Jesse Michael

A flaw was found in the bootloaders, allowing an attacker to bypass or tamper with Secure Boot protections. To load and execute arbitrary code in the pre-boot stage, an attacker needs to replace the existing signed bootloader with this one, requiring access to the EFI System Partition for booting using external media. The vulnerability is related to errors in security settings, which can be exploited to bypass existing security restrictions.

A flaw was found in Eurosoft bootloaders that allows an attacker to bypass or tamper with Secure Boot protections. To load and execute arbitrary code in the pre-boot stage, an attacker needs to replace the existing signed bootloader with this bootloader, requiring access to the EFI System Partition for booting using external media. Additionally, there is a security-feature bypass vulnerability that allows attackers to affect the system. A related issue concerns errors in security settings of the Crypto Pro bootloader in Windows, which can be exploited to bypass security restrictions and gain unauthorized access to the system.

A flaw was found in the bootloaders, allowing an attacker to bypass or tamper with Secure Boot protections. To load and execute arbitrary code in the pre-boot stage, an attacker needs to replace the existing signed bootloader with this one, requiring access to the EFI System Partition for booting using external media. The vulnerability is related to errors in security settings, which can be exploited to bypass existing security restrictions.

The Dell BIOSConnect feature contains a buffer overflow issue. An authenticated malicious admin user with local access to the system may potentially exploit this to run arbitrary code and bypass UEFI restrictions.

The Dell BIOSConnect feature contains a buffer overflow issue. An authenticated malicious admin user with local access to the system may potentially exploit this to run arbitrary code and bypass UEFI restrictions.

The Dell BIOSConnect feature contains a buffer overflow issue. An authenticated malicious admin user with local access to the system may potentially exploit this to run arbitrary code and bypass UEFI restrictions.

A flaw was found in GRUB2 that allows an attacker to hijack and tamper with the GRUB verification process, bypassing Secure Boot protections. This can be exploited to load an untrusted or modified kernel, potentially leading to arbitrary code execution within GRUB. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. An attacker would first need to establish access to the system, such as gaining physical access or obtaining remote access to a networked system with root access. With this access, an attacker could craft a string to cause a buffer overflow by injecting a malicious payload.

The issue allows low-privileged users to interact directly with physical memory by calling one of several driver routines that map physical memory into the virtual address space of the calling process. This could enable low-privileged users to achieve NT AUTHORITYSYSTEM privileges via a DeviceIoControl call associated with `MmMapIoSpace`, `IoAllocateMdl`, `MmBuildMdlForNonPagedPool`, or `MmMapLockedPages`.

The issue is related to improper access control in the Insyde software tools, which may allow an authenticated user to potentially enable escalation of privilege or information disclosure via local access. This is a software vulnerability and not a firmware issue.

The issue is related to insufficient access control in the hardware abstraction of the SEMA driver, which may allow an authenticated user to potentially enable escalation of privilege, denial of service, or information disclosure via local access.

The issue is related to insufficient access control in the Huawei PC Manager application, allowing an attacker to execute arbitrary code and write arbitrary files. Successful exploitation of this issue may cause the attacker to execute code and read or write information.

The issue is related to an information leak. Successful exploitation may allow an attacker to read information. The vulnerability is associated with a lack of protection for service data, which could enable an attacker to disclose protected information.

The issue is related to insufficient access control in the Huawei PCManager application, allowing for code execution. Successful exploitation may enable an attacker to execute code and read/write information, potentially leading to arbitrary file writing.

An issue with improper restriction of operations within the bounds of a memory buffer was found. This issue may allow an attacker to access and control memory, potentially enabling remote code execution on the baseband radio processor of the Telematics Control Unit (TCU). The vulnerability is related to the temporary mobile subscriber identity (TMSI).

The issue is related to insecure permissions for memory used by Adobe Flash Player when running on Linux, which could allow local users to gain privileges.