39 matches found
CVE-2026-55642
dbx is a cross-platform database client for databases. Prior to 0.5.51, dbx-web authmiddleware in crates/dbx-web/src/auth.rs passes every protected request to the handler chain when passwordhash is None. A fresh deployment reaches that state when DBXPASSWORD is unset and no stored password exists...
CVE-2026-55642 dbx: Unauthenticated arbitrary SQL execution in dbx-web (authentication fails open when no password is configured)
dbx is a cross-platform database client for databases. Prior to 0.5.51, dbx-web authmiddleware in crates/dbx-web/src/auth.rs passes every protected request to the handler chain when passwordhash is None. A fresh deployment reaches that state when DBXPASSWORD is unset and no stored password exists...
CVE-2026-55642
In dbx-web before 0.5.51, auth_middleware in crates/dbx-web/src/auth.rs bypasses authentication when password_hash is None, which occurs on fresh deployments with DBX_PASSWORD unset. The service binds to 0.0.0.0:4224 by default, allowing unauthenticated attackers to call /api/connection/connect a...
EUVD-2026-63470
dbx is a cross-platform database client for databases. Prior to 0.5.51, dbx-web authmiddleware in crates/dbx-web/src/auth.rs passes every protected request to the handler chain when passwordhash is None. A fresh deployment reaches that state when DBXPASSWORD is unset and no stored password exists...
CVE-2026-55642 dbx: Unauthenticated arbitrary SQL execution in dbx-web (authentication fails open when no password is configured)
dbx is a cross-platform database client for databases. Prior to 0.5.51, dbx-web authmiddleware in crates/dbx-web/src/auth.rs passes every protected request to the handler chain when passwordhash is None. A fresh deployment reaches that state when DBXPASSWORD is unset and no stored password exists...
PT-2026-79060
dbx is a cross-platform database client for databases. Prior to 0.5.51, dbx-web auth middleware in crates/dbx-web/src/auth.rs passes every protected request to the handler chain when password hash is None. A fresh deployment reaches that state when DBX PASSWORD is unset and no stored password...
SUSE CVE-2026-8863
Multiple Microsoft-sigend UEFI SHIM bootloaders are vulnerable to SecureBoot bypass. An attacker with administrative privileges or the ability to modify the boot process could use one of the vulnerable shim bootloaders to bypass Secure Boot protections and execute arbitrary code before the...
CVE-2026-8863 CVE-2026-8863
Multiple Microsoft-sigend UEFI SHIM bootloaders are vulnerable to SecureBoot bypass. An attacker with administrative privileges or the ability to modify the boot process could use one of the vulnerable shim bootloaders to bypass Secure Boot protections and execute arbitrary code before the...
CVE-2026-8863 CVE-2026-8863
Multiple Microsoft-sigend UEFI SHIM bootloaders are vulnerable to SecureBoot bypass. An attacker with administrative privileges or the ability to modify the boot process could use one of the vulnerable shim bootloaders to bypass Secure Boot protections and execute arbitrary code before the...
CVE-2026-8863
CVE-2026-8863 affects multiple Microsoft-signed UEFI SHIM bootloaders and enables bypass of Secure Boot, allowing code execution before the OS loads. Root cause: vulnerable SHIM bootloaders; impact: bypass of Secure Boot and arbitrary code execution at boot. Remediation: block via a specific UEFI...
CVE-2020-7205
A potential security vulnerability has been identified in HPE Intelligent Provisioning, Service Pack for ProLiant, and HPE Scripting ToolKit. The vulnerability could be locally exploited to allow arbitrary code execution during the boot process. Note: This vulnerability is related to using insmod...
EUVD-2002-2181
Malware in sbrugna...
Unity Linux 20.1070e Security Update: kernel (UTSA-2025-414675)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-414675 advisory. The Linux kernel through 5.8.13 does not properly enforce the Secure Boot Forbidden Signature Database aka dbx protection mechanism. This affects certs/blacklist.c a...
Malicious code in dbx-js-tools (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a2191dabfd9180ad79d00f6678faee7b75417b6a5ee484798bff290a81fa0d56 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2025-178 Malicious code in dbx-js-tools (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a2191dabfd9180ad79d00f6678faee7b75417b6a5ee484798bff290a81fa0d56 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
PC System Recovery Bootloader Vulnerabilities - Lenovo Support US
No description provided...
edk2 security, bug fix, and enhancement update
20230524-3 - edk2-OvmfPkg-AmdSev-fix-BdsPlatform.c-assertion-failure-d.patch bz2190244 - edk2-OvmfPkg-IoMmuDxe-add-locking-to-IoMmuAllocateBounceB.patch bz2211060 - edk2-OvmfPkg-AmdSevDxe-Shim-Reboot-workaround-RHEL-only.patch bz2218196 - Resolves: bz2190244 EDK2 AMDSERVER 9.3 Bug OVMF AP Creatio...
Microsoft Guidance for Addressing Security Feature Bypass in Trend Micro EFI Modules
Trend Micro has released CVE-2023-28005 to address a secure boot bypass. Subsequently Microsoft has released the July Windows security updates to block the vulnerable UEFI modules by using the DBX UEFI Secure Boot Forbidden Signature Database disallow list. To exploit this vulnerability, an...
