains a few U-Boot utilities - mkimage for creating boot imag es and fwprintenv/fwsetenv for manipulating the boot environment variables...

Dell PowerEdge Buffer Overflow Vulnerability

Dell PowerEdge Server BIOS is a system update driver from Dell, a security vulnerability in Dell PowerEdge that could be exploited by attackers to cause a denial of service, execute arbitrary code, or compromise information in a UEFI or BIOS pre-boot environment...

Dell PowerEdge 缓冲区错误漏洞

Dell PowerEdge Server BIOS is a system update driver from Dell Dell. A security vulnerability exists in Dell PowerEdge, which can be exploited by an attacker to cause a denial of service, arbitrary code execution, or information disclosure in a UEFI or BIOS pre-boot environment...

CVE-2019-16258

The bootloader of the homee Brain Cube V2 through 2.23.0 allows attackers with physical access to gain root access by manipulating the U-Boot environment via the CLI after connecting to the internal UART interface...

CVE-2019-16258

The bootloader of the homee Brain Cube V2 through 2.23.0 allows attackers with physical access to gain root access by manipulating the U-Boot environment via the CLI after connecting to the internal UART interface...