Vulnerabilities

Unvalidated memory boundary could result in arbitrary code execution.

UEFI BIOS embedded Shell could be used to bypass Secure Boot via shell commands or startup scripts.

HDD password plaintext is stored in a UEFI variable.

Error in handling the PlatformLangCodes UEFI variable could cause a buffer overflow, leading to resource exhaustion and failure.

An issue was discovered in SysPasswordDxe in Insyde InsydeH2O.

SMM IHISI command handler, FMTSWriteUseIntelLib, for FMTS command 0x32, read and write data without checking buffer size and could cause buffer overflow.

On ARM platforms, a vulnerability in the architecture design of HDD Password could allow an attacker to retrieve HDD Password from UEFI variables.

In an UEFI, Lack of verified boot to certain FV may cause arbitrary code execution.

The drivers in the tool packages use RTL_QUERY_REGISTRY_DIRECT flag to read a registry value to which an untrusted user-mode application may be able to cause a buffer overflow.

The drivers in the tool packages use RTL_QUERY_REGISTRY_DIRECT flag to read a registry value to which an untrusted user-mode application may be able to cause a buffer overflow.

The drivers in the tool packages use RTL_QUERY_REGISTRY_DIRECT flag to read a registry value to which an untrusted user-mode application may be able to cause a buffer overflow.

The drivers in the tool packages use RTL_QUERY_REGISTRY_DIRECT flag to read a registry value to which an untrusted user-mode application may be able to cause a buffer overflow.

Unchecked output buffer may allowed arbitrary code execution in SMM and potentially result in SMM memory corruption.

A buffer overflow vulnerability exists in the module SetupUtility.

Tcg2Smm has a vulnerability which can be used to write arbitrary memory inside SMRAM and execute arbitrary code at SMM level.

UsbCoreDxe has a vulnerability which can be used to write arbitrary memory inside SMRAM and execute arbitrary code at SMM level.

The vulnerability was identified in the code developed specifically for Lenovo.

The vulnerability was identified in the code developed specifically for Lenovo.

The vulnerability was identified in the code developed specifically for Lenovo.

The vulnerability was identified in the code developed specifically for Lenovo.

The vulnerability was identified in the code developed specifically for Lenovo.

The vulnerability was identified in the code developed specifically for Lenovo.

Improper input validation was discovered in UsbCoreDxe in Insyde InsydeH2O kernel 5.4 before 05.47.01, 5.5 before 05.55.01, 5.6 before 05.62.01, and 5.7 before 05.71.01.

A vulnerability in the digital signature verification process does not properly validate variable attributes which allows an attacker to bypass signature verification by creating a non-authenticated NVRAM variable.

An issue was discovered in Insyde InsydeH2O kernel 5.2 before version 05.29.50, kernel 5.3 before version 05.38.50, kernel 5.4 before version 05.46.50, kernel 5.5 before version 05.54.50, kernel 5.6 before version 05.61.…