CVE-2021-3972

A potential vulnerability by a driver used during manufacturing process on some consumer Lenovo Notebook devices' BIOS that was mistakenly not deactivated may allow an attacker with elevated privileges to modify secure boot setting by modifying an NVRAM variable...

Cisco Catalyst Digital Building Series Switches and Cisco Catalyst Micro Switches Vulnerabilities (cisco-sa-cdb-cmicr-vulns-KJjFtNb)

According to its self-reported version, Cisco Catalyst Digital Building Series Switches and Cisco Catalyst Micro Switches Vulnerabilities is affected by the following vulnerabilities: - A denial of service DoS vulnerability exists in the boot loader. An unauthenticated, physical attacker can...

Lenovo issues fixes for laptop backdoors

Researchers have discovered three vulnerabilities affecting various Lenovo consumer laptop models. The vulnerabilities were found in UEFI firmware drivers originally meant to be used only during the manufacturing process, along with a vulnerability in the SW SMI handler function. The list of...

The vulnerability of the ChgBootDxeHook driver in Lenovo notebook BIOS microprogramming software allows a malicious actor to execute malicious drivers and applications during the boot process.

The vulnerability of the ChgBootDxeHook driver in Lenovo notebook BIOS microprogramming software relates to the possibility of modifying security boot settings by editing the NVRAM variable. Exploiting this vulnerability allows a hacker to execute malicious drivers and applications during the boo...

April 21, 2022 Servicing stack update (KB5012676)

None None...

April 21, 2022—KB5012636 (OS Build 17763.2867) Preview

None None...

Huawei EulerOS: Security Advisory for uboot-tools (EulerOS-SA-2022-1517)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

EulerOS 2.0 SP10 : uboot-tools (EulerOS-SA-2022-1517)

According to the versions of the uboot-tools package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - The boot loader in Das U-Boot before 2021.04-rc2 mishandles a modified FIT. CVE-2021-27097 - The boot loader in Das U-Boot before 2021.04-rc...

Huawei EulerOS: Security Advisory for uboot-tools (EulerOS-SA-2022-1498)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

EulerOS 2.0 SP10 : uboot-tools (EulerOS-SA-2022-1498)

According to the versions of the uboot-tools packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - The boot loader in Das U-Boot before 2021.04-rc2 mishandles a modified FIT. CVE-2021-27097 - The boot loader in Das U-Boot before 2021.04-r...

New Lenovo UEFI Firmware Vulnerabilities Affect Millions of Laptops

Three high-impact Unified Extensible Firmware Interface UEFI security vulnerabilities have been discovered impacting various Lenovo consumer laptop models, enabling malicious actors to deploy and execute firmware implants on the affected devices. Tracked as CVE-2021-3970, CVE-2021-3971, and...

VMware Spring Boot < 2.5.13, 2.6.x < 2.6.7 Data Binding Rules Vulnerability

VMware Spring Boot is prone to a data binding rules vulnerability in the used Spring Framework. SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

Lenovo Notebook 安全漏洞

Lenovo Notebook is a laptop computer from Lenovo, a Chinese company. A security vulnerability exists in Lenovo Notebook that originates from the use of an incorrect driver that is incorrectly not deactivated. A local privileged user can modify the secure boot settings and bypass the implemented...

CVE-2022-20731

Multiple vulnerabilities that affect Cisco Catalyst Digital Building Series Switches and Cisco Catalyst Micro Switches could allow an attacker to execute persistent code at boot time or to permanently prevent the device from booting, resulting in a permanent denial of service DoS condition. For...

CVE-2022-20661

Multiple vulnerabilities that affect Cisco Catalyst Digital Building Series Switches and Cisco Catalyst Micro Switches could allow an attacker to execute persistent code at boot time or to permanently prevent the device from booting, resulting in a permanent denial of service DoS condition. For...

CVE-2022-20731 Cisco Catalyst Digital Building Series Switches and Cisco Catalyst Micro Switches Vulnerabilities

Multiple vulnerabilities that affect Cisco Catalyst Digital Building Series Switches and Cisco Catalyst Micro Switches could allow an attacker to execute persistent code at boot time or to permanently prevent the device from booting, resulting in a permanent denial of service DoS condition. For...

CVE-2022-20661 Cisco Catalyst Digital Building Series Switches and Cisco Catalyst Micro Switches Vulnerabilities

Multiple vulnerabilities that affect Cisco Catalyst Digital Building Series Switches and Cisco Catalyst Micro Switches could allow an attacker to execute persistent code at boot time or to permanently prevent the device from booting, resulting in a permanent denial of service DoS condition. For...

Cisco Catalyst Digital Building Series Switches 安全漏洞

Cisco Catalyst Digital Building Series Switches are a series of digital building switches from Cisco USA. A security vulnerability exists in the Cisco Catalyst Digital Building Series Switches where an authenticated local attacker with level 15 privileges or an unauthenticated attacker with...

CVE-2022-20731

Multiple vulnerabilities that affect Cisco Catalyst Digital Building Series Switches and Cisco Catalyst Micro Switches could allow an attacker to execute persistent code at boot time or to permanently prevent the device from booting, resulting in a permanent denial of service DoS condition. For...

Spring Framework Data Binding Rules Vulnerability (CVE-2022-22968)

Table of Contents Overview Does This Affect My Application? Reassessing Your Data Binding Approach Overview While investigating the Spring Framework RCE vulnerability CVE-2022-22965 and the suggested workaround, we realized that the disallowedFields configuration setting on WebDataBinder is not...