| 0 |
|
| 1 |
|
| 2 |
|
| 3 |
| url |
VCID-2y4v-rme2-efe4 |
| vulnerability_id |
VCID-2y4v-rme2-efe4 |
| summary |
Stack overflow in DxeCore for EDK II may allow an unauthenticated user to potentially enable escalation of privilege, information disclosure and/or denial of service via local access. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2018-12183
|
| risk_score |
3.0 |
| exploitability |
0.5 |
| weighted_severity |
6.1 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-2y4v-rme2-efe4 |
|
| 4 |
|
| 5 |
|
| 6 |
| url |
VCID-3k3f-q3mm-b7bh |
| vulnerability_id |
VCID-3k3f-q3mm-b7bh |
| summary |
The Ubuntu edk2 UEFI firmware packages accidentally allowed the UEFI Shell to be accessed in Secure Boot environments, possibly allowing bypass of Secure Boot constraints. Versions 2024.05-2ubuntu0.3 and 2024.02-2ubuntu0.3 disable the Shell. Some previous versions inserted a secure-boot-based decision to continue running inside the Shell itself, which is believed to be sufficient to enforce Secure Boot restrictions. This is an additional repair on top of the incomplete fix for CVE-2023-48733. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2025-2486
|
| risk_score |
1.6 |
| exploitability |
0.5 |
| weighted_severity |
3.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-3k3f-q3mm-b7bh |
|
| 7 |
|
| 8 |
|
| 9 |
|
| 10 |
|
| 11 |
|
| 12 |
|
| 13 |
|
| 14 |
| url |
VCID-a4xf-yhxe-6fcx |
| vulnerability_id |
VCID-a4xf-yhxe-6fcx |
| summary |
Improper configuration in system firmware for EDK II may allow unauthenticated user to potentially enable escalation of privilege, information disclosure and/or denial of service via local access. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2018-12179
|
| risk_score |
3.5 |
| exploitability |
0.5 |
| weighted_severity |
7.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-a4xf-yhxe-6fcx |
|
| 15 |
|
| 16 |
|
| 17 |
|
| 18 |
|
| 19 |
|
| 20 |
|
| 21 |
|
| 22 |
|
| 23 |
|
| 24 |
|
| 25 |
|
| 26 |
| url |
VCID-j4tr-y7kc-9qa2 |
| vulnerability_id |
VCID-j4tr-y7kc-9qa2 |
| summary |
A BIOS bug in firmware for a particular PC model leaves the Platform authorization value empty. This can be used to permanently brick the TPM in multiple ways, as well as to non-permanently DoS the system. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2021-38576
|
| risk_score |
null |
| exploitability |
0.5 |
| weighted_severity |
0.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-j4tr-y7kc-9qa2 |
|
| 27 |
|
| 28 |
|
| 29 |
|
| 30 |
|
| 31 |
|
| 32 |
|
| 33 |
|
| 34 |
|
| 35 |
|
| 36 |
|
| 37 |
|
| 38 |
| url |
VCID-vgvn-bvfg-g3fu |
| vulnerability_id |
VCID-vgvn-bvfg-g3fu |
| summary |
Integer overflow in the Drive Execution Environment (DXE) phase in the Capsule Update feature in the UEFI implementation in EDK2 allows physically proximate attackers to bypass intended access restrictions via crafted data. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2014-4859
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-vgvn-bvfg-g3fu |
|
| 39 |
| url |
VCID-wu8f-zx48-dbf3 |
| vulnerability_id |
VCID-wu8f-zx48-dbf3 |
| summary |
Multiple integer overflows in the Pre-EFI Initialization (PEI) boot phase in the Capsule Update feature in the UEFI implementation in EDK2 allow physically proximate attackers to bypass intended access restrictions by providing crafted data that is not properly handled during the coalescing phase. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2014-4860
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-wu8f-zx48-dbf3 |
|
| 40 |
| url |
VCID-yjrq-8qp2-mkbk |
| vulnerability_id |
VCID-yjrq-8qp2-mkbk |
| summary |
Insufficient memory write check in SMM service for EDK II may allow an authenticated user to potentially enable escalation of privilege, information disclosure and/or denial of service via local access. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2018-12182
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-yjrq-8qp2-mkbk |
|