Priority MEDIUM 50
NVIDIA DGX A100 baseboard management controller (BMC) contains a vulnerability in the host KVM daemon, where an unauthenticated attacker may cause a stack overflow by sending a specially crafted network packet.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00635 · Published 2024-01-12 · Fixed in 00.22.05 CWE-121
Priority MEDIUM 44
NVIDIA DGX A100 BMC contains a vulnerability in the host KVM daemon, where an unauthenticated attacker may cause a stack overflow by sending a specially crafted network packet.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00603 · Published 2024-01-12 · Fixed in 00.22.05 CWE-121
Priority MEDIUM 44
NVIDIA DGX A100 BMC contains a vulnerability in the host KVM daemon, where an unauthenticated attacker may cause stack memory corruption by sending a specially crafted network packet.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00644 · Published 2024-01-12 · Fixed in 00.22.05 CWE-121
Priority MEDIUM 42
NVIDIA BMC contains a vulnerability in SPX REST API, where an authorized attacker can inject arbitrary shell commands, which may lead to code execution, denial of service, information disclosure and data tampering.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.01057 · Published 2023-01-13 · No fix listed CWE-78
Priority MEDIUM 42
NVIDIA BMC contains a vulnerability in SPX REST API, where an authorized attacker can inject arbitrary shell commands, which may lead to code execution, denial of service, information disclosure and data tampering.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.01057 · Published 2023-01-13 · No fix listed CWE-78
Priority MEDIUM 42
NVIDIA BMC contains a vulnerability in SPX REST API, where an authorized attacker can inject arbitrary shell commands, which may lead to code execution, denial of service, information disclosure and data tampering.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.0112 · Published 2023-01-13 · No fix listed CWE-78
Priority MEDIUM 42
NVIDIA BMC contains a vulnerability in libwebsocket, where an authorized attacker can cause a buffer overflow and cause a denial of service or gain code execution.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.009 · Published 2023-01-12 · No fix listed CWE-120
Priority MEDIUM 42
NVIDIA BMC contains a vulnerability in IPMI handler, where an authorized attacker can cause a buffer overflow, which may lead to code execution, denial of service or escalation of privileges.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.00818 · Published 2023-01-12 · No fix listed CWE-120
Priority LOW 38
NVIDIA BMC contains a vulnerability in IPMI handler, where an authorized attacker can cause a buffer overflow and cause a denial of service or gain code execution
CVSS 3.1HIGH 8.4· Local · No auth · No interaction · EPSS 0.00269 · Published 2023-01-11 · No fix listed CWE-120
Priority LOW 37
NVIDIA DGX A100 BMC contains a vulnerability where a user may cause a missing authentication issue for a critical function by an adjacent network .
CVSS 3.1HIGH 8.0· Adjacent network · Low privileges · No interaction · EPSS 0.00305 · Published 2024-01-12 · Fixed in 00.22.05 CWE-306
Priority LOW 37
NVIDIA DGX A100 contains a vulnerability in SBIOS in the SmiFlash, where a local user with elevated privileges can read, write and erase flash, which may lead to code execution, escalation of privileges, denial of servic…
CVSS 3.1HIGH 8.2· Local · High privileges · No interaction · EPSS 0.00191 · Published 2023-01-13 · No fix listed CWE-288
Priority LOW 35
NVIDIA DGX A100 SBIOS contains a vulnerability where an attacker may cause an SMI callout vulnerability that could be used to execute arbitrary code at the SMM level.
CVSS 3.1HIGH 7.8· Local · Low privileges · No interaction · EPSS 0.00176 · Published 2024-01-12 · Fixed in 1.25 CWE-20
Priority LOW 35
NVIDIA DGX Station A100 and DGX Station A800 SBIOS contains a vulnerability where a user may cause a heap-based buffer overflow by local access.
CVSS 3.1HIGH 7.8· Local · Low privileges · No interaction · EPSS 0.00194 · Published 2024-01-12 · Fixed in 1.25 CWE-122
Priority LOW 35
NVIDIA DGX A100/A800 contains a vulnerability in SBIOS where an attacker may cause improper input validation by providing configuration information in an unexpected format.
CVSS 3.1HIGH 7.8· Local · Low privileges · No interaction · EPSS 0.00174 · Published 2023-07-03 · Fixed in 1.21 CWE-20
Priority LOW 35
NVIDIA DGX A100/A800 contains a vulnerability in SBIOS where an attacker may cause execution with unnecessary privileges by leveraging a weakness whereby proper input parameter validation is not performed.
CVSS 3.1HIGH 7.8· Local · Low privileges · No interaction · EPSS 0.00148 · Published 2023-07-03 · Fixed in 1.21 CWE-250
Priority LOW 35
NVIDIA DGX A100 SBIOS contains a vulnerability where an attacker may modify arbitrary memory of SMRAM by exploiting the NVME SMM API.
CVSS 3.1HIGH 7.8· Local · Low privileges · No interaction · EPSS 0.00163 · Published 2023-04-22 · Fixed in 1.18 CWE-119
Priority LOW 35
NVIDIA DGX A100 SBIOS contains a vulnerability where an attacker may modify arbitrary memory of SMRAM by exploiting the GenericSio and LegacySmmSredir SMM APIs.
CVSS 3.1HIGH 7.8· Local · Low privileges · No interaction · EPSS 0.00163 · Published 2023-04-22 · Fixed in 1.18 CWE-119
Priority LOW 35
NVIDIA DGX A100 contains a vulnerability in SBIOS in the SmmCore, where a user with high privileges can chain another vulnerability to this vulnerability, causing an integer overflow, possibly leading to code execution,…
CVSS 3.1HIGH 8.2· Local · High privileges · No interaction · EPSS 0.00219 · Published 2022-07-04 · Fixed in 22.5.5 CWE-190
Priority LOW 35
NVIDIA DGX A100 contains a vulnerability in SBIOS in the Ofbd, where a local user with elevated privileges can cause access to an uninitialized pointer, which may lead to code execution, escalation of privileges, denial…
CVSS 3.1HIGH 8.2· Local · High privileges · No interaction · EPSS 0.00249 · Published 2022-07-04 · Fixed in 22.5.5 CWE-824
Priority LOW 35
NVIDIA DGX A100 contains a vulnerability in SBIOS in the BiosCfgTool, where a local user with elevated privileges can read and write beyond intended bounds in SMRAM, which may lead to code execution, escalation of privil…
CVSS 3.1HIGH 8.2· Local · High privileges · No interaction · EPSS 0.00249 · Published 2022-07-02 · Fixed in 22.5.5 CWE-119
Priority LOW 34
NVIDIA DGX A100 SBIOS contains a vulnerability where a user may cause a dynamic variable evaluation by local access.
CVSS 3.1HIGH 7.5· Local · High privileges · No interaction · EPSS 0.00163 · Published 2024-01-12 · Fixed in 1.25 CWE-627
Priority LOW 33
NVIDIA DGX A100 SBIOS contains a vulnerability where a local attacker can cause input validation checks to be bypassed by causing an integer overflow.
CVSS 3.1HIGH 7.8· Local · Low privileges · No interaction · EPSS 0.00151 · Published 2024-01-12 · Fixed in 1.25 CWE-190
Priority LOW 33
NVIDIA DGX A100 BMC contains a vulnerability where an attacker may cause an LDAP user injection.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00488 · Published 2024-01-12 · Fixed in 00.22.05 CWE-90
Priority LOW 31
NVIDIA DGX A100 contains a vulnerability in SBIOS in the FsRecovery, which may allow a highly privileged local attacker to cause an out-of-bounds write, which may lead to code execution, denial of service, compromised in…
CVSS 3.1MEDIUM 6.7· Local · High privileges · No interaction · EPSS 0.00243 · Published 2023-01-13 · No fix listed CWE-787
Priority LOW 30
NVIDIA BMC contains a vulnerability in IPMI handler, where an unauthorized attacker can use certain oracles to guess a valid BMC username, which may lead to an information disclosure.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.0047 · Published 2023-01-13 · No fix listed CWE-208
Load more