Vulnerabilities (CVE)

Filtered by vendor Tianocore Subscribe
Filtered by product Edk2
Total 30 CVE
CVE Vendors Products Updated CVSS v2 CVSS v3
CVE-2023-45235 1 Tianocore 1 Edk2 2024-03-13 N/A 8.8 HIGH
EDK2's Network Package is susceptible to a buffer overflow vulnerability when handling Server ID option from a DHCPv6 proxy Advertise message. This vulnerability can be exploited by an attacker to gain unauthorized access and potentially lead to a loss of Confidentiality, Integrity and/or Availability.
CVE-2023-45234 1 Tianocore 1 Edk2 2024-03-13 N/A 8.8 HIGH
EDK2's Network Package is susceptible to a buffer overflow vulnerability when processing DNS Servers option from a DHCPv6 Advertise message. This vulnerability can be exploited by an attacker to gain unauthorized access and potentially lead to a loss of Confidentiality, Integrity and/or Availability.
CVE-2023-45233 1 Tianocore 1 Edk2 2024-03-13 N/A 7.5 HIGH
EDK2's Network Package is susceptible to an infinite lop vulnerability when parsing a PadN option in the Destination Options header of IPv6. This vulnerability can be exploited by an attacker to gain unauthorized access and potentially lead to a loss of Availability.
CVE-2023-45232 1 Tianocore 1 Edk2 2024-03-13 N/A 7.5 HIGH
EDK2's Network Package is susceptible to an infinite loop vulnerability when parsing unknown options in the Destination Options header of IPv6. This vulnerability can be exploited by an attacker to gain unauthorized access and potentially lead to a loss of Availability.
CVE-2023-45231 1 Tianocore 1 Edk2 2024-03-13 N/A 6.5 MEDIUM
EDK2's Network Package is susceptible to an out-of-bounds read vulnerability when processing  Neighbor Discovery Redirect message. This vulnerability can be exploited by an attacker to gain unauthorized access and potentially lead to a loss of Confidentiality.
CVE-2023-45230 1 Tianocore 1 Edk2 2024-03-13 N/A 8.8 HIGH
EDK2's Network Package is susceptible to a buffer overflow vulnerability via a long server ID option in DHCPv6 client. This vulnerability can be exploited by an attacker to gain unauthorized access and potentially lead to a loss of Confidentiality, Integrity and/or Availability.
CVE-2022-36765 1 Tianocore 1 Edk2 2024-03-13 N/A 7.8 HIGH
EDK2 is susceptible to a vulnerability in the CreateHob() function, allowing a user to trigger a integer overflow to buffer overflow via a local network. Successful exploitation of this vulnerability may result in a compromise of confidentiality, integrity, and/or availability.
CVE-2022-36764 1 Tianocore 1 Edk2 2024-03-13 N/A 7.8 HIGH
EDK2 is susceptible to a vulnerability in the Tcg2MeasurePeImage() function, allowing a user to trigger a heap buffer overflow via a local network. Successful exploitation of this vulnerability may result in a compromise of confidentiality, integrity, and/or availability.
CVE-2022-36763 1 Tianocore 1 Edk2 2024-03-13 N/A 7.8 HIGH
EDK2 is susceptible to a vulnerability in the Tcg2MeasureGptTable() function, allowing a user to trigger a heap buffer overflow via a local network. Successful exploitation of this vulnerability may result in a compromise of confidentiality, integrity, and/or availability.
CVE-2023-45237 1 Tianocore 1 Edk2 2024-03-07 N/A 7.5 HIGH
EDK2's Network Package is susceptible to a predictable TCP Initial Sequence Number. This vulnerability can be exploited by an attacker to gain unauthorized access and potentially lead to a loss of Confidentiality.
CVE-2023-45236 1 Tianocore 1 Edk2 2024-03-07 N/A 7.5 HIGH
EDK2's Network Package is susceptible to a predictable TCP Initial Sequence Number. This vulnerability can be exploited by an attacker to gain unauthorized access and potentially lead to a loss of Confidentiality.
CVE-2023-45229 1 Tianocore 1 Edk2 2024-03-07 N/A 6.5 MEDIUM
EDK2's Network Package is susceptible to an out-of-bounds read vulnerability when processing the IA_NA or IA_TA option in a DHCPv6 Advertise message. This vulnerability can be exploited by an attacker to gain unauthorized access and potentially lead to a loss of Confidentiality.
CVE-2021-38578 2 Insyde, Tianocore 2 Kernel, Edk2 2023-12-10 7.5 HIGH 9.8 CRITICAL
Existing CommBuffer checks in SmmEntryPoint will not catch underflow when computing BufferSize.
CVE-2021-38575 2 Insyde, Tianocore 2 Kernel, Edk2 2023-12-10 6.8 MEDIUM 8.1 HIGH
NetworkPkg/IScsiDxe has remotely exploitable buffer overflows.
CVE-2021-38576 1 Tianocore 1 Edk2 2023-12-10 7.8 HIGH 7.5 HIGH
A BIOS bug in firmware for a particular PC model leaves the Platform authorization value empty. This can be used to permanently brick the TPM in multiple ways, as well as to non-permanently DoS the system.
CVE-2021-28213 1 Tianocore 1 Edk2 2023-12-10 5.0 MEDIUM 7.5 HIGH
Example EDK2 encrypted private key in the IpSecDxe.efi present potential security risks.
CVE-2019-14584 1 Tianocore 1 Edk2 2023-12-10 4.6 MEDIUM 7.8 HIGH
Null pointer dereference in Tianocore EDK2 may allow an authenticated user to potentially enable escalation of privilege via local access.
CVE-2021-28210 1 Tianocore 1 Edk2 2023-12-10 4.6 MEDIUM 7.8 HIGH
An unlimited recursion in DxeCore in EDK II.
CVE-2021-28211 1 Tianocore 1 Edk2 2023-12-10 4.6 MEDIUM 6.7 MEDIUM
A heap overflow in LzmaUefiDecompressGetInfo function in EDK II.
CVE-2019-14563 2 Debian, Tianocore 2 Debian Linux, Edk2 2023-12-10 4.6 MEDIUM 7.8 HIGH
Integer truncation in EDK II may allow an authenticated user to potentially enable escalation of privilege via local access.