Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
799 results · page 11 of 16
Oct 12, 2022Dell BIOS contains an improper input validation vulnerability.CVE-2022-32487 · Other software · Dell · reported by security_alert@emc.comHigh 7.5
Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user may potentially exploit this vulnerability by using an SMI to gain arbitrary code execution in SMRAM.
- Product
- CPG BIOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2022Dell BIOS contains an improper input validation vulnerability.CVE-2022-32485 · Other software · Dell · reported by security_alert@emc.comHigh 7.5
Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user may potentially exploit this vulnerability by using an SMI to gain arbitrary code execution in SMRAM.
- Product
- CPG BIOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2022Dell BIOS contains an improper input validation vulnerability.CVE-2022-32484 · Other software · Dell · reported by security_alert@emc.comMedium 5.6
Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user with admin privileges may potentially exploit this vulnerability in order to modify a UEFI variable.
- Product
- CPG BIOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2022Dell BIOS contains an improper input validation vulnerability.CVE-2022-32483 · Other software · Dell · reported by security_alert@emc.comMedium 5.6
Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user with admin privileges may potentially exploit this vulnerability in order to modify a UEFI variable.
- Product
- CPG BIOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 11, 2022Dell BIOS contains an improper input validation vulnerability.CVE-2022-32492 · Other software · Dell · reported by security_alert@emc.comHigh 7.5
Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user may potentially exploit this vulnerability by using an SMI to gain arbitrary code execution in SMRAM.
- Product
- CPG BIOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 11, 2022Dell BIOS contains an improper input validation vulnerability.CVE-2022-32486 · Other software · Dell · reported by security_alert@emc.comHigh 7.5
Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user may potentially exploit this vulnerability by using an SMI to gain arbitrary code execution in SMRAM.
- Product
- CPG BIOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 7, 2022ZKteco ZKBioSecurity V5000 4.1.3 was discovered to contain a SQL injection vulnerability via the component /baseOpLog.do.CVE-2022-36635 · Other software · Zkteco · reported by MITREHigh 8.8
ZKteco ZKBioSecurity V5000 4.1.3 was discovered to contain a SQL injection vulnerability via the component /baseOpLog.do.
- Product
- Zkbiosecurity V5000
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 7, 2022An access control issue in ZKTeco ZKBioSecurity V5000 3.0.5_r allows attackers to arbitrarily create admin users via a crafted HTTP request.CVE-2022-36634 · Other software · Zkteco · reported by MITREHigh 8.8
An access control issue in ZKTeco ZKBioSecurity V5000 3.0.5_r allows attackers to arbitrarily create admin users via a crafted HTTP request.
- Product
- Zkbiosecurity V5000
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgseclists.org
Sep 19, 2022A vulnerability in Suprema BioStar (aka Bio Star) 2 v2.8.16 allows attackers to escalate privileges to System Administrator via a crafted PUT request to the updCVE-2022-38351 · Other software · Supremainc · reported by MITREHigh 8.8
A vulnerability in Suprema BioStar (aka Bio Star) 2 v2.8.16 allows attackers to escalate privileges to System Administrator via a crafted PUT request to the update profile page.
- Product
- Biostar 2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnobugescapes.comnobugescapes.com
Sep 12, 2022Dell BIOS versions contain a Stack-based Buffer Overflow vulnerability.CVE-2022-31226 · Other software · Dell · reported by security_alert@emc.comHigh 7.1
Dell BIOS versions contain a Stack-based Buffer Overflow vulnerability. A local authenticated malicious user could potentially exploit this vulnerability by sending excess data to a function in order to gain arbitrary code execution on the system.
- Product
- CPG BIOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 12, 2022Dell BIOS versions contain an Unchecked Return Value vulnerability.CVE-2022-31225 · Other software · Dell · reported by security_alert@emc.comLow 3
Dell BIOS versions contain an Unchecked Return Value vulnerability. A local authenticated administrator user could potentially exploit this vulnerability in order to change the state of the system or cause unexpected failures.
- Product
- CPG BIOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 12, 2022Dell BIOS versions contain an Improper Protection Against Voltage and Clock Glitches vulnerability.CVE-2022-31224 · Other software · Dell · reported by security_alert@emc.comLow 2
Dell BIOS versions contain an Improper Protection Against Voltage and Clock Glitches vulnerability. An attacker with physical access to the system could potentially exploit this vulnerability by triggering a fault condition in order to change the behavior of the system.
- Product
- CPG BIOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 12, 2022Dell BIOS versions contain an Improper Neutralization of Null Byte vulnerability.CVE-2022-31223 · Other software · Dell · reported by security_alert@emc.comLow 2.3
Dell BIOS versions contain an Improper Neutralization of Null Byte vulnerability. A local authenticated administrator user could potentially exploit this vulnerability by sending unexpected null bytes in order to read memory on the system.
- Product
- CPG BIOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 12, 2022Dell BIOS versions contain a Missing Release of Resource after Effective Lifetime vulnerability.CVE-2022-31222 · Other software · Dell · reported by security_alert@emc.comLow 2.3
Dell BIOS versions contain a Missing Release of Resource after Effective Lifetime vulnerability. A local authenticated administrator user could potentially exploit this vulnerability by consuming excess memory in order to cause the application to crash.
- Product
- CPG BIOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 12, 2022Dell BIOS versions contain an Information Exposure vulnerability.CVE-2022-31221 · Other software · Dell · reported by security_alert@emc.comLow 2.3
Dell BIOS versions contain an Information Exposure vulnerability. A local authenticated administrator user could potentially exploit this vulnerability in order access sensitive state information on the system.
- Product
- CPG BIOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 12, 2022Dell BIOS versions contain an Unchecked Return Value vulnerability.CVE-2022-31220 · Other software · Dell · reported by security_alert@emc.comLow 3
Dell BIOS versions contain an Unchecked Return Value vulnerability. A local authenticated administrator user could potentially exploit this vulnerability in order to change the state of the system or cause unexpected failures.
- Product
- CPG BIOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 6, 2022Dell BIOS versions contain an Insecure Automated Optimization vulnerability.CVE-2022-26861 · Other software · Dell · reported by security_alert@emc.comHigh 7.9
Dell BIOS versions contain an Insecure Automated Optimization vulnerability. A local authenticated malicious user could exploit this vulnerability by sending malicious input via SMI to obtain arbitrary code execution during SMM.
- Product
- CPG BIOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 6, 2022Dell BIOS versions contain a stack-based buffer overflow vulnerability.CVE-2022-26860 · Other software · Dell · reported by security_alert@emc.comHigh 7.5
Dell BIOS versions contain a stack-based buffer overflow vulnerability. A local attacker could exploit this vulnerability by sending malicious input via SMI to bypass security checks resulting in arbitrary code execution in SMM.
- Product
- CPG BIOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 6, 2022Dell BIOS contains a race condition vulnerability.CVE-2022-26859 · Other software · Dell · reported by security_alert@emc.comMedium 6.1
Dell BIOS contains a race condition vulnerability. A local attacker could exploit this vulnerability by sending malicious input via SMI in order to bypass security checks during SMM.
- Product
- CPG BIOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 6, 2022Dell BIOS versions contain an Improper Authentication vulnerability.CVE-2022-26858 · Other software · Dell · reported by security_alert@emc.comMedium 6.1
Dell BIOS versions contain an Improper Authentication vulnerability. A locally authenticated malicious user could potentially exploit this vulnerability by sending malicious input to an SMI in order to bypass security controls.
- Product
- CPG BIOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 18, 2022Out-of-bounds write in the BIOS firmware for some Intel(R) Processors may allow an authenticated user to potentially enable escalation of privilege via local acCVE-2021-33060 · Other software · Intel · reported by secure@intel.comHigh 7.8
Out-of-bounds write in the BIOS firmware for some Intel(R) Processors may allow an authenticated user to potentially enable escalation of privilege via local access.
- Product
- Xeon Gold 5315y Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.netapp.comintel.com
Aug 9, 2022Prior Dell BIOS versions contain an Improper Authentication vulnerability.CVE-2022-29083 · Other software · Dell · reported by security_alert@emc.comMedium 6.8
Prior Dell BIOS versions contain an Improper Authentication vulnerability. An unauthenticated attacker with physical access to the system could potentially exploit this vulnerability by bypassing drive security mechanisms in order to gain access to the system.
- Product
- CPG BIOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 4, 2022NVIDIA DGX A100 contains a vulnerability in SBIOS in the IpSecDxe, where a user with high privileges and preconditioned IpSecDxe global data can exploit impropeCVE-2022-31603 · Other software · NVIDIA · reported by psirt@nvidia.comMedium 6.4
NVIDIA DGX A100 contains a vulnerability in SBIOS in the IpSecDxe, where a user with high privileges and preconditioned IpSecDxe global data can exploit improper validation of an array index to cause code execution, which may lead to denial of service, data integrity impact, and information disclosure.
- Product
- NVIDIA DGX A100
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnvidia.custhelp.comnvidia.custhelp.com
Jul 4, 2022NVIDIA DGX A100 contains a vulnerability in SBIOS in the IpSecDxe, where a user with elevated privileges and a preconditioned heap can exploit an out-of-bounds CVE-2022-31602 · Other software · NVIDIA · reported by psirt@nvidia.comMedium 6.4
NVIDIA DGX A100 contains a vulnerability in SBIOS in the IpSecDxe, where a user with elevated privileges and a preconditioned heap can exploit an out-of-bounds write vulnerability, which may lead to code execution, denial of service, data integrity impact, and information disclosure.
- Product
- NVIDIA DGX A100
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnvidia.custhelp.comnvidia.custhelp.com
Jul 4, 2022NVIDIA DGX A100 contains a vulnerability in SBIOS in the SmbiosPei, which may allow a highly privileged local attacker to cause an out-of-bounds write, which maCVE-2022-31601 · Other software · NVIDIA · reported by psirt@nvidia.comMedium 6.7
NVIDIA DGX A100 contains a vulnerability in SBIOS in the SmbiosPei, which may allow a highly privileged local attacker to cause an out-of-bounds write, which may lead to code execution, denial of service, compromised integrity, and information disclosure.
- Product
- NVIDIA DGX A100
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnvidia.custhelp.comnvidia.custhelp.com
Jul 4, 2022NVIDIA DGX A100 contains a vulnerability in SBIOS in the SmmCore, where a user with high privileges can chain another vulnerability to this vulnerability, causiCVE-2022-31600 · Other software · NVIDIA · reported by psirt@nvidia.comHigh 7.5
NVIDIA DGX A100 contains a vulnerability in SBIOS in the SmmCore, where a user with high privileges can chain another vulnerability to this vulnerability, causing an integer overflow, possibly leading to code execution, escalation of privileges, denial of service, compromised integrity, and information disclosure. The scope of impact can extend to other components.
- Product
- NVIDIA DGX A100
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnvidia.custhelp.comnvidia.custhelp.com
Jul 4, 2022NVIDIA DGX A100 contains a vulnerability in SBIOS in the Ofbd, where a local user with elevated privileges can cause access to an uninitialized pointer, which mCVE-2022-31599 · Other software · NVIDIA · reported by psirt@nvidia.comHigh 8.2
NVIDIA DGX A100 contains a vulnerability in SBIOS in the Ofbd, where a local user with elevated privileges can cause access to an uninitialized pointer, which may lead to code execution, escalation of privileges, denial of service, and information disclosure. The scope of impact can extend to other components.
- Product
- NVIDIA DGX A100
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnvidia.custhelp.comnvidia.custhelp.com
Jul 1, 2022NVIDIA DGX A100 contains a vulnerability in SBIOS in the BiosCfgTool, where a local user with elevated privileges can read and write beyond intended bounds in SCVE-2022-28200 · Other software · NVIDIA · reported by psirt@nvidia.comHigh 8.2
NVIDIA DGX A100 contains a vulnerability in SBIOS in the BiosCfgTool, where a local user with elevated privileges can read and write beyond intended bounds in SMRAM, which may lead to code execution, escalation of privileges, denial of service, and information disclosure. The scope of impact can extend to other components.
- Product
- NVIDIA DGX A100
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnvidia.custhelp.comnvidia.custhelp.com
Jun 23, 2022Prior Dell BIOS versions contain an Input Validation vulnerability.CVE-2022-26864 · Other software · Dell · reported by security_alert@emc.comMedium 6.3
Prior Dell BIOS versions contain an Input Validation vulnerability. A locally authenticated malicious user could potentially exploit this vulnerability by sending malicious input to an SMI in order to bypass security controls in SMM.
- Product
- CPG BIOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 23, 2022Prior Dell BIOS versions contain an Input Validation vulnerability.CVE-2022-26863 · Other software · Dell · reported by security_alert@emc.comMedium 6.3
Prior Dell BIOS versions contain an Input Validation vulnerability. A locally authenticated malicious user could potentially exploit this vulnerability by sending malicious input to an SMI in order to bypass security controls in SMM.
- Product
- CPG BIOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 23, 2022Prior Dell BIOS versions contain an Input Validation vulnerability.CVE-2022-26862 · Other software · Dell · reported by security_alert@emc.comMedium 6.3
Prior Dell BIOS versions contain an Input Validation vulnerability. A locally authenticated malicious user could potentially exploit this vulnerability by sending malicious input to an SMI in order to bypass security controls in SMM.
- Product
- CPG BIOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2022Dell BIOS contains an improper input validation vulnerability.CVE-2022-24418 · Other software · Dell · reported by security_alert@emc.comHigh 7.5
Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user may potentially exploit this vulnerability by using an SMI to gain arbitrary code execution during SMM.
- Product
- CPG BIOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2022Dell BIOS contains an improper input validation vulnerability.CVE-2022-24417 · Other software · Dell · reported by security_alert@emc.comHigh 7.5
Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user may potentially exploit this vulnerability by using an SMI to gain arbitrary code execution during SMM.
- Product
- CPG BIOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2022Out-of-bounds write in the BIOS authenticated code module for some Intel(R) Processors may allow a privileged user to potentially enable aescalation of privilegCVE-2021-33124 · Other software · Intel · reported by secure@intel.comMedium 6.7
Out-of-bounds write in the BIOS authenticated code module for some Intel(R) Processors may allow a privileged user to potentially enable aescalation of privilege via local access.
- Product
- Xeon Bronze 3206r Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.netapp.comintel.com
May 12, 2022Improper access control in the BIOS authenticated code module for some Intel(R) Processors may allow a privileged user to potentially enable aescalation of privCVE-2021-33123 · Other software · Intel · reported by secure@intel.comHigh 7.8
Improper access control in the BIOS authenticated code module for some Intel(R) Processors may allow a privileged user to potentially enable aescalation of privilege via local access.
- Product
- Xeon Bronze 3206r Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.netapp.comintel.com
May 12, 2022Insufficient control flow management in the BIOS firmware for some Intel(R) Processors may allow a privileged user to potentially enable aescalation of privilegCVE-2021-33122 · Other software · Intel · reported by secure@intel.comHigh 7.8
Insufficient control flow management in the BIOS firmware for some Intel(R) Processors may allow a privileged user to potentially enable aescalation of privilege via local access.
- Product
- Xeon E-2386g Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.netapp.comintel.com
May 12, 2022Improper access control for some 3rd Generation Intel(R) Xeon(R) Scalable Processors before BIOS version MR7, may allow a local attacker to potentially enable iCVE-2021-33117 · Other software · Intel · reported by secure@intel.comMedium 5.5
Improper access control for some 3rd Generation Intel(R) Xeon(R) Scalable Processors before BIOS version MR7, may allow a local attacker to potentially enable information disclosure via local access.
- Product
- Bios
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.netapp.comintel.com
May 12, 2022Unintended intermediary in the BIOS authenticated code module for some Intel(R) Processors may allow a privileged user to potentially enable aescalation of privCVE-2021-33103 · Other software · Intel · reported by secure@intel.comMedium 6.7
Unintended intermediary in the BIOS authenticated code module for some Intel(R) Processors may allow a privileged user to potentially enable aescalation of privilege via local access.
- Product
- Xeon E-2386g Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.netapp.comintel.com
May 12, 2022Uncaught exception in the BIOS firmware for some Intel(R) Processors may allow a privileged user to potentially enable aescalation of privilege via local accessCVE-2021-0190 · Other software · Intel · reported by secure@intel.comHigh 7.8
Uncaught exception in the BIOS firmware for some Intel(R) Processors may allow a privileged user to potentially enable aescalation of privilege via local access.
- Product
- Core I9-10900x Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.netapp.comintel.com
May 12, 2022Use of out-of-range pointer offset in the BIOS firmware for some Intel(R) Processors may allow a privileged user to potentially enable aescalation of privilege CVE-2021-0189 · Other software · Intel · reported by secure@intel.comHigh 7.8
Use of out-of-range pointer offset in the BIOS firmware for some Intel(R) Processors may allow a privileged user to potentially enable aescalation of privilege via local access.
- Product
- Xeon E3-1558l V5 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.netapp.comintel.com
May 12, 2022Return of pointer value outside of expected range in the BIOS firmware for some Intel(R) Processors may allow a privileged user to potentially enable aescalatioCVE-2021-0188 · Other software · Intel · reported by secure@intel.comHigh 7.8
Return of pointer value outside of expected range in the BIOS firmware for some Intel(R) Processors may allow a privileged user to potentially enable aescalation of privilege via local access.
- Product
- Xeon E3-1558l V5 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.netapp.comintel.com
May 12, 2022Improper input validation in the BIOS authenticated code module for some Intel(R) Processors may allow a privileged user to potentially enable aescalation of prCVE-2021-0159 · Other software · Intel · reported by secure@intel.comHigh 7.8
Improper input validation in the BIOS authenticated code module for some Intel(R) Processors may allow a privileged user to potentially enable aescalation of privilege via local access.
- Product
- Xeon Bronze 3204 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.netapp.comintel.com
May 12, 2022Unchecked return value in the BIOS firmware for some Intel(R) Processors may allow a privileged user to potentially enable information disclosure via local acceCVE-2021-0155 · Other software · Intel · reported by secure@intel.comMedium 5.5
Unchecked return value in the BIOS firmware for some Intel(R) Processors may allow a privileged user to potentially enable information disclosure via local access.
- Product
- Xeon E7-8894 V4 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.netapp.comintel.com
May 12, 2022Improper input validation in the BIOS firmware for some Intel(R) Processors may allow a privileged user to potentially enable aescalation of privilege via localCVE-2021-0154 · Other software · Intel · reported by secure@intel.comHigh 7.8
Improper input validation in the BIOS firmware for some Intel(R) Processors may allow a privileged user to potentially enable aescalation of privilege via local access.
- Product
- Xeon E-2314 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.netapp.comintel.com
May 12, 2022Out-of-bounds write in the BIOS firmware for some Intel(R) Processors may allow a privileged user to potentially enable aescalation of privilege via local accesCVE-2021-0153 · Other software · Intel · reported by secure@intel.comHigh 7.8
Out-of-bounds write in the BIOS firmware for some Intel(R) Processors may allow a privileged user to potentially enable aescalation of privilege via local access.
- Product
- Core I9-10900x Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.netapp.comintel.com
May 11, 2022Improper validation of the BIOS directory may allow for searches to read beyond the directory table copy in RAM, exposing out of bounds memory contents, resultiCVE-2021-26388 · Other software · AMD · reported by psirt@amd.comMedium 5.5
Improper validation of the BIOS directory may allow for searches to read beyond the directory table copy in RAM, exposing out of bounds memory contents, resulting in a potential denial of service.
- Product
- EPYC™ Processors
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 4, 2022An issue was discovered on certain Fujitsu LIEFBOOK devices (A3510, U9310, U7511/U7411/U7311, U9311, E5510/E5410, U7510/U7410/U7310, E459/E449) with BIOS versioCVE-2022-28806 · Other software · Fujitsu · reported by MITREHigh 7.8
An issue was discovered on certain Fujitsu LIEFBOOK devices (A3510, U9310, U7511/U7411/U7311, U9311, E5510/E5410, U7510/U7410/U7310, E459/E449) with BIOS versions before v1.09 (A3510), v2.17 (U9310), v2.30 (U7511/U7411/U7311), v2.33 (U9311), v2.23 (E5510), v2.19 (U7510/U7410), v2.13 (U7310), and v1.09 (E459/E449). The FjGabiFlashCoreAbstractionSmm driver registers a Software System Management Interrupt (SWSMI) handler that is not sufficiently validated to ensure that the CommBuffer (or any other communication buffer's nested contents) are not pointing to SMRAM contents. A potential attacker can therefore write fixed data to SMRAM, which could lead to data corruption inside this memory (e.g., change the SMI handler's code or modify SMRAM map structures to break input pointer validation for other SMI handlers). Thus, the attacker could elevate privileges from ring 0 to ring -2 and execute arbitrary code in SMM.
- Product
- Lifebook A3510 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfmworld.netkb.cert.org
Apr 22, 2022A potential vulnerability due to improper buffer validation in the SMI handler LenovoFlashDeviceInterface in Thinkpad X1 Fold Gen 1 could be exploited by an attCVE-2022-1108 · Other software · Lenovo · reported by psirt@lenovo.comMedium 6.7
A potential vulnerability due to improper buffer validation in the SMI handler LenovoFlashDeviceInterface in Thinkpad X1 Fold Gen 1 could be exploited by an attacker with local access and elevated privileges to execute arbitrary code.
- Product
- ThinkPad BIOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.lenovo.comsupport.lenovo.com
Apr 22, 2022During an internal product security audit a potential vulnerability due to use of Boot Services in the SmmOEMInt15 SMI handler was discovered in some ThinkPad mCVE-2022-1107 · Other software · Lenovo · reported by psirt@lenovo.comMedium 6.7
During an internal product security audit a potential vulnerability due to use of Boot Services in the SmmOEMInt15 SMI handler was discovered in some ThinkPad models could be exploited by an attacker with elevated privileges that could allow for execution of code.
- Product
- ThinkPad BIOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.lenovo.comsupport.lenovo.com
Apr 22, 2022A potential vulnerability in the SMI callback function used in the Legacy BIOS mode driver in some Lenovo Notebook models may allow an attacker with local accesCVE-2021-4212 · Other software · Lenovo · reported by psirt@lenovo.comMedium 6.7
A potential vulnerability in the SMI callback function used in the Legacy BIOS mode driver in some Lenovo Notebook models may allow an attacker with local access and elevated privileges to execute arbitrary code.
- Product
- BIOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.lenovo.comsupport.lenovo.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.