CVE-2024-49358 ZimaOS vulnerable to Username Enumeration via API Responses

ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In version 1.2.4 and all prior versions, the API endpoint http:///v1/users/login in ZimaOS returns distinct responses based on whether a username exists or the password is incorrect. This behavior can b...

CVE-2024-48931

ZimaOS (fork of CasaOS) versions 1.2.4 and earlier are affected by an arbitrary file read vulnerability in the API endpoint /v3/file?token=&files=, caused by improper input validation on the files parameter. Authenticated users can manipulate the files value to access sensitive files outside the ...

Important: Red Hat Security Advisory: edk2 security update

An update for edk2 is now available for Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions, and Red Hat Enterprise Linux 8.6 Telecommunications Update Service. Red Hat Product Security has rated this update as havi...

Important: Red Hat Security Advisory: edk2 security update

An update for edk2 is now available for Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.4 Telecommunications Update Service, and Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions. Red Hat Product Security has rated this update as havi...

edk2: Buffer overflow when handling Server ID option from a DHCPv6 proxy Advertise message

A security flaw involving buffer overflow was identified in EDK2, the open-source reference implementation of the UEFI specification. This vulnerability enables an unauthorized attacker within the vicinity network to transmit a specifically crafted DHCPv6 proxy Advertise message, resulting in the...

RHEL 8 : edk2 (RHSA-2024:8455)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:8455 advisory. EDK Embedded Development Kit is a project to enable UEFI support for Virtual Machines. This package contains a sample 64-bit UEFI firmware for QEMU a...

RHEL 8 : edk2 (RHSA-2024:8449)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2024:8449 advisory. EDK Embedded Development Kit is a project to enable UEFI support for Virtual Machines. This package contains a sample 64-bit UEFI firmware for QEMU a...

K000141509: Intel UEFI vulnerability CVE-2024-21781

Security Advisory Description Improper input validation in UEFI firmware for some IntelR Processors may allow a privileged user to enable information disclosure or denial of service via local access. CVE-2024-21781 Impact Attackers may exploit this vulnerability to enable privilege escalation via...

K000141511: Intel UEFI vulnerability CVE-2023-43626

Security Advisory Description Improper access control in UEFI firmware for some IntelR Processors may allow a privileged user to potentially enable escalation of privilege via local access. CVE-2023-43626 Impact Attackers may exploit this vulnerability to enable privilege escalation via local...

K000141503: Intel UEFI vulnerability CVE-2023-42772

Security Advisory Description Untrusted pointer dereference in UEFI firmware for some IntelR reference processors may allow a privileged user to potentially enable escalation of privilege via local access. CVE-2023-42772 Impact There is no impact; F5 products are not affected by this vulnerabilit...

K000141501: Intel UEFI vulnerability CVE-2024-21871

Security Advisory Description Improper input validation in UEFI firmware for some IntelR Processors may allow a privileged user to potentially enable escalation of privilege via local access. CVE-2024-21871 Impact There is no impact; F5 products are not affected by this vulnerability. F5 previous...

K000141505: Intel UEFI vulnerability CVE-2024-21829

Security Advisory Description Improper input validation in UEFI firmware error handler for some IntelR Processors may allow a privileged user to potentially enable escalation of privilege via local access. CVE-2024-21829 Impact Attackers may exploit this vulnerability to enable privilege escalati...

Intel 2024.3 IPU – BIOS Security Updates

Intel has informed HP of potential security vulnerabilities for some Intel® Processors, which might allow escalation of privilege, denial of service or information disclosure. Intel is releasing UEFI firmware updates to mitigate these potential vulnerabilities. Intel has released updates to...

[SECURITY] Fedora 41 Update: edk2-20240813-2.fc41

EDK II is a modern, feature-rich, cross-platform firmware development environment for the UEFI and PI specifications. This package contains sample 64-bit UEFI firmware builds for QEMU and KVM...

RHEL 8 : edk2 (RHSA-2024:8104)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:8104 advisory. EDK Embedded Development Kit is a project to enable UEFI support for Virtual Machines. This package contains a sample 64-bit UEFI firmware f...

edk2 bug fix and enhancement update

An update is available for edk2. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list EDK Embedded Development Kit is a project to enable UEFI support for Virtual...

PVS 2407 BIOS target devices crash on PVS reconnect

PVS 2407 BIOS based Target Devices crash on PVS reconnect. Customers would typically encounter a requirement for a PVS reconnect when performing load balancing operations, for example when patching and rebooting PVS servers. PVS reconnect would also occur during normal operation if sufficient PVS...

Important: Red Hat Security Advisory: edk2 security update

An update for edk2 is now available for Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

RHEL 9 : edk2 (RHSA-2024:6931)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:6931 advisory. EDK Embedded Development Kit is a project to enable UEFI support for Virtual Machines. This package contains a sample 64-bit UEFI firmware for QEMU a...

Important: Red Hat Security Advisory: edk2 security update

An update for edk2 is now available for Red Hat Enterprise Linux 8.8 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for ea...