CVE-2022-43779

A potential Time-of-Check to Time-of-Use TOCTOU vulnerability has been identified in certain HP PC products using AMI UEFI Firmware system BIOS which might allow arbitrary code execution, denial of service, and information disclosure. AMI has released updates to mitigate the potential vulnerabili...

CVE-2022-36337

An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. A stack buffer overflow vulnerability in the MebxConfiguration driver leads to arbitrary code execution. Control of a UEFI variable under the OS can cause this overflow when read by BIOS code...

CVE-2022-3744

A potential vulnerability was discovered in LCFC BIOS for some Lenovo consumer notebook models that could allow a local attacker with elevated privileges to unlock UEFI variables due to a hard-coded SMI handler credential...

CVE-2022-36338

An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. An SMM callout vulnerability in the SMM driver FwBlockServiceSmm, creating SMM, leads to arbitrary code execution. An attacker can replace the pointer to the UEFI boot service GetVariable with a pointer to malware, and then...

CVE-2021-42059

An issue was discovered in Insyde InsydeH2O Kernel 5.0 before 05.08.41, Kernel 5.1 before 05.16.41, Kernel 5.2 before 05.26.41, Kernel 5.3 before 05.35.41, and Kernel 5.4 before 05.42.20. A stack-based buffer overflow leads toarbitrary code execution in UEFI DisplayTypeDxe DXE driver...

CVE-2021-39301

Potential vulnerabilities have been identified in UEFI firmware BIOS for some PC products which may allow escalation of privilege and arbitrary code execution...

CVE-2021-39299

Potential vulnerabilities have been identified in UEFI firmware BIOS for some PC products which may allow escalation of privilege and arbitrary code execution...

CVE-2021-39297

Potential vulnerabilities have been identified in UEFI firmware BIOS for some PC products which may allow escalation of privilege and arbitrary code execution...

CVE-2020-5953

A vulnerability exists in System Management Interrupt SWSMI handler of InsydeH2O UEFI Firmware code located in SWSMI handler that dereferences gRT EFIRUNTIMESERVICES pointer to call a GetVariable service, which is located outside of SMRAM. This can result in code execution in SMM escalating...

CVE-2020-26200

A component of Kaspersky custom boot loader allowed loading of untrusted UEFI modules due to insufficient check of their authenticity. This component is incorporated in Kaspersky Rescue Disk KRD and was trusted by the Authentication Agent of Full Disk Encryption in Kaspersky Endpoint Security KES...

CVE-2019-18279

In Phoenix SCT WinFlash 1.1.12.0 through 1.5.74.0, the included drivers could be used by a malicious Windows application to gain elevated privileges. Adverse impacts are limited to the Windows environment and there is no known direct impact to the UEFI firmware. This was fixed in late June 2019...

CVE-2025-21100

Improper initialization in the UEFI firmware for the IntelR Server D50DNP and M50FCP boards may allow a privileged user to potentially enable information disclosure via local access...

CVE-2025-20009

Improper input validation in the UEFI firmware GenerationSetup module for the IntelR Server D50DNP and M50FCP boards may allow a privileged user to potentially enable information disclosure via local access...

CVE-2025-20082

Time-of-check time-of-use race condition in the UEFI firmware SmiVariable driver for the IntelR Server D50DNP and M50FCP boards may allow a privileged user to enable escalation of privilege via local access...

CVE-2025-24308

Improper input validation in the UEFI firmware error handler for the IntelR Server D50DNP and M50FCP may allow a privileged user to potentially enable escalation of privilege via local access...

CVE-2025-24308

Improper input validation in the UEFI firmware error handler for the IntelR Server D50DNP and M50FCP may allow a privileged user to potentially enable escalation of privilege via local access...

CVE-2025-21094

Improper input validation in the UEFI firmware DXE module for the IntelR Server D50DNP and M50FCP boards may allow a privileged user to potentially enable escalation of privilege via local access...

CVE-2025-20082

Time-of-check time-of-use race condition in the UEFI firmware SmiVariable driver for the IntelR Server D50DNP and M50FCP boards may allow a privileged user to enable escalation of privilege via local access...

CVE-2025-20034

Improper input validation in the BackupBiosUpdate UEFI firmware SmiVariable driver for the IntelR Server D50DNP and M50FCP boards before version R01.02.0003 may allow a privileged user to potentially enable information disclosure via local access...

CVE-2025-20009

Improper input validation in the UEFI firmware GenerationSetup module for the IntelR Server D50DNP and M50FCP boards may allow a privileged user to potentially enable information disclosure via local access...