Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
24 results
Feb 14, 2024An insecure default to allow UEFI Shell in EDK2 was left enabled in Ubuntu's EDK2.CVE-2023-48733 · Other software · Canonical Ltd. · reported by security@ubuntu.comMedium 6.7
An insecure default to allow UEFI Shell in EDK2 was left enabled in Ubuntu's EDK2. This allows an OS-resident attacker to bypass Secure Boot.
- Product
- Ubuntu EDK II
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.launchpad.netbugs.launchpad.net
Mar 3, 2022Existing CommBuffer checks in SmmEntryPoint will not catch underflow when computing BufferSize.CVE-2021-38578 · Other software · TianoCore · reported by infosec@edk2.groups.ioHigh 7.4
Existing CommBuffer checks in SmmEntryPoint will not catch underflow when computing BufferSize.
- Product
- EDK II
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.tianocore.orginsyde.com
Dec 1, 2021NetworkPkg/IScsiDxe has remotely exploitable buffer overflows.CVE-2021-38575 · Other software · TianoCore · reported by infosec@edk2.groups.ioHigh 8.1
NetworkPkg/IScsiDxe has remotely exploitable buffer overflows.
- Product
- EDK II
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.tianocore.orginsyde.com
Aug 5, 2021BootPerformanceTable pointer is read from an NVRAM variable in PEI.CVE-2021-28216 · Other software · TianoCore · reported by infosec@edk2.groups.ioHigh 7.8
BootPerformanceTable pointer is read from an NVRAM variable in PEI. Recommend setting PcdFirmwarePerformanceDataTableS3Support to FALSE.
- Product
- EDK II
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.tianocore.orgbugzilla.tianocore.org
Jul 14, 2021Insufficient input validation in MdeModulePkg in EDKII may allow an unauthenticated user to potentially enable escalation of privilege, denial of service and/orCVE-2019-11098 · Other software · Tianocore · reported by secure@intel.comMedium 6.8
Insufficient input validation in MdeModulePkg in EDKII may allow an unauthenticated user to potentially enable escalation of privilege, denial of service and/or information disclosure via physical access.
- Product
- EDK II
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordedk2-docs.gitbook.ioedk2-docs.gitbook.io
Jun 11, 2021Example EDK2 encrypted private key in the IpSecDxe.efi present potential security risks.CVE-2021-28213 · Other software · TianoCore · reported by infosec@edk2.groups.ioHigh 7.5
Example EDK2 encrypted private key in the IpSecDxe.efi present potential security risks.
- Product
- EDK II
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.tianocore.orgbugzilla.tianocore.org
Jun 11, 2021A heap overflow in LzmaUefiDecompressGetInfo function in EDK II.CVE-2021-28211 · Other software · TianoCore · reported by infosec@edk2.groups.ioMedium 6.7
A heap overflow in LzmaUefiDecompressGetInfo function in EDK II.
- Product
- EDK II
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.tianocore.orgbugzilla.tianocore.org
Jun 11, 2021An unlimited recursion in DxeCore in EDK II.CVE-2021-28210 · Other software · TianoCore · reported by infosec@edk2.groups.ioHigh 7.8
An unlimited recursion in DxeCore in EDK II.
- Product
- EDK II
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.tianocore.orgbugzilla.tianocore.org
Nov 23, 2020Logic issue EDK II may allow an unauthenticated user to potentially enable denial of service via adjacent access.CVE-2019-14587 · Other software · Tianocore · reported by secure@intel.comMedium 6.5
Logic issue EDK II may allow an unauthenticated user to potentially enable denial of service via adjacent access.
- Product
- Edk2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.tianocore.orglists.debian.org
Nov 23, 2020Use after free vulnerability in EDK II may allow an authenticated user to potentially enable escalation of privilege, information disclosure and/or denial of seCVE-2019-14586 · Other software · Tianocore · reported by secure@intel.comHigh 8
Use after free vulnerability in EDK II may allow an authenticated user to potentially enable escalation of privilege, information disclosure and/or denial of service via adjacent access.
- Product
- Edk2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.tianocore.orglists.debian.org
Nov 23, 2020Logic issue in DxeImageVerificationHandler() for EDK II may allow an authenticated user to potentially enable escalation of privilege via local access.CVE-2019-14575 · Other software · Tianocore · reported by secure@intel.comHigh 7.8
Logic issue in DxeImageVerificationHandler() for EDK II may allow an authenticated user to potentially enable escalation of privilege via local access.
- Product
- Edk2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.tianocore.orglists.debian.org
Nov 23, 2020Integer truncation in EDK II may allow an authenticated user to potentially enable escalation of privilege via local access.CVE-2019-14563 · Other software · Tianocore · reported by secure@intel.comHigh 7.8
Integer truncation in EDK II may allow an authenticated user to potentially enable escalation of privilege via local access.
- Product
- Edk2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.tianocore.orglists.debian.org
Nov 23, 2020Integer overflow in DxeImageVerificationHandler() EDK II may allow an authenticated user to potentially enable denial of service via local access.CVE-2019-14562 · Other software · Tianocore · reported by secure@intel.comMedium 5.5
Integer overflow in DxeImageVerificationHandler() EDK II may allow an authenticated user to potentially enable denial of service via local access.
- Product
- Edk2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.tianocore.orglists.debian.org
Nov 23, 2020Uncontrolled resource consumption in EDK II may allow an unauthenticated user to potentially enable denial of service via network access.CVE-2019-14559 · Other software · Tianocore · reported by secure@intel.comHigh 7.5
Uncontrolled resource consumption in EDK II may allow an unauthenticated user to potentially enable denial of service via network access.
- Product
- Edk2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.tianocore.orglists.debian.org
Nov 23, 2020Improper authentication in EDK II may allow a privileged user to potentially enable information disclosure via network access.CVE-2019-14553 · Other software · Tianocore · reported by secure@intel.comMedium 4.9
Improper authentication in EDK II may allow a privileged user to potentially enable information disclosure via network access.
- Product
- Edk2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.tianocore.orgbugzilla.tianocore.org
Mar 27, 2019Stack overflow in XHCI for EDK II may allow an unauthenticated user to potentially enable denial of service via local access.CVE-2019-0161 · Other software · Extensible Firmware Interface Development Kit (EDK II) · reported by secure@intel.comMedium 5.5
Stack overflow in XHCI for EDK II may allow an unauthenticated user to potentially enable denial of service via local access.
- Product
- Extensible Firmware Interface Development Kit (EDK II)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.opensuse.orglists.opensuse.org
Mar 27, 2019Buffer overflow in system firmware for EDK II may allow unauthenticated user to potentially enable escalation of privilege and/or denial of service via network CVE-2019-0160 · Other software · Tianocore · reported by secure@intel.comCritical 9.8
Buffer overflow in system firmware for EDK II may allow unauthenticated user to potentially enable escalation of privilege and/or denial of service via network access.
- Product
- EDK II
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtianocore-docs.github.iotianocore-docs.github.io
Mar 27, 2019Logic issue in variable service module for EDK II/UDK2018/UDK2017/UDK2015 may allow an authenticated user to potentially enable escalation of privilege, informaCVE-2018-3613 · Other software · Extensible Firmware Interface Development Kit (EDK II) · reported by secure@intel.comHigh 7.8
Logic issue in variable service module for EDK II/UDK2018/UDK2017/UDK2015 may allow an authenticated user to potentially enable escalation of privilege, information disclosure and/or denial of service via local access.
- Product
- Extensible Firmware Interface Development Kit (EDK II)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comedk2-docs.gitbooks.io
Mar 27, 2019Stack overflow in DxeCore for EDK II may allow an unauthenticated user to potentially enable escalation of privilege, information disclosure and/or denial of seCVE-2018-12183 · Other software · Extensible Firmware Interface Development Kit (EDK II) · reported by secure@intel.comMedium 6.8
Stack overflow in DxeCore for EDK II may allow an unauthenticated user to potentially enable escalation of privilege, information disclosure and/or denial of service via local access.
- Product
- Extensible Firmware Interface Development Kit (EDK II)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comedk2-docs.gitbooks.io
Mar 27, 2019Insufficient memory write check in SMM service for EDK II may allow an authenticated user to potentially enable escalation of privilege, information disclosure CVE-2018-12182 · Other software · Extensible Firmware Interface Development Kit (EDK II) · reported by secure@intel.comMedium 6.7
Insufficient memory write check in SMM service for EDK II may allow an authenticated user to potentially enable escalation of privilege, information disclosure and/or denial of service via local access.
- Product
- Extensible Firmware Interface Development Kit (EDK II)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comedk2-docs.gitbooks.io
Mar 27, 2019Stack overflow in corrupted bmp for EDK II may allow unprivileged user to potentially enable denial of service or elevation of privilege via local access.CVE-2018-12181 · Other software · Extensible Firmware Interface Development Kit (EDK II) · reported by secure@intel.comMedium 6
Stack overflow in corrupted bmp for EDK II may allow unprivileged user to potentially enable denial of service or elevation of privilege via local access.
- Product
- Extensible Firmware Interface Development Kit (EDK II)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.opensuse.orglists.opensuse.org
Mar 27, 2019Buffer overflow in BlockIo service for EDK II may allow an unauthenticated user to potentially enable escalation of privilege, information disclosure and/or denCVE-2018-12180 · Other software · Extensible Firmware Interface Development Kit (EDK II) · reported by secure@intel.comHigh 8.8
Buffer overflow in BlockIo service for EDK II may allow an unauthenticated user to potentially enable escalation of privilege, information disclosure and/or denial of service via network access.
- Product
- Extensible Firmware Interface Development Kit (EDK II)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.opensuse.orgaccess.redhat.com
Mar 27, 2019Improper configuration in system firmware for EDK II may allow unauthenticated user to potentially enable escalation of privilege, information disclosure and/orCVE-2018-12179 · Other software · Extensible Firmware Interface Development Kit (EDK II) · reported by secure@intel.comHigh 7.8
Improper configuration in system firmware for EDK II may allow unauthenticated user to potentially enable escalation of privilege, information disclosure and/or denial of service via local access.
- Product
- Extensible Firmware Interface Development Kit (EDK II)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordedk2-docs.gitbooks.iolists.fedoraproject.org
Mar 27, 2019Buffer overflow in network stack for EDK II may allow unprivileged user to potentially enable escalation of privilege and/or denial of service via network.CVE-2018-12178 · Other software · Extensible Firmware Interface Development Kit (EDK II) · reported by secure@intel.comCritical 9.1
Buffer overflow in network stack for EDK II may allow unprivileged user to potentially enable escalation of privilege and/or denial of service via network.
- Product
- Extensible Firmware Interface Development Kit (EDK II)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.opensuse.orgedk2-docs.gitbooks.io
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.