Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
799 results · page 13 of 16
Feb 2, 2022An issue was discovered in Insyde InsydeH2O with kernel 5.1 through 2021-11-08, 5.2 through 2021-11-08, and 5.3 through 2021-11-08.CVE-2021-43522 · Other software · Siemens · reported by MITREHigh 7.5
An issue was discovered in Insyde InsydeH2O with kernel 5.1 through 2021-11-08, 5.2 through 2021-11-08, and 5.3 through 2021-11-08. A StorageSecurityCommandDxe SMM memory corruption vulnerability allows an attacker to write fixed or predictable data to SMRAM. Exploiting this issue could lead to escalating privileges to SMM.
- Product
- RUGGEDCOM APE1808 - BIOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert-portal.siemens.comsecurity.netapp.com
Jan 24, 2022Dell BIOS contains an improper input validation vulnerability.CVE-2021-36343 · Other software · Dell · reported by security_alert@emc.comHigh 7.5
Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user may potentially exploit this vulnerability by using an SMI to gain arbitrary code execution in SMRAM.
- Product
- CPG BIOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 24, 2022Dell BIOS contains an improper input validation vulnerability.CVE-2021-36342 · Other software · Dell · reported by security_alert@emc.comHigh 7.5
Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user may potentially exploit this vulnerability by using an SMI to gain arbitrary code execution in SMRAM.
- Product
- CPG BIOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 5, 2022An issue was discovered in SdHostDriver in Insyde InsydeH2O with kernel 5.1 before 05.16.25, 5.2 before 05.26.25, 5.3 before 05.35.25, 5.4 before 05.43.25, and CVE-2021-45971 · Other software · Siemens · reported by MITREHigh 8.2
An issue was discovered in SdHostDriver in Insyde InsydeH2O with kernel 5.1 before 05.16.25, 5.2 before 05.26.25, 5.3 before 05.35.25, 5.4 before 05.43.25, and 5.5 before 05.51.25. A vulnerability exists in the SMM (System Management Mode) branch that registers a SWSMI handler that does not sufficiently check or validate the allocated buffer pointer (CommBufferData).
- Product
- RUGGEDCOM APE1808 - BIOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert-portal.siemens.comsecurity.netapp.com
Jan 5, 2022An issue was discovered in IdeBusDxe in Insyde InsydeH2O with kernel 5.1 before 05.16.25, 5.2 before 05.26.25, 5.3 before 05.35.25, 5.4 before 05.43.25, and 5.5CVE-2021-45970 · Other software · Siemens · reported by MITREHigh 8.2
An issue was discovered in IdeBusDxe in Insyde InsydeH2O with kernel 5.1 before 05.16.25, 5.2 before 05.26.25, 5.3 before 05.35.25, 5.4 before 05.43.25, and 5.5 before 05.51.25. A vulnerability exists in the SMM (System Management Mode) branch that registers a SWSMI handler that does not sufficiently check or validate the allocated buffer pointer (the status code saved at the CommBuffer+4 location).
- Product
- RUGGEDCOM APE1808 - BIOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert-portal.siemens.comsecurity.netapp.com
Jan 5, 2022An issue was discovered in AhciBusDxe in Insyde InsydeH2O with kernel 5.1 before 05.16.25, 5.2 before 05.26.25, 5.3 before 05.35.25, 5.4 before 05.43.25, and 5.CVE-2021-45969 · Other software · Siemens · reported by MITREHigh 8.2
An issue was discovered in AhciBusDxe in Insyde InsydeH2O with kernel 5.1 before 05.16.25, 5.2 before 05.26.25, 5.3 before 05.35.25, 5.4 before 05.43.25, and 5.5 before 05.51.25. A vulnerability exists in the SMM (System Management Mode) branch that registers a SWSMI handler that does not sufficiently check or validate the allocated buffer pointer (the CommBuffer+8 location).
- Product
- RUGGEDCOM APE1808 - BIOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert-portal.siemens.comsecurity.netapp.com
Jan 3, 2022A BIOS bug in firmware for a particular PC model leaves the Platform authorization value empty.CVE-2021-38576 · Other software · Tianocore · reported by infosec@edk2.groups.ioHigh 7.5
A BIOS bug in firmware for a particular PC model leaves the Platform authorization value empty. This can be used to permanently brick the TPM in multiple ways, as well as to non-permanently DoS the system.
- Product
- Edk2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.tianocore.orgbugzilla.tianocore.org
Jan 1, 2022An issue was discovered in BS_RCIO64.sys in Biostar RACING GT Evo 2.1.1905.1700.CVE-2021-44852 · Other software · Biostar · reported by MITREHigh 7.8
An issue was discovered in BS_RCIO64.sys in Biostar RACING GT Evo 2.1.1905.1700. A low-integrity process can open the driver's device object and issue IOCTLs to read or write to arbitrary physical memory locations (or call an arbitrary address), leading to execution of arbitrary code. This is associated with 0x226040, 0x226044, and 0x226000.
- Product
- Racing GT EVO
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnephosec.comnephosec.com
Nov 17, 2021Improper input validation in the BIOS firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege via local CVE-2021-0158 · Other software · Intel · reported by secure@intel.comMedium 6.7
Improper input validation in the BIOS firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege via local access.
- Product
- Celeron N2805
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 17, 2021Insufficient control flow management in the BIOS firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilegeCVE-2021-0157 · Other software · Intel · reported by secure@intel.comMedium 6.7
Insufficient control flow management in the BIOS firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege via local access.
- Product
- Celeron N2805
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 16, 2021Insufficient validation of BIOS image length by ASP Firmware could lead to arbitrary code execution.CVE-2020-12944 · Other software · AMD · reported by psirt@amd.comHigh 7.8
Insufficient validation of BIOS image length by ASP Firmware could lead to arbitrary code execution.
- Product
- Ryzen™ Series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 15, 2021ASUS P453UJ contains the Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability.CVE-2021-41289 · Network & remote access · ASUS · reported by twcert@cert.org.twMedium 6.3
ASUS P453UJ contains the Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability. With a general user’s permission, local attackers can modify the BIOS by replacing or filling in the content of the designated Memory DataBuffer, which causing a failure of integrity verification and further resulting in a failure to boot.
- Product
- P453UJ BIOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 12, 2021Dell BIOS contains an improper input validation vulnerability.CVE-2021-36325 · Other software · Dell · reported by security_alert@emc.comHigh 7.5
Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user may potentially exploit this vulnerability by using an SMI to gain arbitrary code execution in SMRAM.
- Product
- CPG BIOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 12, 2021Dell BIOS contains an improper input validation vulnerability.CVE-2021-36324 · Other software · Dell · reported by security_alert@emc.comHigh 7.5
Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user may potentially exploit this vulnerability by using an SMI to gain arbitrary code execution in SMRAM.
- Product
- CPG BIOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 12, 2021Dell BIOS contains an improper input validation vulnerability.CVE-2021-36323 · Other software · Dell · reported by security_alert@emc.comHigh 7.5
Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user may potentially exploit this vulnerability by using an SMI to gain arbitrary code execution in SMRAM.
- Product
- CPG BIOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 12, 2021A potential vulnerability in the SMI function to access EEPROM in some ThinkPad models may allow an attacker with local access and elevated privileges to executCVE-2021-3843 · Other software · Lenovo · reported by psirt@lenovo.comMedium 6.7
A potential vulnerability in the SMI function to access EEPROM in some ThinkPad models may allow an attacker with local access and elevated privileges to execute arbitrary code.
- Product
- ThinkPad BIOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.lenovo.comsupport.lenovo.com
Nov 12, 2021A potential vulnerability in the SMI callback function used in CSME configuration of some Lenovo Notebook and ThinkPad systems could be used to leak out data ouCVE-2021-3786 · Other software · Lenovo · reported by psirt@lenovo.comMedium 4.4
A potential vulnerability in the SMI callback function used in CSME configuration of some Lenovo Notebook and ThinkPad systems could be used to leak out data out of the SMRAM range.
- Product
- Notebook and ThinkPad BIOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.lenovo.comsupport.lenovo.com
Nov 12, 2021A potential vulnerability in the SMI callback function that saves and restore boot script tables used for resuming from sleep state in some ThinkCentre and ThinCVE-2021-3719 · Other software · Lenovo · reported by psirt@lenovo.comMedium 6.7
A potential vulnerability in the SMI callback function that saves and restore boot script tables used for resuming from sleep state in some ThinkCentre and ThinkStation models may allow an attacker with local access and elevated privileges to execute arbitrary code.
- Product
- ThinkCentre and ThinkStation BIOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.lenovo.comsupport.lenovo.com
Nov 12, 2021A denial of service vulnerability was reported in some ThinkPad models that could cause a system to crash when the Enhanced Biometrics setting is enabled in BIOCVE-2021-3718 · Other software · Lenovo · reported by psirt@lenovo.comMedium 4.3
A denial of service vulnerability was reported in some ThinkPad models that could cause a system to crash when the Enhanced Biometrics setting is enabled in BIOS.
- Product
- ThinkPad BIOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.lenovo.comsupport.lenovo.com
Nov 12, 2021A potential vulnerability in the SMI callback function used to access flash device in some ThinkPad models may allow an attacker with local access and elevated CVE-2021-3599 · Other software · Lenovo · reported by psirt@lenovo.comMedium 6.7
A potential vulnerability in the SMI callback function used to access flash device in some ThinkPad models may allow an attacker with local access and elevated privileges to execute arbitrary code.
- Product
- ThinkPad BIOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.lenovo.comsupport.lenovo.com
Nov 12, 2021A vulnerability was reported in some Lenovo Desktop models that could allow unauthorized access to the boot menu, when the "BIOS Password At Boot Device List" BCVE-2021-3519 · Other software · Lenovo · reported by psirt@lenovo.comMedium 6.4
A vulnerability was reported in some Lenovo Desktop models that could allow unauthorized access to the boot menu, when the "BIOS Password At Boot Device List" BIOS setting is Yes.
- Product
- Desktop BIOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.lenovo.comsupport.lenovo.com
Nov 2, 2021An issue was discovered in Int15MicrocodeSmm in Insyde InsydeH2O before 2021-10-14 on Intel client chipsets.CVE-2020-5955 · Other software · Insyde · reported by MITRECritical 9.8
An issue was discovered in Int15MicrocodeSmm in Insyde InsydeH2O before 2021-10-14 on Intel client chipsets. A caller may be able to escalate privileges.
- Product
- Insydeh2o Uefi Bios
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.netapp.cominsyde.com
Sep 30, 2021A vulnerability exists in SMM (System Management Mode) branch that registers a SWSMI handler that does not sufficiently check or validate the allocated buffer pCVE-2021-33626 · Other software · Siemens · reported by MITREHigh 7.8
A vulnerability exists in SMM (System Management Mode) branch that registers a SWSMI handler that does not sufficiently check or validate the allocated buffer pointer(QWORD values for CommBuffer). This can be used by an attacker to corrupt data in SMRAM memory and even lead to arbitrary code execution.
- Product
- RUGGEDCOM APE1808 - BIOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert-portal.siemens.comsecurity.netapp.com
Sep 28, 2021Dell BIOS contains an Improper Restriction of Excessive Authentication Attempts vulnerability.CVE-2021-36285 · Other software · Dell · reported by security_alert@emc.comMedium 5.7
Dell BIOS contains an Improper Restriction of Excessive Authentication Attempts vulnerability. A local authenticated malicious administrator could exploit this vulnerability to bypass excessive NVMe password attempt mitigations in order to carry out a brute force attack.
- Product
- CPG BIOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 28, 2021Dell BIOS contains an Improper Restriction of Excessive Authentication Attempts vulnerability.CVE-2021-36284 · Other software · Dell · reported by security_alert@emc.comMedium 5.7
Dell BIOS contains an Improper Restriction of Excessive Authentication Attempts vulnerability. A local authenticated malicious administrator could exploit this vulnerability to bypass excessive admin password attempt mitigations in order to carry out a brute force attack.
- Product
- CPG BIOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 28, 2021Dell BIOS contains an improper input validation vulnerability.CVE-2021-36283 · Other software · Dell · reported by security_alert@emc.comHigh 7.5
Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user may potentially exploit this vulnerability by using an SMI to gain arbitrary code execution in SMRAM.
- Product
- CPG BIOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 28, 2021Dell BIOS contains a Credentials Management issue.CVE-2021-21522 · Other software · Dell · reported by security_alert@emc.comHigh 8.2
Dell BIOS contains a Credentials Management issue. A local authenticated malicious user may potentially exploit this vulnerability to gain access to sensitive information on an NVMe storage by resetting the BIOS password on the system via the Manageability Interface.
- Product
- CPG BIOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 23, 2021ASRock 4x4 BOX-R1000 before BIOS P1.40 allows privilege escalation via code execution in the SMM.CVE-2020-14032 · Other software · Asrock · reported by MITRECritical 9.8
ASRock 4x4 BOX-R1000 before BIOS P1.40 allows privilege escalation via code execution in the SMM.
- Product
- Box-r1000 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddannyodler.medium.comasrock.com
Jul 16, 2021A vulnerability was reported on some Lenovo Notebook systems that could allow an attacker with physical access to elevate privileges under certain conditions duCVE-2021-3614 · Other software · Lenovo · reported by psirt@lenovo.comMedium 6.4
A vulnerability was reported on some Lenovo Notebook systems that could allow an attacker with physical access to elevate privileges under certain conditions during a BIOS update performed by Lenovo Vantage.
- Product
- Notebook BIOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.lenovo.comsupport.lenovo.com
Jul 16, 2021Some Lenovo Notebook, ThinkPad, and Lenovo Desktop systems have BIOS modules unprotected by Intel Boot Guard that could allow an attacker with physical access tCVE-2021-3453 · Other software · Lenovo · reported by psirt@lenovo.comMedium 6.8
Some Lenovo Notebook, ThinkPad, and Lenovo Desktop systems have BIOS modules unprotected by Intel Boot Guard that could allow an attacker with physical access the ability to write to the SPI flash storage.
- Product
- BIOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.lenovo.comsupport.lenovo.com
Jul 16, 2021A potential vulnerability in the system shutdown SMI callback function in some ThinkPad models may allow an attacker with local access and elevated privileges tCVE-2021-3452 · Other software · Lenovo · reported by psirt@lenovo.comMedium 6.7
A potential vulnerability in the system shutdown SMI callback function in some ThinkPad models may allow an attacker with local access and elevated privileges to execute arbitrary code.
- Product
- ThinkPad BIOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.lenovo.comsupport.lenovo.com
Jun 24, 2021Dell BIOSConnect feature contains a buffer overflow vulnerability.CVE-2021-21574 · Other software · Dell · reported by security_alert@emc.comHigh 7.2
Dell BIOSConnect feature contains a buffer overflow vulnerability. An authenticated malicious admin user with local access to the system may potentially exploit this vulnerability to run arbitrary code and bypass UEFI restrictions.
- Product
- BIOSConnect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 24, 2021Dell BIOSConnect feature contains a buffer overflow vulnerability.CVE-2021-21573 · Other software · Dell · reported by security_alert@emc.comHigh 7.2
Dell BIOSConnect feature contains a buffer overflow vulnerability. An authenticated malicious admin user with local access to the system may potentially exploit this vulnerability to run arbitrary code and bypass UEFI restrictions.
- Product
- BIOSConnect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 24, 2021Dell BIOSConnect feature contains a buffer overflow vulnerability.CVE-2021-21572 · Other software · Dell · reported by security_alert@emc.comHigh 7.2
Dell BIOSConnect feature contains a buffer overflow vulnerability. An authenticated malicious admin user with local access to the system may potentially exploit this vulnerability to run arbitrary code and bypass UEFI restrictions.
- Product
- BIOSConnect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 24, 2021Dell UEFI BIOS https stack leveraged by the Dell BIOSConnect feature and Dell HTTPS Boot feature contains an improper certificate validation vulnerability.CVE-2021-21571 · Other software · Dell · reported by security_alert@emc.comMedium 5.9
Dell UEFI BIOS https stack leveraged by the Dell BIOSConnect feature and Dell HTTPS Boot feature contains an improper certificate validation vulnerability. A remote unauthenticated attacker may exploit this vulnerability using a person-in-the-middle attack which may lead to a denial of service and payload tampering.
- Product
- UEFI BIOS https stack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2021In the kernel in Insyde InsydeH2O 5.x, certain SMM drivers did not correctly validate the CommBuffer and CommBufferSize parameters, allowing callers to corrupt CVE-2020-27339 · Other software · Siemens · reported by MITREMedium 6.7
In the kernel in Insyde InsydeH2O 5.x, certain SMM drivers did not correctly validate the CommBuffer and CommBufferSize parameters, allowing callers to corrupt either the firmware or the OS memory. The fixed versions for this issue in the AhciBusDxe, IdeBusDxe, NvmExpressDxe, SdHostDriverDxe, and SdMmcDeviceDxe drivers are 05.16.25, 05.26.25, 05.35.25, 05.43.25, and 05.51.25 (for Kernel 5.1 through 5.5).
- Product
- RUGGEDCOM APE1808 - BIOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert-portal.siemens.comsecurity.netapp.com
Jun 14, 2021Dell PowerEdge Server BIOS and select Dell Precision Rack BIOS contain an out-of-bounds array access vulnerability.CVE-2021-21557 · Other software · Dell · reported by security_alert@emc.comHigh 8.1
Dell PowerEdge Server BIOS and select Dell Precision Rack BIOS contain an out-of-bounds array access vulnerability. A local malicious user with high privileges may potentially exploit this vulnerability, leading to a denial of service, arbitrary code execution, or information disclosure in System Management Mode.
- Product
- PowerEdge BIOS Intel 15G
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 14, 2021Dell PowerEdge R640, R740, R740XD, R840, R940, R940xa, MX740c, MX840c, and T640 Server BIOS contain a stack-based buffer overflow vulnerability in systems with CVE-2021-21556 · Other software · Dell · reported by security_alert@emc.comMedium 6.1
Dell PowerEdge R640, R740, R740XD, R840, R940, R940xa, MX740c, MX840c, and T640 Server BIOS contain a stack-based buffer overflow vulnerability in systems with NVDIMM-N installed. A local malicious user with high privileges may potentially exploit this vulnerability, leading to a denial of Service, arbitrary code execution, or information disclosure in UEFI or BIOS Preboot Environment.
- Product
- PowerEdge BIOS Intel 15G
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 14, 2021Dell PowerEdge R640, R740, R740XD, R840, R940, R940xa, MX740c, MX840c, and T640 Server BIOS contain a heap-based buffer overflow vulnerability in systems with NCVE-2021-21555 · Other software · Dell · reported by security_alert@emc.comMedium 6.1
Dell PowerEdge R640, R740, R740XD, R840, R940, R940xa, MX740c, MX840c, and T640 Server BIOS contain a heap-based buffer overflow vulnerability in systems with NVDIMM-N installed. A local malicious user with high privileges may potentially exploit this vulnerability, leading to a denial of Service, arbitrary code execution, or information disclosure in UEFI or BIOS Preboot Environment.
- Product
- PowerEdge BIOS Intel 15G
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 14, 2021Dell PowerEdge R640, R740, R740XD, R840, R940, R940xa, MX740c, MX840c, and, Dell Precision 7920 Rack Workstation BIOS contain a stack-based buffer overflow vulnCVE-2021-21554 · Other software · Dell · reported by security_alert@emc.comMedium 6.1
Dell PowerEdge R640, R740, R740XD, R840, R940, R940xa, MX740c, MX840c, and, Dell Precision 7920 Rack Workstation BIOS contain a stack-based buffer overflow vulnerability in systems with Intel Optane DC Persistent Memory installed. A local malicious user with high privileges may potentially exploit this vulnerability, leading to a denial of Service, arbitrary code execution, or information disclosure in UEFI or BIOS Preboot Environment.
- Product
- PowerEdge BIOS Intel 15G
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2021Out of bounds write in the BMC firmware for Intel(R) Server Board M10JNP2SB before version EFI BIOS 7215, BMC 8100.01.08 may allow an unauthenticated user to poCVE-2021-0113 · Other software · Intel · reported by secure@intel.comMedium 6.5
Out of bounds write in the BMC firmware for Intel(R) Server Board M10JNP2SB before version EFI BIOS 7215, BMC 8100.01.08 may allow an unauthenticated user to potentially enable a denial of service via adjacent access.
- Product
- EFI Bios 7215
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2021Buffer overflow in the BMC firmware for Intel(R) Server BoardM10JNP2SB before version EFI BIOS 7215, BMC 8100.01.08 may allow an unauthenticated user to potentiCVE-2021-0101 · Other software · Intel · reported by secure@intel.comHigh 8.8
Buffer overflow in the BMC firmware for Intel(R) Server BoardM10JNP2SB before version EFI BIOS 7215, BMC 8100.01.08 may allow an unauthenticated user to potentially enable an escalation of privilege via adjacent access.
- Product
- EFI Bios 7215
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2021Path traversal in the BMC firmware for Intel(R) Server Board M10JNP2SB before version EFI BIOS 7215, BMC 8100.01.08 may allow an unauthenticated user to potentiCVE-2021-0097 · Other software · Intel · reported by secure@intel.comMedium 6.5
Path traversal in the BMC firmware for Intel(R) Server Board M10JNP2SB before version EFI BIOS 7215, BMC 8100.01.08 may allow an unauthenticated user to potentially enable a denial of service via adjacent access.
- Product
- EFI Bios 7215
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2021Improper initialization in the firmware for some Intel(R) Processors may allow a privileged user to potentially enable a denial of service via local access.CVE-2021-0095 · Other software · Intel · reported by secure@intel.comMedium 4.4
Improper initialization in the firmware for some Intel(R) Processors may allow a privileged user to potentially enable a denial of service via local access.
- Product
- Bios
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.netapp.comintel.com
Jun 9, 2021Improper input validation in the BMC firmware for Intel(R) Server Board M10JNP2SB before version EFI BIOS 7215, BMC 8100.01.08 may allow an unauthenticated userCVE-2021-0070 · Other software · Intel · reported by secure@intel.comHigh 8.8
Improper input validation in the BMC firmware for Intel(R) Server Board M10JNP2SB before version EFI BIOS 7215, BMC 8100.01.08 may allow an unauthenticated user to potentially enable an escalation of privilege via adjacent access.
- Product
- EFI Bios 7215
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2021Improper input validation in the firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege via local accesCVE-2020-8700 · Other software · Intel · reported by secure@intel.comMedium 6.7
Improper input validation in the firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege via local access.
- Product
- Bios
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.netapp.comintel.com
Jun 9, 2021Race condition in the firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege via local access.CVE-2020-8670 · Other software · Intel · reported by secure@intel.comMedium 6.4
Race condition in the firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege via local access.
- Product
- Bios
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert-portal.siemens.comsecurity.netapp.com
Jun 9, 2021Improper input validation in the firmware for some Intel(R) Processors may allow an authenticated user to potentially enable denial of service via local access.CVE-2020-24486 · Other software · Intel · reported by secure@intel.comMedium 5.5
Improper input validation in the firmware for some Intel(R) Processors may allow an authenticated user to potentially enable denial of service via local access.
- Product
- Bios
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert-portal.siemens.comsecurity.netapp.com
Jun 9, 2021Out of bounds read in the firmware for some Intel(R) Processors may allow an authenticated user to potentially enable escalation of privilege via local access.CVE-2020-12360 · Other software · Intel · reported by secure@intel.comHigh 7.8
Out of bounds read in the firmware for some Intel(R) Processors may allow an authenticated user to potentially enable escalation of privilege via local access.
- Product
- Bios
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert-portal.siemens.comsecurity.netapp.com
Jun 9, 2021Insufficient control flow management in the firmware for some Intel(R) Processors may allow an unauthenticated user to potentially enable escalation of privilegCVE-2020-12359 · Other software · Intel · reported by secure@intel.comMedium 6.8
Insufficient control flow management in the firmware for some Intel(R) Processors may allow an unauthenticated user to potentially enable escalation of privilege via physical access.
- Product
- Bios
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.netapp.comintel.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.