Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
799 results · page 9 of 16
Apr 21, 2023NVIDIA DGX-1 SBIOS contains a vulnerability in the Uncore PEI module, where authentication of the code executed by SSA is missing, which may lead to arbitrary cCVE-2023-0209 · Other software · NVIDIA · reported by psirt@nvidia.comHigh 8.2
NVIDIA DGX-1 SBIOS contains a vulnerability in the Uncore PEI module, where authentication of the code executed by SSA is missing, which may lead to arbitrary code execution, denial of service, escalation of privileges assisted by a firmware implant, information disclosure assisted by a firmware implant, data tampering, and SecureBoot bypass.
- Product
- NVIDIA DGX servers
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnvidia.custhelp.comnvidia.custhelp.com
Apr 21, 2023NVIDIA DGX-2 SBIOS contains a vulnerability where an attacker may modify the ServerSetup NVRAM variable at runtime by executing privileged code.CVE-2023-0207 · Other software · NVIDIA · reported by psirt@nvidia.comHigh 7.5
NVIDIA DGX-2 SBIOS contains a vulnerability where an attacker may modify the ServerSetup NVRAM variable at runtime by executing privileged code. A successful exploit of this vulnerability may lead to denial of service.
- Product
- NVIDIA DGX servers
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnvidia.custhelp.comnvidia.custhelp.com
Apr 21, 2023NVIDIA DGX A100 SBIOS contains a vulnerability where an attacker may modify arbitrary memory of SMRAM by exploiting the NVME SMM API.CVE-2023-0206 · Other software · NVIDIA · reported by psirt@nvidia.comHigh 7.5
NVIDIA DGX A100 SBIOS contains a vulnerability where an attacker may modify arbitrary memory of SMRAM by exploiting the NVME SMM API. A successful exploit of this vulnerability may lead to denial of service, escalation of privileges, and information disclosure.
- Product
- NVIDIA DGX servers
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnvidia.custhelp.comnvidia.custhelp.com
Apr 21, 2023NVIDIA DGX A100 SBIOS contains a vulnerability where an attacker may modify arbitrary memory of SMRAM by exploiting the GenericSio and LegacySmmSredir SMM APIs.CVE-2023-0202 · Other software · NVIDIA · reported by psirt@nvidia.comHigh 7.5
NVIDIA DGX A100 SBIOS contains a vulnerability where an attacker may modify arbitrary memory of SMRAM by exploiting the GenericSio and LegacySmmSredir SMM APIs. A successful exploit of this vulnerability may lead to denial of service, escalation of privileges, and information disclosure.
- Product
- NVIDIA DGX servers
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnvidia.custhelp.comnvidia.custhelp.com
Apr 21, 2023NVIDIA DGX-2 SBIOS contains a vulnerability in Bds, where a user with high privileges can cause a write beyond the bounds of an indexable resource, which may leCVE-2023-0201 · Other software · NVIDIA · reported by psirt@nvidia.comMedium 6.7
NVIDIA DGX-2 SBIOS contains a vulnerability in Bds, where a user with high privileges can cause a write beyond the bounds of an indexable resource, which may lead to code execution, denial of service, compromised integrity, and information disclosure.
- Product
- NVIDIA DGX servers
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnvidia.custhelp.comnvidia.custhelp.com
Mar 29, 2023Suprema BioStar 2 v2.8.16 was discovered to contain a SQL injection vulnerability via the values parameter at /users/absence?search_month=1.CVE-2023-27167 · Other software · Supremainc · reported by MITREMedium 6.5
Suprema BioStar 2 v2.8.16 was discovered to contain a SQL injection vulnerability via the values parameter at /users/absence?search_month=1.
- Product
- Biostar 2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbiostar2.ciklum.netpacketstormsecurity.com
Mar 16, 2023 Dell PowerEdge BIOS and Dell Precision BIOS contain an Improper SMM communication buffer verification vulnerability.CVE-2022-34423 · Other software · Dell · reported by security_alert@emc.comHigh 7.5
Dell PowerEdge BIOS and Dell Precision BIOS contain an Improper SMM communication buffer verification vulnerability. A local malicious user with high Privileges may potentially exploit this vulnerability to perform arbitrary code execution or cause denial of service.
- Product
- PowerEdge Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 16, 2023 Dell PowerEdge BIOS and Dell Precision BIOS contain an Improper SMM communication buffer verification vulnerability.CVE-2022-34422 · Other software · Dell · reported by security_alert@emc.comHigh 7.5
Dell PowerEdge BIOS and Dell Precision BIOS contain an Improper SMM communication buffer verification vulnerability. A local malicious user with high Privileges may potentially exploit this vulnerability to perform arbitrary code execution or cause denial of service.
- Product
- PowerEdge Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 16, 2023 Dell PowerEdge BIOS and Dell Precision BIOS contain an Improper SMM communication buffer verification vulnerability.CVE-2022-34421 · Other software · Dell · reported by security_alert@emc.comHigh 7.5
Dell PowerEdge BIOS and Dell Precision BIOS contain an Improper SMM communication buffer verification vulnerability. A local malicious user with high Privileges may potentially exploit this vulnerability to perform arbitrary code execution or cause denial of service.
- Product
- PowerEdge Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 16, 2023 Dell PowerEdge BIOS and Dell Precision BIOS contain an Improper SMM communication buffer verification vulnerability.CVE-2022-34420 · Other software · Dell · reported by security_alert@emc.comHigh 7.5
Dell PowerEdge BIOS and Dell Precision BIOS contain an Improper SMM communication buffer verification vulnerability. A local malicious user with high Privileges may potentially exploit this vulnerability to perform arbitrary code execution or cause denial of service.
- Product
- PowerEdge Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 16, 2023 Dell PowerEdge BIOS and Dell Precision BIOS contain an Improper SMM communication buffer verification vulnerability.CVE-2022-34419 · Other software · Dell · reported by security_alert@emc.comHigh 7.5
Dell PowerEdge BIOS and Dell Precision BIOS contain an Improper SMM communication buffer verification vulnerability. A local malicious user with high Privileges may potentially exploit this vulnerability to perform arbitrary code execution or cause denial of service.
- Product
- PowerEdge Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 16, 2023 Dell PowerEdge BIOS and Dell Precision BIOS contain an Improper SMM communication buffer verification vulnerability.CVE-2022-34418 · Other software · Dell · reported by security_alert@emc.comHigh 7.5
Dell PowerEdge BIOS and Dell Precision BIOS contain an Improper SMM communication buffer verification vulnerability. A local malicious user with high Privileges may potentially exploit this vulnerability to perform arbitrary code execution or cause denial of service.
- Product
- PowerEdge Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 16, 2023 Dell PowerEdge BIOS and Dell Precision BIOS contain an Improper SMM communication buffer verification vulnerability.CVE-2022-34417 · Other software · Dell · reported by security_alert@emc.comHigh 7.5
Dell PowerEdge BIOS and Dell Precision BIOS contain an Improper SMM communication buffer verification vulnerability. A local malicious user with high Privileges may potentially exploit this vulnerability to perform arbitrary code execution or cause denial of service.
- Product
- PowerEdge Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 16, 2023 Dell PowerEdge BIOS and Dell Precision BIOS contain an Improper SMM communication buffer verification vulnerability.CVE-2022-34416 · Other software · Dell · reported by security_alert@emc.comHigh 7.5
Dell PowerEdge BIOS and Dell Precision BIOS contain an Improper SMM communication buffer verification vulnerability. A local malicious user with high Privileges may potentially exploit this vulnerability to perform arbitrary code execution or cause denial of service.
- Product
- PowerEdge Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 16, 2023 Dell PowerEdge BIOS and Dell Precision BIOS contain an Improper SMM communication buffer verification vulnerability.CVE-2022-34415 · Other software · Dell · reported by security_alert@emc.comHigh 7.5
Dell PowerEdge BIOS and Dell Precision BIOS contain an Improper SMM communication buffer verification vulnerability. A local malicious user with high Privileges may potentially exploit this vulnerability to perform arbitrary code execution or cause denial of service.
- Product
- PowerEdge Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 16, 2023 Dell PowerEdge BIOS and Dell Precision BIOS contain an Improper SMM communication buffer verification vulnerability.CVE-2022-34414 · Other software · Dell · reported by security_alert@emc.comHigh 7.5
Dell PowerEdge BIOS and Dell Precision BIOS contain an Improper SMM communication buffer verification vulnerability. A local malicious user with high Privileges may potentially exploit this vulnerability to perform arbitrary code execution or cause denial of service.
- Product
- PowerEdge Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 16, 2023 Dell PowerEdge BIOS and Dell Precision BIOS contain an Improper SMM communication buffer verification vulnerability.CVE-2022-34413 · Other software · Dell · reported by security_alert@emc.comHigh 7.5
Dell PowerEdge BIOS and Dell Precision BIOS contain an Improper SMM communication buffer verification vulnerability. A local malicious user with high Privileges may potentially exploit this vulnerability to perform arbitrary code execution or cause denial of service.
- Product
- PowerEdge Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 16, 2023 Dell PowerEdge BIOS and Dell Precision BIOS contain an Improper SMM communication buffer verification vulnerability.CVE-2022-34412 · Other software · Dell · reported by security_alert@emc.comHigh 7.5
Dell PowerEdge BIOS and Dell Precision BIOS contain an Improper SMM communication buffer verification vulnerability. A local malicious user with high Privileges may potentially exploit this vulnerability to perform arbitrary code execution or cause denial of service.
- Product
- PowerEdge Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 16, 2023 Dell PowerEdge BIOS and Dell Precision BIOS contain an Improper SMM communication buffer verification vulnerability.CVE-2022-34411 · Other software · Dell · reported by security_alert@emc.comHigh 7.5
Dell PowerEdge BIOS and Dell Precision BIOS contain an Improper SMM communication buffer verification vulnerability. A local malicious user with high Privileges may potentially exploit this vulnerability to perform arbitrary code execution or cause denial of service.
- Product
- PowerEdge Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 16, 2023 Dell PowerEdge BIOS and Dell Precision BIOS contain an Improper SMM communication buffer verification vulnerability.CVE-2022-34410 · Other software · Dell · reported by security_alert@emc.comHigh 7.5
Dell PowerEdge BIOS and Dell Precision BIOS contain an Improper SMM communication buffer verification vulnerability. A local malicious user with high Privileges may potentially exploit this vulnerability to perform arbitrary code execution or cause denial of service.
- Product
- PowerEdge Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 16, 2023 Dell PowerEdge BIOS and Dell Precision BIOS contain an Improper SMM communication buffer verification vulnerability.CVE-2022-34409 · Other software · Dell · reported by security_alert@emc.comHigh 7.5
Dell PowerEdge BIOS and Dell Precision BIOS contain an Improper SMM communication buffer verification vulnerability. A local malicious user with high Privileges may potentially exploit this vulnerability to perform arbitrary code execution or cause denial of service.
- Product
- PowerEdge Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 16, 2023 Dell PowerEdge BIOS and Dell Precision BIOS contain an Improper SMM communication buffer verification vulnerability.CVE-2022-34408 · Other software · Dell · reported by security_alert@emc.comHigh 7.5
Dell PowerEdge BIOS and Dell Precision BIOS contain an Improper SMM communication buffer verification vulnerability. A local malicious user with high Privileges may potentially exploit this vulnerability to perform arbitrary code execution or cause denial of service.
- Product
- PowerEdge Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 16, 2023 Dell PowerEdge BIOS and Dell Precision BIOS contain an Improper SMM communication buffer verification vulnerability.CVE-2022-34407 · Other software · Dell · reported by security_alert@emc.comHigh 7.5
Dell PowerEdge BIOS and Dell Precision BIOS contain an Improper SMM communication buffer verification vulnerability. A local malicious user with high Privileges may potentially exploit this vulnerability to perform arbitrary code execution or cause denial of service.
- Product
- PowerEdge Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 16, 2023 Dell PowerEdge BIOS and Dell Precision BIOS contain an Improper SMM communication buffer verification vulnerability.CVE-2022-34406 · Other software · Dell · reported by security_alert@emc.comHigh 7.5
Dell PowerEdge BIOS and Dell Precision BIOS contain an Improper SMM communication buffer verification vulnerability. A local malicious user with high Privileges may potentially exploit this vulnerability to perform arbitrary code execution or cause denial of service.
- Product
- PowerEdge Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 16, 2023 Dell BIOS contains an Improper Input Validation vulnerability.CVE-2023-24571 · Other software · Dell · reported by security_alert@emc.comHigh 7.5
Dell BIOS contains an Improper Input Validation vulnerability. A local authenticated malicious user with administrator privileges could potentially exploit this vulnerability to perform arbitrary code execution.
- Product
- Embedded Box PC 3000 , CPG BIOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 8, 2023 Dell BIOS contains an Improper Authorization vulnerability.CVE-2022-46752 · Other software · Dell · reported by security_alert@emc.comMedium 4.6
Dell BIOS contains an Improper Authorization vulnerability. An unauthenticated physical attacker may potentially exploit this vulnerability, leading to denial of service.
- Product
- CPG BIOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 7, 2023An attacker with physical access to the affected Moxa UC Series devices can initiate a restart of the device and gain access to its BIOS.CVE-2023-1257 · Other software · MOXA · reported by ics-cert@hq.dhs.govHigh 7.6
An attacker with physical access to the affected Moxa UC Series devices can initiate a restart of the device and gain access to its BIOS. Command line options can then be altered, allowing the attacker to access the terminal. From the terminal, the attacker can modify the device’s authentication files to create a new user and gain full access to the system.
- Product
- UC-8580 Series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 16, 2023Stack overflow vulnerability in Aspire E5-475G 's BIOS firmware, in the FpGui module, a second call to GetVariable services allows local attackers to execute arCVE-2022-40080 · Other software · Acer · reported by MITREHigh 7.8
Stack overflow vulnerability in Aspire E5-475G 's BIOS firmware, in the FpGui module, a second call to GetVariable services allows local attackers to execute arbitrary code in the UEFI DXE phase and gain escalated privileges.
- Product
- Aspire E5-475g Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 16, 2023Improper initialization in the BIOS firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege via local acCVE-2022-32231 · Other software · Intel · reported by secure@intel.comHigh 7.5
Improper initialization in the BIOS firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege via local access.
- Product
- Xeon Gold 6138p Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 16, 2023Use after free in the BIOS firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege via local access.CVE-2022-30539 · Other software · Intel · reported by secure@intel.comHigh 7.5
Use after free in the BIOS firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege via local access.
- Product
- Xeon Gold 5315y Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 16, 2023Improper input validation in the BIOS firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege via local CVE-2022-26837 · Other software · Intel · reported by secure@intel.comHigh 7.5
Improper input validation in the BIOS firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege via local access.
- Product
- Xeon Gold 5317 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 16, 2023Improper access control in the BIOS firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege via local acCVE-2022-26343 · Other software · Intel · reported by secure@intel.comHigh 8.2
Improper access control in the BIOS firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege via local access.
- Product
- Xeon Bronze 3104 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 16, 2023Improper access control in the BIOS firmware for some Intel(R) Processors may allow a privileged user to potentially enable an escalation of privilege via localCVE-2021-0187 · Other software · Intel · reported by secure@intel.comLow 3.2
Improper access control in the BIOS firmware for some Intel(R) Processors may allow a privileged user to potentially enable an escalation of privilege via local access.
- Product
- Xeon Gold 6342 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 11, 2023A potential Time-of-Check to Time-of-Use (TOCTOU) vulnerability has been identified in certain HP PC products using AMI UEFI Firmware (system BIOS) which might CVE-2022-43779 · Other software · HP Inc. · reported by hp-security-alert@hp.comHigh 7
A potential Time-of-Check to Time-of-Use (TOCTOU) vulnerability has been identified in certain HP PC products using AMI UEFI Firmware (system BIOS) which might allow arbitrary code execution, denial of service, and information disclosure. AMI has released updates to mitigate the potential vulnerability.
- Product
- HP PC products using AMI UEFI Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hp.comsupport.hp.com
Feb 10, 2023 Dell PowerEdge BIOS and Dell Precision BIOS contain an Improper SMM communication buffer verification vulnerability.CVE-2022-34377 · Other software · Dell · reported by security_alert@emc.comLow 1.9
Dell PowerEdge BIOS and Dell Precision BIOS contain an Improper SMM communication buffer verification vulnerability. A local malicious user with high Privileges may potentially exploit this vulnerability to perform arbitrary code execution or cause denial of service.
- Product
- PowerEdge Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 10, 2023 Dell PowerEdge BIOS and Dell Precision BIOS contain an improper input validation vulnerability.CVE-2022-34376 · Other software · Dell · reported by security_alert@emc.comLow 3.9
Dell PowerEdge BIOS and Dell Precision BIOS contain an improper input validation vulnerability. A local authenticated malicious user may potentially exploit this vulnerability by manipulating an SMI to cause a denial of service during SMM.
- Product
- PowerEdge Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 10, 2023 Dell BIOS contains an information exposure vulnerability.CVE-2022-24410 · Other software · Dell · reported by security_alert@emc.comMedium 6.8
Dell BIOS contains an information exposure vulnerability. An unauthenticated local attacker with physical access to the system and knowledge of the system configuration could potentially exploit this vulnerability to read system information via debug interfaces.
- Product
- CPG BIOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 1, 2023A potential Time-of-Check to Time-of-Use (TOCTOU) vulnerability has been identified in the BIOS for certain HP PC products which may allow arbitrary code executCVE-2022-27538 · Other software · HP Inc. · reported by hp-security-alert@hp.comHigh 7
A potential Time-of-Check to Time-of-Use (TOCTOU) vulnerability has been identified in the BIOS for certain HP PC products which may allow arbitrary code execution, denial of service, and information disclosure. HP is releasing BIOS updates to mitigate the potential vulnerability.
- Product
- HP PC BIOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hp.comsupport.hp.com
Feb 1, 2023Potential vulnerabilities have been identified in the system BIOS of certain HP PC products, which might allow arbitrary code execution, escalation of privilegeCVE-2022-27537 · Other software · HP Inc. · reported by hp-security-alert@hp.comHigh 7.8
Potential vulnerabilities have been identified in the system BIOS of certain HP PC products, which might allow arbitrary code execution, escalation of privilege, denial of service, and information disclosure. HP is releasing BIOS updates to mitigate these potential vulnerabilities.
- Product
- HP PC BIOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hp.comsupport.hp.com
Feb 1, 2023Potential security vulnerabilities have been identified in the BIOS (UEFI Firmware) for certain HP PC products, which might allow arbitrary code execution.CVE-2021-3809 · Other software · HP Inc. · reported by hp-security-alert@hp.comHigh 7.8
Potential security vulnerabilities have been identified in the BIOS (UEFI Firmware) for certain HP PC products, which might allow arbitrary code execution. HP is releasing firmware updates to mitigate these potential vulnerabilities.
- Product
- HP PC BIOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hp.comsupport.hp.com
Feb 1, 2023Potential security vulnerabilities have been identified in the BIOS (UEFI Firmware) for certain HP PC products, which might allow arbitrary code execution.CVE-2021-3808 · Other software · HP Inc. · reported by hp-security-alert@hp.comHigh 7.8
Potential security vulnerabilities have been identified in the BIOS (UEFI Firmware) for certain HP PC products, which might allow arbitrary code execution. HP is releasing firmware updates to mitigate these potential vulnerabilities.
- Product
- HP PC BIOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hp.comsupport.hp.com
Feb 1, 2023HP has identified a potential vulnerability in BIOS firmware of some Workstation products.CVE-2021-3439 · Other software · HP Inc. · reported by hp-security-alert@hp.comHigh 7.8
HP has identified a potential vulnerability in BIOS firmware of some Workstation products. Firmware updates are being released to mitigate these potential vulnerabilities.
- Product
- HP PC BIOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hp.comsupport.hp.com
Feb 1, 2023 Dell BIOS contains a Stack based buffer overflow vulnerability.CVE-2022-34403 · Other software · Dell · reported by security_alert@emc.comHigh 7.5
Dell BIOS contains a Stack based buffer overflow vulnerability. A local authenticated attacker could potentially exploit this vulnerability by using an SMI to send larger than expected input to a parameter to gain arbitrary code execution in SMRAM.
- Product
- CPG BIOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 1, 2023 Dell BIOS contains a Time-of-check Time-of-use vulnerability.CVE-2022-34398 · Other software · Dell · reported by security_alert@emc.comHigh 7.5
Dell BIOS contains a Time-of-check Time-of-use vulnerability. A local authenticated malicious user could\u00a0potentially exploit this vulnerability by using a specifically timed DMA transaction during an SMI to gain arbitrary code execution on the system.
- Product
- CPG BIOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 1, 2023 Dell BIOS contains an improper input validation vulnerability.CVE-2022-32482 · Other software · Dell · reported by security_alert@emc.comMedium 5.6
Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user with admin privileges may potentially exploit this vulnerability in order to modify a UEFI variable.
- Product
- CPG BIOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 1, 2023 Dell BIOS contains a heap buffer overflow vulnerability.CVE-2022-34400 · Other software · Dell · reported by security_alert@emc.comHigh 7.1
Dell BIOS contains a heap buffer overflow vulnerability. A local attacker with admin privileges could potentially exploit this vulnerability to perform an arbitrary write to SMRAM during SMM.
- Product
- CPG BIOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 30, 2023A buffer overflow in the WMI SMI Handler in some Lenovo models may allow an attacker with local access and elevated privileges to execute arbitrary code.CVE-2022-40137 · Other software · Lenovo · reported by psirt@lenovo.comMedium 6.7
A buffer overflow in the WMI SMI Handler in some Lenovo models may allow an attacker with local access and elevated privileges to execute arbitrary code.
- Product
- BIOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.lenovo.comsupport.lenovo.com
Jan 30, 2023An information leak vulnerability in SMI Handler used to configure platform settings over WMI in some Lenovo models may allow an attacker with local access and CVE-2022-40136 · Other software · Lenovo · reported by psirt@lenovo.comMedium 4.4
An information leak vulnerability in SMI Handler used to configure platform settings over WMI in some Lenovo models may allow an attacker with local access and elevated privileges to read SMM memory.
- Product
- BIOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.lenovo.comsupport.lenovo.com
Jan 30, 2023An information leak vulnerability in the Smart USB Protection SMI Handler in some Lenovo models may allow an attacker with local access and elevated privileges CVE-2022-40135 · Other software · Lenovo · reported by psirt@lenovo.comMedium 4.4
An information leak vulnerability in the Smart USB Protection SMI Handler in some Lenovo models may allow an attacker with local access and elevated privileges to read SMM memory.
- Product
- BIOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.lenovo.comsupport.lenovo.com
Jan 30, 2023An information leak vulnerability in the SMI Set BIOS Password SMI Handler in some Lenovo models may allow an attacker with local access and elevated privilegesCVE-2022-40134 · Other software · Lenovo · reported by psirt@lenovo.comMedium 4.4
An information leak vulnerability in the SMI Set BIOS Password SMI Handler in some Lenovo models may allow an attacker with local access and elevated privileges to read SMM memory.
- Product
- BIOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.lenovo.comsupport.lenovo.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.