deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-38532
Published: 2022-09-19
Description: Micro-Star International Co., Ltd MSI Center 1.0.50.0 was discovered to contain a vulnerability in the component C_Features of MSI.CentralServer.exe. This vulnerability allows attackers to escalate privileges via running a crafted executable.
CVSS Score: 7.8 (HIGH)
References: https://github.com/nam3lum/msi-central_privesc; https://github.com/nam3lum/msi-central_privesc
CVE: CVE-2022-38545
Published: 2022-09-19
Description: Valine v1.4.18 was discovered to contain a remote code execution (RCE) vulnerability which allows attackers to execute arbitrary code via a crafted POST request.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-79
References: https://github.com/xCss/Valine/issues/400; https://github.com/xCss/Valine/issues/400
CVE: CVE-2022-38550
Published: 2022-09-19
Description: A stored cross-site scripting (XSS) vulnerability in the /weibo/list component of Jeesns v2.0.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/Pick-program/JEESNS/issues/1; https://github.com/Pick-program/JEESNS/issues/1
CVE: CVE-2022-34746
Published: 2022-09-20
Description: An insufficient entropy vulnerability caused by the improper use of randomness sources with low entropy for RSA key pair generation was found in Zyxel GS1900 series firmware versions prior to V2.70. This vulnerability could allow an unauthenticated attacker to retrieve a private key by factoring the RSA modulus N in the certificate of the web administration interface.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-331, CWE-331
References: https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-insufficient-entropy-vulnerability-of-gs1900-series-switches; https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-insufficient-entropy-vulnerability-of-gs1900-series-switches
CVE: CVE-2022-2924
Published: 2022-09-20
Description: Cross-site Scripting (XSS) - Stored in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.3.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/yetiforcecompany/yetiforcecrm/commit/b716ecea340783b842498425faa029800bd30420; https://huntr.dev/bounties/f0f3aded-6e97-4cf2-980a-c90f2c6ca0e0; https://github.com/yetiforcecompany/yetiforcecrm/commit/b716ecea340783b842498425faa029800bd30420
CVE: CVE-2022-39955
Published: 2022-09-20
Description: The OWASP ModSecurity Core Rule Set (CRS) is affected by a partial rule set bypass by submitting a specially crafted HTTP Content-Type header field that indicates multiple character encoding schemes. A vulnerable back-end can potentially be exploited by declaring multiple Content-Type "charset" names and therefore bypassing the configurable CRS Content-Type header "charset" allow list. An encoded payload can bypass CRS detection this way and may then be decoded by the backend. The legacy CRS versions 3.0.x and 3.1.x are affected, as well as the currently supported versions 3.2.1 and 3.3.2. Integrators and users are advised to upgrade to 3.2.2 and 3.3.3 respectively.
CVSS Score: 7.3 (HIGH)
CWE: CWE-863
References: https://coreruleset.org/20220919/crs-version-3-3-3-and-3-2-2-covering-several-cves/; https://lists.debian.org/debian-lts-announce/2023/01/msg00033.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HL2L2GF7GOCWPMJZDUE5OXDSXHGG3XUJ/
CVE: CVE-2022-39956
Published: 2022-09-20
Description: The OWASP ModSecurity Core Rule Set (CRS) is affected by a partial rule set bypass for HTTP multipart requests by submitting a payload that uses a character encoding scheme via the Content-Type or the deprecated Content-Transfer-Encoding multipart MIME header fields that will not be decoded and inspected by the web application firewall engine and the rule set. The multipart payload will therefore bypass detection. A vulnerable backend that supports these encoding schemes can potentially be exploited. The legacy CRS versions 3.0.x and 3.1.x are affected, as well as the currently supported versions 3.2.1 and 3.3.2. Integrators and users are advised upgrade to 3.2.2 and 3.3.3 respectively. The mitigation against these vulnerabilities depends on the installation of the latest ModSecurity version (v2.9.6 / v3.0.8).
CVSS Score: 7.3 (HIGH)
CWE: CWE-863, CWE-116
References: https://coreruleset.org/20220919/crs-version-3-3-3-and-3-2-2-covering-several-cves/; https://lists.debian.org/debian-lts-announce/2023/01/msg00033.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HL2L2GF7GOCWPMJZDUE5OXDSXHGG3XUJ/
CVE: CVE-2022-39957
Published: 2022-09-20
Description: The OWASP ModSecurity Core Rule Set (CRS) is affected by a response body bypass. A client can issue an HTTP Accept header field containing an optional "charset" parameter in order to receive the response in an encoded form. Depending on the "charset", this response can not be decoded by the web application firewall. A restricted resource, access to which would ordinarily be detected, may therefore bypass detection. The legacy CRS versions 3.0.x and 3.1.x are affected, as well as the currently supported versions 3.2.1 and 3.3.2. Integrators and users are advised to upgrade to 3.2.2 and 3.3.3 respectively.
CVSS Score: 7.3 (HIGH)
CWE: CWE-693, CWE-116
References: https://coreruleset.org/20220919/crs-version-3-3-3-and-3-2-2-covering-several-cves/; https://lists.debian.org/debian-lts-announce/2023/01/msg00033.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HL2L2GF7GOCWPMJZDUE5OXDSXHGG3XUJ/
CVE: CVE-2022-39958
Published: 2022-09-20
Description: The OWASP ModSecurity Core Rule Set (CRS) is affected by a response body bypass to sequentially exfiltrate small and undetectable sections of data by repeatedly submitting an HTTP Range header field with a small byte range. A restricted resource, access to which would ordinarily be detected, may be exfiltrated from the backend, despite being protected by a web application firewall that uses CRS. Short subsections of a restricted resource may bypass pattern matching techniques and allow undetected access. The legacy CRS versions 3.0.x and 3.1.x are affected, as well as the currently supported versions 3.2.1 and 3.3.2. Integrators and users are advised to upgrade to 3.2.2 and 3.3.3 respectively and to configure a CRS paranoia level of 3 or higher.
CVSS Score: 7.5 (HIGH)
CWE: CWE-863, CWE-116
References: https://coreruleset.org/20220919/crs-version-3-3-3-and-3-2-2-covering-several-cves/; https://lists.debian.org/debian-lts-announce/2023/01/msg00033.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HL2L2GF7GOCWPMJZDUE5OXDSXHGG3XUJ/
CVE: CVE-2022-3000
Published: 2022-09-20
Description: Cross-site Scripting (XSS) - Stored in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.4.0.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/yetiforcecompany/yetiforcecrm/commit/eebc12601495ada38495076bec12841b2477516b; https://huntr.dev/bounties/a060d3dd-6fdd-4958-82a9-364df1cb770c; https://github.com/yetiforcecompany/yetiforcecrm/commit/eebc12601495ada38495076bec12841b2477516b
CVE: CVE-2022-34917
Published: 2022-09-20
Description: A security vulnerability has been identified in Apache Kafka. It affects all releases since 2.8.0. The vulnerability allows malicious unauthenticated clients to allocate large amounts of memory on brokers. This can lead to brokers hitting OutOfMemoryException and causing denial of service. Example scenarios: - Kafka cluster without authentication: Any clients able to establish a network connection to a broker can trigger the issue. - Kafka cluster with SASL authentication: Any clients able to establish a network connection to a broker, without the need for valid SASL credentials, can trigger the issue. - Kafka cluster with TLS authentication: Only clients able to successfully authenticate via TLS can trigger the issue. We advise the users to upgrade the Kafka installations to one of the 3.2.3, 3.1.2, 3.0.2, 2.8.2 versions.
CVSS Score: 7.5 (HIGH)
CWE: CWE-789, CWE-770
References: https://kafka.apache.org/cve-list; https://kafka.apache.org/cve-list
CVE: CVE-2022-3004
Published: 2022-09-20
Description: Cross-site Scripting (XSS) - Stored in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.4.0.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/yetiforcecompany/yetiforcecrm/commit/cd82ecce44d83f1f6c10c7766bf36f3026de024a; https://huntr.dev/bounties/461e5f8f-17cf-4be4-9149-111d0bd92d14; https://github.com/yetiforcecompany/yetiforcecrm/commit/cd82ecce44d83f1f6c10c7766bf36f3026de024a
CVE: CVE-2022-3079
Published: 2022-09-20
Description: Festo control block CPX-CEC-C1 and CPX-CMXX in multiple versions allow unauthenticated, remote access to critical webpage functions which may cause a denial of service.
CVSS Score: 7.5 (HIGH)
CWE: CWE-269
References: https://cert.vde.com/en/advisories/VDE-2022-036; https://cert.vde.com/en/advisories/VDE-2022-036
CVE: CVE-2022-2177
Published: 2022-09-20
Description: Kayrasoft product before version 2 has an unauthenticated SQL Injection vulnerability. This is fixed in version 2.
CVSS Score: 9.4 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://www.usom.gov.tr/bildirim/tr-22-0630; https://www.usom.gov.tr/bildirim/tr-22-0630
CVE: CVE-2022-3005
Published: 2022-09-20
Description: Cross-site Scripting (XSS) - Stored in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.4.0.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/yetiforcecompany/yetiforcecrm/commit/e[PII_REDACTED]9fe39951fc[PII_REDACTED]474a17884; https://huntr.dev/bounties/4b144433-a979-4c4e-a627-659838acc217; https://github.com/yetiforcecompany/yetiforcecrm/commit/e[PII_REDACTED]9fe39951fc[PII_REDACTED]474a17884
CVE: CVE-2022-3242
Published: 2022-09-20
Description: Code Injection in GitHub repository microweber/microweber prior to 1.3.2.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-94, CWE-79
References: https://github.com/microweber/microweber/commit/68f[PII_REDACTED]db865a5fa01c7986642c82e919c; https://huntr.dev/bounties/3e6b218a-a5a6-40d9-9f7e-5ab0c6214faf; https://github.com/microweber/microweber/commit/68f[PII_REDACTED]db865a5fa01c7986642c82e919c
CVE: CVE-2022-3245
Published: 2022-09-20
Description: HTML injection attack is closely related to Cross-site Scripting (XSS). HTML injection uses HTML to deface the page. XSS, as the name implies, injects JavaScript into the page. Both attacks exploit insufficient validation of user input.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-94, CWE-79
References: https://github.com/microweber/microweber/commit/f20abf30a1d9c1426c5fb757ac63998dc5b92bfc; https://huntr.dev/bounties/747c2924-95ca-4311-9e69-58ee0fb440a0; https://github.com/microweber/microweber/commit/f20abf30a1d9c1426c5fb757ac63998dc5b92bfc
CVE: CVE-2022-40955
Published: 2022-09-20
Description: In versions of Apache InLong prior to 1.3.0, an attacker with sufficient privileges to specify MySQL JDBC connection URL parameters and to write arbitrary data to the MySQL database, could cause this data to be deserialized by Apache InLong, potentially leading to Remote Code Execution on the Apache InLong server. Users are advised to upgrade to Apache InLong 1.3.0 or newer.
CVSS Score: 8.8 (HIGH)
CWE: CWE-502, CWE-502
References: http://www.openwall.com/lists/oss-security/2022/09/22/5; https://lists.apache.org/thread/r1r34y7bchrpmp9jhfdoohzdmk7pj1q1; http://www.openwall.com/lists/oss-security/2022/09/22/5
CVE: CVE-2021-33076
Published: 2022-09-20
Description: Improper authentication in firmware for some Intel(R) SSD DC Products may allow an unauthenticated user to potentially enable escalation of privilege via physical access.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-287, CWE-287
References: https://www.solidigm.com/content/dam/newco-aem-site/master/site/support/Solidigm%20SA-000563%20rev1.1.pdf; https://www.solidigm.com/content/dam/newco-aem-site/master/site/support/Solidigm%20SA-000563%20rev1.1.pdf
CVE: CVE-2021-33079
Published: 2022-09-20
Description: Protection mechanism failure in firmware for some Intel(R) SSD DC Products may allow a privileged user to potentially enable information disclosure via local access.
CVSS Score: 4.1 (MEDIUM)
CWE: CWE-693
References: https://www.solidigm.com/content/dam/newco-aem-site/master/site/support/Solidigm%20SA-000563%20rev1.1.pdf; https://www.solidigm.com/content/dam/newco-aem-site/master/site/support/Solidigm%20SA-000563%20rev1.1.pdf
CVE: CVE-2021-33081
Published: 2022-09-20
Description: Protection mechanism failure in firmware for some Intel(R) SSD DC Products may allow a privileged user to potentially enable information disclosure via local access.
CVSS Score: 7.9 (HIGH)
CWE: CWE-693
References: https://www.solidigm.com/content/dam/newco-aem-site/master/site/support/Solidigm%20SA-000563%20rev1.1.pdf; https://www.solidigm.com/content/dam/newco-aem-site/master/site/support/Solidigm%20SA-000563%20rev1.1.pdf
CVE: CVE-2022-32167
Published: 2022-09-20
Description: Cloudreve versions v1.0.0 through v3.5.3 are vulnerable to Stored Cross-Site Scripting (XSS), via the file upload functionality. A low privileged user will be able to share a file with an admin user, which could lead to privilege escalation.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.mend.io/vulnerability-database/CVE-2022-32167; https://www.mend.io/vulnerability-database/CVE-2022-32167
CVE: CVE-2022-35196
Published: 2022-09-20
Description: TestLink v1.9.20 was discovered to contain a Cross-Site Request Forgery (CSRF) via /lib/plan/planView.php.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352, CWE-352
References: https://github.com/HuangYuHsiangPhone/CVEs/; https://github.com/HuangYuHsiangPhone/CVEs/tree/main/TestLink/CVE-2022-35196; https://github.com/HuangYuHsiangPhone/CVEs/
CVE: CVE-2022-37204
Published: 2022-09-20
Description: Final CMS 5.1.0 is vulnerable to SQL Injection.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://github.com/AgainstTheLight/CVE-2022-37204/blob/main/README.md; https://github.com/AgainstTheLight/someEXP_of_jfinal_cms/blob/main/jfinal_cms/sql7.md; https://github.com/AgainstTheLight/CVE-2022-37204/blob/main/README.md
CVE: CVE-2022-38916
Published: 2022-09-20
Description: A file upload vulnerability exists in the storage feature of pagekit 1.0.18, which allows an attacker to upload malicious files
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434, CWE-434
References: https://github.com/pagekit/pagekit/issues/970; https://github.com/pagekit/pagekit/issues/970
CVE: CVE-2016-20015
Published: 2022-09-20
Description: In the ebuild package through smokeping-2.7.3-r1 for SmokePing on Gentoo, the initscript allows the smokeping user to gain ownership of any file, allowing for the smokeping user to gain root privileges. There is a race condition involving /var/lib/smokeping and chown.
CVSS Score: 7.5 (HIGH)
CWE: CWE-362
References: https://bugs.gentoo.org/602652; https://bugs.gentoo.org/602652
CVE: CVE-2017-20147
Published: 2022-09-20
Description: In the ebuild package through smokeping-2.7.3-r1 for SmokePing on Gentoo, the initscript uses a PID file that is writable by the smokeping user. By writing arbitrary PIDs to that file, the smokeping user can cause a denial of service to arbitrary PIDs when the service is stopped.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-377
References: https://bugs.gentoo.org/631140; https://security.gentoo.org/glsa/202209-08; https://bugs.gentoo.org/631140
CVE: CVE-2017-20148
Published: 2022-09-20
Description: In the ebuild package through logcheck-1.3.23.ebuild for Logcheck on Gentoo, it is possible to achieve root privilege escalation from the logcheck user because of insecure recursive chown calls.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-732
References: https://bugs.gentoo.org/630752; https://security.gentoo.org/glsa/202209-10; https://bugs.gentoo.org/630752
CVE: CVE-2022-26873
Published: 2022-09-20
Description: A potential attacker can execute an arbitrary code at the time of the PEI phase and influence the subsequent boot stages. This can lead to the mitigations bypassing, physical memory contents disclosure, discovery of any secrets from any Virtual Machines (VMs) and bypassing memory isolation and confidential computing boundaries. Additionally, an attacker can build a payload which can be injected into the SMRAM memory. This issue affects: Module name: PlatformInitAdvancedPreMem SHA256: 644044fdb8daea30a7820e0f5f88dbf5cd460af72fbf70418e9d2e47efed8d9b Module GUID: EEEE611D-F78F-4FB9-B868-55907F169280 This issue affects: AMI Aptio 5.x.
CVSS Score: 8.2 (HIGH)
CWE: CWE-121, CWE-787
References: https://www.ami.com/security-center/; https://www.binarly.io/advisories/BRLY-2022-027; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00712.html
CVE: CVE-2022-2154
Published: 2022-09-20
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2022-34345. Reason: This candidate is a reservation duplicate of CVE-2022-34345. Notes: All CVE users should reference CVE-2022-34345 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
CVE: CVE-2022-37205
Published: 2022-09-20
Description: JFinal CMS 5.1.0 is affected by: SQL Injection. These interfaces do not use the same component, nor do they have filters, but each uses its own SQL concatenation method, resulting in SQL injection.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89, CWE-89
References: https://github.com/AgainstTheLight/CVE-2022-37205/blob/main/README.md; https://github.com/AgainstTheLight/someEXP_of_jfinal_cms/blob/main/jfinal_cms/sql8.md; https://github.com/AgainstTheLight/CVE-2022-37205/blob/main/README.md
CVE: CVE-2022-37259
Published: 2022-09-20
Description: A Regular Expression Denial of Service (ReDoS) flaw was found in stealjs steal 2.2.4 via the string variable in babel.js.
CVSS Score: 7.5 (HIGH)
CWE: CWE-1333, CWE-1333
References: https://github.com/stealjs/steal/blob/c9dd1eb19ed3f97aeb93cf9dcea5d68ad5d0ced9/ext/babel.js#L54124; https://github.com/stealjs/steal/blob/c9dd1eb19ed3f97aeb93cf9dcea5d68ad5d0ced9/ext/babel.js#L54129; https://github.com/stealjs/steal/issues/1528
CVE: CVE-2022-37265
Published: 2022-09-20
Description: Prototype pollution vulnerability in stealjs steal 2.2.4 via the alias variable in babel.js.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-1321, CWE-1321
References: https://github.com/stealjs/steal/blob/c9dd1eb19ed3f97aeb93cf9dcea5d68ad5d0ced9/ext/babel.js#L4216; https://github.com/stealjs/steal/blob/c9dd1eb19ed3f97aeb93cf9dcea5d68ad5d0ced9/ext/babel.js#L4569; https://github.com/stealjs/steal/issues/1534
CVE: CVE-2022-38340
Published: 2022-09-20
Description: Safe Software FME Server v2021.2.5, v2022.0.0.2 and below was discovered to contain a Path Traversal vulnerability via the component fmedataupload.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-22, CWE-22
References: https://community.safe.com/s/article/Known-Issue-Arbitrary-file-upload-with-any-authenticated-FME-Server-account; https://community.safe.com/s/article/Known-Issue-FME-Server-vulnerability-with-arbitrary-path-traversal-and-file-upload; https://www.cycura.com/blog/safe-software-inc-fme-server-vulnerability-disclosure/
CVE: CVE-2022-38955
Published: 2022-09-20
Description: An exploitable firmware modification vulnerability was discovered on the Netgear WPN824EXT WiFi Range Extender. An attacker can conduct a MITM attack to modify the user-uploaded firmware image and bypass the CRC check. A successful attack can either introduce a backdoor to the device or make the device DoS. This affects Firmware Version: 1.1.1_1.1.9.
CVSS Score: 7.5 (HIGH)
CWE: CWE-354, CWE-354
References: https://hackmd.io/%40eupX2KdkT6iNpqJUWk9p4A/SyAnOSd1s; https://www.netgear.com/about/security/; https://hackmd.io/%40eupX2KdkT6iNpqJUWk9p4A/SyAnOSd1s
CVE: CVE-2022-38956
Published: 2022-09-20
Description: An exploitable firmware downgrade vulnerability was discovered on the Netgear WPN824EXT WiFi Range Extender. An attacker can conduct a MITM attack to replace the user-uploaded firmware image with an original old firmware image. This affects Firmware 1.1.1_1.1.9 and earlier.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-354, CWE-354
References: https://hackmd.io/%40eupX2KdkT6iNpqJUWk9p4A/SyAnOSd1s; https://www.netgear.com/about/security/; https://hackmd.io/%40eupX2KdkT6iNpqJUWk9p4A/SyAnOSd1s
CVE: CVE-2022-39974
Published: 2022-09-20
Description: WASM3 v0.5.0 was discovered to contain a segmentation fault via the component op_Select_i32_srs in wasm3/source/m3_exec.h.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119, CWE-119
References: https://github.com/wasm3/wasm3/issues/379; https://github.com/wasm3/wasm3/issues/379
CVE: CVE-2022-40246
Published: 2022-09-20
Description: A potential attacker can write one byte by arbitrary address at the time of the PEI phase (only during S3 resume boot mode) and influence the subsequent boot stages. This can lead to the mitigations bypassing, physical memory contents disclosure, discovery of any secrets from any Virtual Machines (VMs) and bypassing memory isolation and confidential computing boundaries. Additionally, an attacker can build a payload which can be injected into the SMRAM memory. This issue affects: Module name: SbPei SHA256: d827182e5f9b7a9ff0b9d3e232f7cfac43b5237e2681e11f005be627a49283a9 Module GUID: c1fbd624-27ea-40d1-aa48-94c3dc5c7e0d
CVSS Score: 7.2 (HIGH)
CWE: CWE-123, CWE-787
References: https://www.ami.com/security-center/; https://www.binarly.io/advisories/BRLY-2022-014; https://www.ami.com/security-center/
CVE: CVE-2022-40250
Published: 2022-09-20
Description: An attacker can exploit this vulnerability to elevate privileges from ring 0 to ring -2, execute arbitrary code in System Management Mode - an environment more privileged than operating system (OS) and completely isolated from it. Running arbitrary code in SMM additionally bypasses SMM-based SPI flash protections against modifications, which can help an attacker to install a firmware backdoor/implant into BIOS. Such a malicious firmware code in BIOS could persist across operating system re-installs. Additionally, this vulnerability potentially could be used by malicious actors to bypass security mechanisms provided by UEFI firmware (for example, Secure Boot and some types of memory isolation for hypervisors). This issue affects: Module name: SmmSmbiosElog SHA256: 3a8acb4f9bddccb19ec3b22b22ad[PII_REDACTED]0f76b27b606461cd5073a93b59 Module GUID: 8e61fd6b-7a8b-404f-b83f-aa90a47cabdf This issue affects: AMI Aptio 5.x. This issue affects: AMI Aptio 5.x.
CVSS Score: 8.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://www.ami.com/security-center/; https://www.binarly.io/advisories/BRLY-2022-016; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00712.html
CVE: CVE-2022-40261
Published: 2022-09-20
Description: An attacker can exploit this vulnerability to elevate privileges from ring 0 to ring -2, execute arbitrary code in System Management Mode - an environment more privileged than operating system (OS) and completely isolated from it. Running arbitrary code in SMM additionally bypasses SMM-based SPI flash protections against modifications, which can help an attacker to install a firmware backdoor/implant into BIOS. Such a malicious firmware code in BIOS could persist across operating system re-installs. Additionally, this vulnerability potentially could be used by malicious actors to bypass security mechanisms provided by UEFI firmware (for example, Secure Boot and some types of memory isolation for hypervisors). This issue affects: Module name: OverClockSmiHandler SHA256: a204699576e1a48ce915d9d9423380c8e4c197003baf9d17e6504f0265f3039c Module GUID: 4698C2BD-A903-410E-AD1F-5EEF3A1AE422
CVSS Score: 8.2 (HIGH)
CWE: CWE-120, CWE-120
References: https://www.ami.com/security-center/; https://www.binarly.io/advisories/BRLY-2022-003; https://www.ami.com/security-center/