HP UEFI Firmware February 2022 Security Updates

Potential vulnerabilities have been identified in UEFI firmware BIOS for some PC products which may allow escalation of privilege and arbitrary code execution. HP is releasing firmware updates to mitigate these potential vulnerabilities. HP has identified affected platforms and corresponding...

CVE-2022-21933

ASUS VivoMini/Mini PC device has an improper input validation vulnerability. A local attacker with system privilege can use system management interrupt SMI to modify memory, resulting in arbitrary code execution for controlling the system or disrupting service...

CVE-2022-21933

CVE-2022-21933 affects ASUS VivoMini/Mini PC and describes an improper input validation vulnerability. A local attacker with system privileges can trigger a System Management Interrupt (SMI) to modify memory, resulting in arbitrary code execution and potential control or disruption of the system....

CVE-2022-21933: Improper Input Validation

ASUS VivoMini/Mini PC device has an improper input validation vulnerability. A local attacker with system privilege can use system management interrupt SMI to modify memory, resulting in arbitrary code execution for controlling the system or disrupting service...

Heap-based Buffer Overflow in vim/vim

Description Heap-buffer-overflow in vim Proof of Concept ./vim -u NONE -X -Z -e -s -S poc3 -c :qa! POC3 is here. Bt ==728741==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x621000025500 at pc 0x0000008961b2 bp 0x7ffca76ad0b0 sp 0x7ffca76ad0a8 READ of size 1 at 0x621000025500 thread T0...

libbpf:bpf-object-fuzzer: Segv on unknown address in unsigned long fuzzer::ForEachNonZeroByte<unsigned long fuzzer::TracePC::CollectF

Detailed Report: https://oss-fuzz.com/testcase?key=6288192473530368 Project: libbpf Fuzzing Engine: libFuzzer Fuzz Target: bpf-object-fuzzer Job Type: libfuzzermsanlibbpf Platform Id: linux Crash Type: Segv on unknown address Crash Address: Crash State: unsigned long...

FBI warns of hackers mailing malicious USB drives to spread ransomware

By Deeba Ahmed FBI's warning highlights the fact that one should never insert an unknown USB flash drive in their PCs. This is a post from HackRead.com Read the original post: FBI warns of hackers mailing malicious USB drives to spread ransomware...

Authorization

A BIOS bug in firmware for a particular PC model leaves the Platform authorization value empty. This can be used to permanently brick the TPM in multiple ways, as well as to non-permanently DoS the system...

CVE-2021-38576

A BIOS bug in firmware for a particular PC model leaves the Platform authorization value empty. This can be used to permanently brick the TPM in multiple ways, as well as to non-permanently DoS the system...

CVE-2021-38576

A BIOS bug in firmware for a particular PC model leaves the Platform authorization value empty. This can be used to permanently brick the TPM in multiple ways, as well as to non-permanently DoS the system...

CVE-2021-38576

CVE-2021-38576 is described across several connected advisories as a BIOS/firmware issue in EDK II where a PC model’s Platform Authorization value can be left empty. This can permanently brick the TPM or cause non-permanent DoS. The affected component is EDK II (EFI/firmware tooling) within vario...

subscribe.pcgamer.com Cross Site Scripting vulnerability OBB-2309916

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2021-40850

TCMAN GIM is vulnerable to a SQL injection vulnerability inside several available webservice methods in /PC/WebService.asmx...

CVE-2021-40850 TCMAN GIM SQL injection vulnerability

TCMAN GIM is vulnerable to a SQL injection vulnerability inside several available webservice methods in /PC/WebService.asmx...

CVE-2021-40850

CVE-2021-40850 affects TCMAN GIM. It describes a SQL injection vulnerability in multiple web service methods under /PC/WebService.asmx. The CVSS metrics indicate a critical impact (CVSS v3.1: 9.8, NETWORK, LOW complexity, NONE privileges) with high impact on confidentiality, integrity and availab...

Trend Micro Security Backlink Vulnerability (CNVD-2021-103666)

Trend Micro Security is a suite of computer security software from Trend Micro, Inc. Trend Micro Security has a backlink vulnerability that stems from a link tracking issue in the PC Health Check feature. An attacker could exploit the vulnerability to cause a denial of service attack...

PT-2021-22981

Name of the Vulnerable Software and Affected Versions TCMAN GIM affected versions not specified Description The issue concerns a lack of authorization in all available webservice methods listed in /PC/WebService.asmx. This could allow a remote attacker to obtain information. Recommendations At th...

PT-2021-22980

Name of the Vulnerable Software and Affected Versions TCMAN GIM affected versions not specified Description The issue concerns a SQL injection vulnerability within several webservice methods in the /PC/WebService.asmx endpoint. This vulnerability could potentially allow an attacker to inject...

Tcman Gim SQL注入漏洞

Tcman Gim is a facility management software from Tcman Spain designed for use on mobile devices. TCMAN GIM suffers from a SQL injection vulnerability that can be exploited via the "/PC/WebService.asmx" page...

CVE-2021-40851: Improper Authentication

TCMAN GIM is vulnerable to a lack of authorization in all available webservice methods listed in /PC/WebService.asmx. The exploitation of this vulnerability might allow a remote attacker to obtain information...