CVE-2024-40885

Use after free in the UEFI firmware of some IntelR Server M20NTP BIOS may allow a privileged user to potentially enable escalation of privilege via local access...

CVE-2024-25565

Insufficient control flow management in UEFI firmware for some IntelR XeonR Processors may allow an authenticated user to enable denial of service via local access...

CVE-2023-39950

efibootguard is a simple UEFI boot loader with support for safely switching between current and updated partition sets. Insufficient or missing validation and sanitization of input from untrustworthy bootloader environment files can cause crashes and probably also code injections into bgsetenv or...

CVE-2023-28044

Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user with administrator privileges may potentially exploit this vulnerability in order to modify a UEFI variable...

CVE-2023-48733

An insecure default to allow UEFI Shell in EDK2 was left enabled in Ubuntu's EDK2. This allows an OS-resident attacker to bypass Secure Boot...

CVE-2023-42772

Untrusted pointer dereference in UEFI firmware for some IntelR reference processors may allow a privileged user to potentially enable escalation of privilege via local access...

CVE-2023-41833

A race condition in UEFI firmware for some IntelR processors may allow a privileged user to potentially enable escalation of privilege via local access...

CVE-2023-23904

NULL pointer dereference in the UEFI firmware for some IntelR Processors may allow a privileged user to potentially enable escalation of privilege via local access...

CVE-2023-33017

Memory corruption in Boot while running a ListVars test in UEFI Menu during boot...

CVE-2023-30738

An improper input validation in UEFI Firmware prior to Firmware update Oct-2023 Release in Galaxy Book, Galaxy Book Pro, Galaxy Book Pro 360 and Galaxy Book Odyssey allows local attacker to execute SMM memory corruption...

CVE-2023-28737

Improper initialization in some IntelR Aptio V UEFI Firmware Integrator Tools may allow an authenticated user to potentially enable escalation of privilege via local access...

CVE-2023-28538

Memory corruption in WIN Product while invoking WinAcpi update driver in the UEFI region...

CVE-2023-28397

Improper access control in some IntelR Aptio V UEFI Firmware Integrator Tools may allow an authenticated to potentially enable escalation of privileges via local access...

CVE-2023-27471

An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. UEFI implementations do not correctly protect and validate information contained in the 'MeSetup' UEFI variable. On some systems, this variable can be overwritten using operating system APIs. Exploitation of this vulnerabili...

CVE-2023-26589

Use after free in some IntelR Aptio V UEFI Firmware Integrator Tools may allowed an authenticated user to potentially enable denial of service via local access...

CVE-2023-25949

Uncontrolled resource consumption in some IntelR Aptio V UEFI Firmware Integrator Tools may allow an authenticated user to potentially enable denial of service via local access...

CVE-2023-22351

Out-of-bounds write in UEFI firmware for some IntelR Processors may allow a privileged user to potentially enable escalation of privilege via local access...

CVE-2023-22310

Race condition in some IntelR Aptio V UEFI Firmware Integrator Tools may allow an authenticated user to potentially enable denial of service via local access...

CVE-2023-52080

IEIT NF5280M6 UEFI firmware through 8.4 has a pool overflow vulnerability, caused by improper use of the gRT-GetVariable function. Attackers with access to local NVRAM variables can exploit this by modifying these variables on SPI Flash, resulting in memory data being tampered with. When critical...

CVE-2022-30426

There is a stack buffer overflow vulnerability, which could lead to arbitrary code execution in UEFI DXE driver on some Acer products. An attack could exploit this vulnerability to escalate privilege from ring 3 to ring 0, and hijack control flow during UEFI DXE execution. This affects Altos T110...