PT-2025-24404

Name of the Vulnerable Software and Affected Versions Insyde H2O UEFI firmware affected versions not specified Description A flaw exists in the digital signature verification process within Insyde H2O UEFI firmware. This issue does not properly validate variable attributes, allowing an attacker t...

SUSE CVE-2024-31157

Improper initialization in UEFI firmware OutOfBandXML module in some IntelR Processors may allow a privileged user to potentially enable information disclosure via local access...

SUSE CVE-2024-39279

Insufficient granularity of access control in UEFI firmware in some IntelR processors may allow a authenticated user to potentially enable denial of service via local access...

Intel 2025.1 IPU – 13th and 14th Generation Processors Security Update

Intel has informed HP a potential security vulnerability in some 13th and 14th Generation Intel® Core™ Processors, which might allow denial of service. Intel is releasing microcode and UEFI reference code updates to mitigate this potential vulnerability. Intel has released updates to mitigate the...

CVE-2024-45105

An internal product security audit discovered a UEFI SMM System Management Mode callout vulnerability in some ThinkSystem servers that could allow a local attacker with elevated privileges to execute arbitrary code...

CVE-2024-7756

A potential vulnerability was reported in the ThinkPad L390 Yoga and 10w Notebook that could allow a local attacker to escalate privileges by accessing an embedded UEFI shell...

CVE-2024-40885

Use after free in the UEFI firmware of some IntelR Server M20NTP BIOS may allow a privileged user to potentially enable escalation of privilege via local access...

CVE-2024-25565

Insufficient control flow management in UEFI firmware for some IntelR XeonR Processors may allow an authenticated user to enable denial of service via local access...

CVE-2023-39950

efibootguard is a simple UEFI boot loader with support for safely switching between current and updated partition sets. Insufficient or missing validation and sanitization of input from untrustworthy bootloader environment files can cause crashes and probably also code injections into bgsetenv or...

CVE-2023-28044

Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user with administrator privileges may potentially exploit this vulnerability in order to modify a UEFI variable...

CVE-2023-48733

An insecure default to allow UEFI Shell in EDK2 was left enabled in Ubuntu's EDK2. This allows an OS-resident attacker to bypass Secure Boot...

CVE-2023-42772

Untrusted pointer dereference in UEFI firmware for some IntelR reference processors may allow a privileged user to potentially enable escalation of privilege via local access...

CVE-2023-41833

A race condition in UEFI firmware for some IntelR processors may allow a privileged user to potentially enable escalation of privilege via local access...

CVE-2023-23904

NULL pointer dereference in the UEFI firmware for some IntelR Processors may allow a privileged user to potentially enable escalation of privilege via local access...

CVE-2023-33017

Memory corruption in Boot while running a ListVars test in UEFI Menu during boot...

CVE-2023-30738

An improper input validation in UEFI Firmware prior to Firmware update Oct-2023 Release in Galaxy Book, Galaxy Book Pro, Galaxy Book Pro 360 and Galaxy Book Odyssey allows local attacker to execute SMM memory corruption...

CVE-2023-28737

Improper initialization in some IntelR Aptio V UEFI Firmware Integrator Tools may allow an authenticated user to potentially enable escalation of privilege via local access...

CVE-2023-28538

Memory corruption in WIN Product while invoking WinAcpi update driver in the UEFI region...

CVE-2023-28397

Improper access control in some IntelR Aptio V UEFI Firmware Integrator Tools may allow an authenticated to potentially enable escalation of privileges via local access...

CVE-2023-27471

An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. UEFI implementations do not correctly protect and validate information contained in the 'MeSetup' UEFI variable. On some systems, this variable can be overwritten using operating system APIs. Exploitation of this vulnerabili...