Logo
-

Byte Open Security

(ByteOS Network)

Log In

Sign Up

ByteOS

Security
Vulnerability Details
Registries
Custom Views
Weaknesses
Attack Patterns
Filters & Tools
Vulnerability Details :

CVE-2024-38483

Summary
Assigner-dell
Assigner Org ID-c550e75a-17ff-4988-97f0-544cde3820fe
Published At-14 Aug, 2024 | 09:24
Updated At-15 Aug, 2024 | 14:24
Rejected At-
Credits

Dell BIOS contains an Improper Input Validation vulnerability in an externally developed component. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Code execution.

Vendors
-
Not available
Products
-
Metrics (CVSS)
VersionBase scoreBase severityVector
Weaknesses
Attack Patterns
Solution/Workaround
References
HyperlinkResource Type
EPSS History
Score
Latest Score
-
N/A
No data available for selected date range
Percentile
Latest Percentile
-
N/A
No data available for selected date range
Stakeholder-Specific Vulnerability Categorization (SSVC)
▼Common Vulnerabilities and Exposures (CVE)
cve.org
Assigner:dell
Assigner Org ID:c550e75a-17ff-4988-97f0-544cde3820fe
Published At:14 Aug, 2024 | 09:24
Updated At:15 Aug, 2024 | 14:24
Rejected At:
▼CVE Numbering Authority (CNA)

Dell BIOS contains an Improper Input Validation vulnerability in an externally developed component. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Code execution.

Affected Products
Vendor
Dell Inc.Dell
Product
Dell Client Platform BIOS
Default Status
unaffected
Versions
Affected
  • From N/A before 1.35.0 (semver)
  • From N/A before 2.32.0 (semver)
  • From N/A before 1.26.0 (semver)
Problem Types
TypeCWE IDDescription
CWECWE-20CWE-20: Improper Input Validation
Type: CWE
CWE ID: CWE-20
Description: CWE-20: Improper Input Validation
Metrics
VersionBase scoreBase severityVector
3.15.8MEDIUM
CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:L
Version: 3.1
Base score: 5.8
Base severity: MEDIUM
Vector:
CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:L
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions

Configurations

Workarounds

Exploits

Credits

finder
CVE-2024-38483: Dell Technologies would like to thank codebreaker1337 for reporting this issue.
Timeline
EventDate
Replaced By

Rejected Reason

References
HyperlinkResource
https://www.dell.com/support/kbdoc/en-us/000225776/dsa-2024-260
vendor-advisory
Hyperlink: https://www.dell.com/support/kbdoc/en-us/000225776/dsa-2024-260
Resource:
vendor-advisory
▼Authorized Data Publishers (ADP)
CISA ADP Vulnrichment
Affected Products
Vendor
Dell Inc.dell
Product
latitude_5290_2-in-1_firmware
CPEs
  • cpe:2.3:o:dell:latitude_5290_2-in-1_firmware:-:*:*:*:*:*:*:*
Default Status
unknown
Versions
Affected
  • From 0 before 1.35.0 (custom)
Vendor
Dell Inc.dell
Product
precision_3420_tower_firmware
CPEs
  • cpe:2.3:o:dell:precision_3420_tower_firmware:-:*:*:*:*:*:*:*
Default Status
unknown
Versions
Affected
  • From 0 before 2.32.0 (custom)
Vendor
Dell Inc.dell
Product
precision_3620_tower_firmware
CPEs
  • cpe:2.3:o:dell:precision_3620_tower_firmware:-:*:*:*:*:*:*:*
Default Status
unknown
Versions
Affected
  • From 0 before 2.32.0 (custom)
Vendor
Dell Inc.dell
Product
wyse_7040_thin_client_firmware
CPEs
  • cpe:2.3:o:dell:wyse_7040_thin_client_firmware:-:*:*:*:*:*:*:*
Default Status
unknown
Versions
Affected
  • From 0 before 1.26.0 (custom)
Metrics
VersionBase scoreBase severityVector
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions

Configurations

Workarounds

Exploits

Credits

Timeline
EventDate
Replaced By

Rejected Reason

References
HyperlinkResource
Information is not available yet
▼National Vulnerability Database (NVD)
nvd.nist.gov
Source:security_alert@emc.com
Published At:14 Aug, 2024 | 10:15
Updated At:18 Sep, 2024 | 19:19

Dell BIOS contains an Improper Input Validation vulnerability in an externally developed component. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Code execution.

CISA Catalog
Date AddedDue DateVulnerability NameRequired Action
N/A
Date Added: N/A
Due Date: N/A
Vulnerability Name: N/A
Required Action: N/A
Metrics
TypeVersionBase scoreBase severityVector
Primary3.16.7MEDIUM
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Secondary3.15.8MEDIUM
CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:L
Type: Primary
Version: 3.1
Base score: 6.7
Base severity: MEDIUM
Vector:
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Type: Secondary
Version: 3.1
Base score: 5.8
Base severity: MEDIUM
Vector:
CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:L
CPE Matches

Dell Inc.
dell
>>latitude_5290_2-in-1_firmware>>Versions before 1.35.0(exclusive)
cpe:2.3:o:dell:latitude_5290_2-in-1_firmware:*:*:*:*:*:*:*:*
Dell Inc.
dell
>>latitude_5290_2-in-1>>-
cpe:2.3:h:dell:latitude_5290_2-in-1:-:*:*:*:*:*:*:*
Dell Inc.
dell
>>precision_3420_tower_firmware>>Versions before 2.32.0(exclusive)
cpe:2.3:o:dell:precision_3420_tower_firmware:*:*:*:*:*:*:*:*
Dell Inc.
dell
>>precision_3420>>-
cpe:2.3:h:dell:precision_3420:-:*:*:*:*:*:*:*
Dell Inc.
dell
>>precision_3620_firmware>>Versions before 2.32.0(exclusive)
cpe:2.3:o:dell:precision_3620_firmware:*:*:*:*:*:*:*:*
Dell Inc.
dell
>>precision_3620_tower>>-
cpe:2.3:h:dell:precision_3620_tower:-:*:*:*:*:*:*:*
Dell Inc.
dell
>>wyse_7040_thin_client_firmware>>Versions before 1.26.0(exclusive)
cpe:2.3:o:dell:wyse_7040_thin_client_firmware:*:*:*:*:*:*:*:*
Dell Inc.
dell
>>wyse_7040_thin_client>>-
cpe:2.3:h:dell:wyse_7040_thin_client:-:*:*:*:*:*:*:*
Dell Inc.
dell
>>precision_7720_firmware>>Versions before 1.37.0(exclusive)
cpe:2.3:o:dell:precision_7720_firmware:*:*:*:*:*:*:*:*
Dell Inc.
dell
>>precision_7720>>-
cpe:2.3:h:dell:precision_7720:-:*:*:*:*:*:*:*
Dell Inc.
dell
>>precision_7520_firmware>>1.37.0
cpe:2.3:o:dell:precision_7520_firmware:1.37.0:*:*:*:*:*:*:*
Dell Inc.
dell
>>precision_7520>>-
cpe:2.3:h:dell:precision_7520:-:*:*:*:*:*:*:*
Dell Inc.
dell
>>precision_5530_2-in-1_firmware>>Versions before 1.32.8(exclusive)
cpe:2.3:o:dell:precision_5530_2-in-1_firmware:*:*:*:*:*:*:*:*
Dell Inc.
dell
>>precision_5530_2-in-1>>-
cpe:2.3:h:dell:precision_5530_2-in-1:-:*:*:*:*:*:*:*
Dell Inc.
dell
>>precision_5520_firmware>>Versions before 1.39.0(exclusive)
cpe:2.3:o:dell:precision_5520_firmware:*:*:*:*:*:*:*:*
Dell Inc.
dell
>>precision_5520>>-
cpe:2.3:h:dell:precision_5520:-:*:*:*:*:*:*:*
Dell Inc.
dell
>>precision_3520_firmware>>Versions before 1.37.0(exclusive)
cpe:2.3:o:dell:precision_3520_firmware:*:*:*:*:*:*:*:*
Dell Inc.
dell
>>precision_3520>>-
cpe:2.3:h:dell:precision_3520:-:*:*:*:*:*:*:*
Dell Inc.
dell
>>optiplex_7450_all-in-one_firmware>>Versions before 1.34.0(exclusive)
cpe:2.3:o:dell:optiplex_7450_all-in-one_firmware:*:*:*:*:*:*:*:*
Dell Inc.
dell
>>optiplex_7450_all-in-one>>-
cpe:2.3:h:dell:optiplex_7450_all-in-one:-:*:*:*:*:*:*:*
Dell Inc.
dell
>>optiplex_5050_firmware>>Versions before 1.31.0(exclusive)
cpe:2.3:o:dell:optiplex_5050_firmware:*:*:*:*:*:*:*:*
Dell Inc.
dell
>>optiplex_5050>>-
cpe:2.3:h:dell:optiplex_5050:-:*:*:*:*:*:*:*
Dell Inc.
dell
>>optiplex_3050_all-in-one_firmware>>Versions before 1.34.0(exclusive)
cpe:2.3:o:dell:optiplex_3050_all-in-one_firmware:*:*:*:*:*:*:*:*
Dell Inc.
dell
>>optiplex_3050_all-in-one>>-
cpe:2.3:h:dell:optiplex_3050_all-in-one:-:*:*:*:*:*:*:*
Dell Inc.
dell
>>optiplex_3050_firmware>>Versions before 1.31.0(exclusive)
cpe:2.3:o:dell:optiplex_3050_firmware:*:*:*:*:*:*:*:*
Dell Inc.
dell
>>optiplex_3050>>-
cpe:2.3:h:dell:optiplex_3050:-:*:*:*:*:*:*:*
Dell Inc.
dell
>>latitude_7490_firmware>>Versions before 1.39.0(exclusive)
cpe:2.3:o:dell:latitude_7490_firmware:*:*:*:*:*:*:*:*
Dell Inc.
dell
>>latitude_7490>>-
cpe:2.3:h:dell:latitude_7490:-:*:*:*:*:*:*:*
Dell Inc.
dell
>>latitude_7480_firmware>>Versions before 1.38.0(exclusive)
cpe:2.3:o:dell:latitude_7480_firmware:*:*:*:*:*:*:*:*
Dell Inc.
dell
>>latitude_7480>>-
cpe:2.3:h:dell:latitude_7480:-:*:*:*:*:*:*:*
Dell Inc.
dell
>>latitude_7424_rugged_extreme_firmware>>Versions before 1.34.0(exclusive)
cpe:2.3:o:dell:latitude_7424_rugged_extreme_firmware:*:*:*:*:*:*:*:*
Dell Inc.
dell
>>latitude_7424_rugged_extreme>>-
cpe:2.3:h:dell:latitude_7424_rugged_extreme:-:*:*:*:*:*:*:*
Dell Inc.
dell
>>latitude_7414_rugged_firmware>>Versions before 1.47.0(exclusive)
cpe:2.3:o:dell:latitude_7414_rugged_firmware:*:*:*:*:*:*:*:*
Dell Inc.
dell
>>latitude_7414_rugged>>-
cpe:2.3:h:dell:latitude_7414_rugged:-:*:*:*:*:*:*:*
Dell Inc.
dell
>>latitude_7390_2-in-1_firmware>>Versions before 1.36.0(exclusive)
cpe:2.3:o:dell:latitude_7390_2-in-1_firmware:*:*:*:*:*:*:*:*
Dell Inc.
dell
>>latitude_7390_2-in-1>>-
cpe:2.3:h:dell:latitude_7390_2-in-1:-:*:*:*:*:*:*:*
Dell Inc.
dell
>>latitude_7390_firmware>>Versions before 1.39.0(exclusive)
cpe:2.3:o:dell:latitude_7390_firmware:*:*:*:*:*:*:*:*
Dell Inc.
dell
>>latitude_7390>>-
cpe:2.3:h:dell:latitude_7390:-:*:*:*:*:*:*:*
Dell Inc.
dell
>>latitude_7380_firmware>>Versions before 1.38.0(exclusive)
cpe:2.3:o:dell:latitude_7380_firmware:*:*:*:*:*:*:*:*
Dell Inc.
dell
>>latitude_7380>>-
cpe:2.3:h:dell:latitude_7380:-:*:*:*:*:*:*:*
Dell Inc.
dell
>>latitude_7290_firmware>>Versions before 1.39.0(exclusive)
cpe:2.3:o:dell:latitude_7290_firmware:*:*:*:*:*:*:*:*
Dell Inc.
dell
>>latitude_7290>>-
cpe:2.3:h:dell:latitude_7290:-:*:*:*:*:*:*:*
Dell Inc.
dell
>>latitude_7285_2-in-1_firmware>>Versions before 1.27.0(exclusive)
cpe:2.3:o:dell:latitude_7285_2-in-1_firmware:*:*:*:*:*:*:*:*
Dell Inc.
dell
>>latitude_7285_2-in-1>>-
cpe:2.3:h:dell:latitude_7285_2-in-1:-:*:*:*:*:*:*:*
Dell Inc.
dell
>>latitude_7280_firmware>>Versions before 1.38.0(exclusive)
cpe:2.3:o:dell:latitude_7280_firmware:*:*:*:*:*:*:*:*
Dell Inc.
dell
>>latitude_7280>>-
cpe:2.3:h:dell:latitude_7280:-:*:*:*:*:*:*:*
Dell Inc.
dell
>>latitude_7212_rugged_extreme_tablet_firmware>>Versions before 1.51.0(exclusive)
cpe:2.3:o:dell:latitude_7212_rugged_extreme_tablet_firmware:*:*:*:*:*:*:*:*
Dell Inc.
dell
>>latitude_7212_rugged_extreme_tablet>>-
cpe:2.3:h:dell:latitude_7212_rugged_extreme_tablet:-:*:*:*:*:*:*:*
Dell Inc.
dell
>>latitude_5590_firmware>>Versions before 1.36.0(exclusive)
cpe:2.3:o:dell:latitude_5590_firmware:*:*:*:*:*:*:*:*
Dell Inc.
dell
>>latitude_5590>>-
cpe:2.3:h:dell:latitude_5590:-:*:*:*:*:*:*:*
Weaknesses
CWE IDTypeSource
NVD-CWE-noinfoPrimarynvd@nist.gov
CWE-20Secondarysecurity_alert@emc.com
CWE ID: NVD-CWE-noinfo
Type: Primary
Source: nvd@nist.gov
CWE ID: CWE-20
Type: Secondary
Source: security_alert@emc.com
Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References
HyperlinkSourceResource
https://www.dell.com/support/kbdoc/en-us/000225776/dsa-2024-260security_alert@emc.com
Vendor Advisory
Hyperlink: https://www.dell.com/support/kbdoc/en-us/000225776/dsa-2024-260
Source: security_alert@emc.com
Resource:
Vendor Advisory

Change History

0
Information is not available yet

Similar CVEs

333Records found

CVE-2023-22449
Matching Score-4
Assigner-Intel Corporation
ShareView Details
Matching Score-4
Assigner-Intel Corporation
CVSS Score-7.5||HIGH
EPSS-0.03% / 6.76%
||
7 Day CHG~0.00%
Published-11 Aug, 2023 | 02:37
Updated-09 Oct, 2024 | 17:32
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Improper input validation in some Intel(R) NUC BIOS firmware may allow a privileged user to potentially enable escalation of privilege via local access.

Action-Not Available
Vendor-n/aIntel Corporation
Product-nuc_pro_board_nuc12wsbi70znuc_13_extreme_compute_element_nuc13sbbi9_firmwarenuc_laptop_kit_lapkc51e_firmwarenuc_pro_board_nuc11tnhv50lnuc_12_compute_element_elm12hbc_firmwarenuc_pro_ki_nuc11tnkv5_firmwarenuc_pro_kit_nuc12wshi30l_firmwarenuc_pro_mini_pc_nuc11tnkv50z_firmwarenuc_laptop_kit_lapkc71e_firmwarenuc_13_extreme_kit_nuc13rngi7nuc_13_extreme_compute_element_nuc13sbbi5nuc_laptop_kit_lapbc710_firmwarenuc_pro_ki_nuc11tnkv50znuc_pro_board_nuc12wshi7nuc_pro_board_nuc12wsbi5_firmwarenuc_11_performance_mini_pc_nuc11pahi3nuc_pro_ki_nuc11tnbv7nuc_pro_board_nuc12wshi70z_firmwarenuc_pro_board_nuc12wski70z_firmwarenuc_boards_nuc11tnhi70l_firmwarenuc_13_extreme_compute_element_nuc13sbbi7fnuc_boards_nuc11tnbi30z_firmwarenuc_pro_mini_pc_nuc11tnkv7_firmwarenuc_11_performance_mini_pc_nuc11paki3nuc_13_extreme_compute_element_nuc13sbbi5_firmwarenuc_pro_ki_nuc11tnkv50z_firmwarenuc_11_performance_mini_pc_nuc11paki7_firmwarenuc_laptop_kits_lapac71g_firmwarenuc_11_performance_kit_nuc11pahi30znuc_pro_board_nuc12wsbi50z_firmwarenuc_11_performance_kit_nuc11pahi30z_firmwarenuc_11_compute_element_cm11ebc4w_firmwarenuc_pro_board_nuc12wshi30z_firmwarenuc_boards_nuc11tnbi50znuc_boards_nuc11tnhi70znuc_pro_kit_nuc12wsbi5_firmwarenuc_essential_nuc11atbc4_firmwarenuc_pro_mini_pc_nuc11tnbv7nuc_boards_nuc11tnki30z_firmwarenuc_pro_kit_nuc12wsbi70znuc_pro_board_nuc11tnkv50znuc_boards_nuc11tnki30znuc_pro_kit_nuc12wsbi5nuc_enthusiast_nuc12snki72nuc_boards_nuc11tnki50z_firmwarenuc_11_performance_mini_pc_nuc11paki3_firmwarenuc_extreme_nuc12dcmi9_firmwarenuc_11_performance_mini_pc_nuc11pahi7nuc_13_extreme_kit_nuc13rngi7_firmwarenuc_enthusiast_nuc12snki72vanuc_boards_nuc11tnki50znuc_pro_kit_nuc12wshi50znuc_pro_ki_nuc11tnhv7nuc_pro_board_nuc11tnbv7_firmwarenuc_pro_kit_nuc12wski50z_firmwarenuc_11_performance_mini_pc_nuc11paqi70qanuc_boards_nuc11tnki5nuc_pro_board_nuc12wski7nuc_essential_nuc11atkc2nuc_boards_nuc11tnhi50znuc_pro_board_nuc12wsbi3nuc_boards_nuc11tnbi5_firmwarenuc_11_performance_mini_pc_nuc11paki7nuc_boards_nuc11tnki7nuc_pro_board_nuc12wsbi70z_firmwarenuc_laptop_kit_lapbc710nuc_11_performance_mini_pc_nuc11pahi7_firmwarenuc_pro_kit_nuc12wshi30znuc_11_performance_kit_nuc11paqi50wanuc_pro_mini_pc_nuc11tnhv5_firmwarenuc_13_extreme_compute_element_nuc13sbbi7_firmwarenuc_laptop_kit_lapkc71fnuc_11_performance_mini_pc_nuc11pahi50znuc_pro_mini_pc_nuc11tnhv70lnuc_11_performance_kit_nuc11pahi3_firmwarenuc_pro_board_nuc12wsbi30znuc_essential_nuc11atkc2_firmwarenuc_laptop_kit_lapbc510_firmwarenuc_pro_ki_nuc11tnhv70l_firmwarenuc_boards_nuc11tnki3_firmwarenuc_11_compute_element_cm11ebi58wnuc_boards_nuc11tnbi30znuc_13_extreme_kit_nuc13rngi9_firmwarenuc_11_performance_mini_pc_nuc11pahi70z_firmwarenuc_12_compute_element_elm12hbcnuc_essential_nuc11atkpenuc_boards_nuc11tnhi30l_firmwarenuc_11_performance_mini_pc_nuc11pahi70znuc_boards_nuc11tnhi30z_firmwarenuc_11_performance_mini_pc_nuc11paqi70qa_firmwarenuc_boards_nuc11tnhi3nuc_pro_board_nuc12wshi5_firmwarenuc_laptop_kit_lapkc51enuc_11_performance_kit_nuc11pahi50znuc_pro_board_nuc12wshi30lnuc_pro_kit_nuc12wsbi3nuc_boards_nuc11tnhi50z_firmwarenuc_boards_nuc11tnhi7_firmwarenuc_pro_board_nuc11tnbv5nuc_laptop_kit_laprc710_firmwarenuc_pro_board_nuc12wshi3nuc_pro_board_nuc12wsbi50znuc_pro_board_nuc11tnhv7_firmwarenuc_pro_kit_nuc12wski70z_firmwarenuc_essential_nuc11atkc4nuc_11_performance_mini_pc_nuc11pahi50z_firmwarenuc_13_extreme_kit_nuc13rngi9nuc_11_compute_element_cm11ebi38w_firmwarenuc_11_performance_kit_nuc11paki3_firmwarenuc_11_performance_mini_pc_nuc11pahi5nuc_pro_kit_nuc12wski7nuc_12_compute_element_elm12hbi3nuc_pro_ki_nuc11tnhv5_firmwarenuc_boards_nuc11tnki70znuc_11_compute_element_cm11ebi38wnuc_boards_nuc11tnhi3_firmwarenuc_13_extreme_compute_element_nuc13sbbi7f_firmwarenuc_12_compute_element_elm12hbi5nuc_pro_board_nuc12wshi7_firmwarenuc_11_performance_kit_nuc11paki7nuc_pro_ki_nuc11tnbv5nuc_11_performance_kit_nuc11pahi70znuc_pro_ki_nuc11tnhv5nuc_pro_board_nuc11tnkv5_firmwarenuc_boards_nuc11tnbi7_firmwarenuc_boards_nuc11tnhi50lnuc_pro_kit_nuc12wski7_firmwarenuc_boards_nuc11tnhi30p_firmwarenuc_pro_mini_pc_nuc11tnhv7_firmwarenuc_boards_nuc11tnki7_firmwarenuc_boards_nuc11tnhi70q_firmwarenuc_pro_board_nuc12wski5_firmwarenuc_pro_kit_nuc12wski30znuc_laptop_kit_lapkc71enuc_pro_board_nuc12wshi50znuc_11_performance_mini_pc_nuc11paki5nuc_11_compute_element_cm11ebi716wnuc_extreme_nuc12dcmi7_firmwarenuc_pro_board_nuc12wshi30znuc_pro_ki_nuc11tnhv70lnuc_pro_kit_nuc12wski70znuc_pro_board_nuc12wski3_firmwarenuc_pro_mini_pc_nuc11tnkv5_firmwarenuc_pro_kit_nuc12wshi5_firmwarenuc_12_extreme_compute_element_nuc12dcmi9_firmwarenuc_laptop_kit_laprc510_firmwarenuc_pro_board_nuc11tnhv50l_firmwarenuc_pro_kit_nuc12wski3nuc_pro_ki_nuc11tnhv50l_firmwarenuc_pro_mini_pc_nuc11tnbv7_firmwarenuc_boards_nuc11tnki5_firmwarenuc_pro_kit_nuc12wski3_firmwarenuc_pro_kit_nuc12wsbi3_firmwarenuc_extreme_compute_element_nuc11dbbi9nuc_nuc11phki7cnuc_pro_mini_pc_nuc11tnbv5_firmwarenuc_extreme_compute_element_nuc11dbbi7nuc_11_performance_mini_pc_nuc11pahi5_firmwarenuc_13_extreme_compute_element_nuc13sbbi9fnuc_11_performance_kit_nuc11pahi3nuc_nuc11phki7c_firmwarenuc_13_extreme_compute_element_nuc13sbbi9f_firmwarenuc_pro_board_nuc11tnkv50z_firmwarenuc_11_performance_kit_nuc11pahi50z_firmwarenuc_pro_board_nuc12wshi70znuc_pro_board_nuc12wski30z_firmwarenuc_essential_nuc11atkc4_firmwarenuc_boards_nuc11tnhi50w_firmwarenuc_13_extreme_compute_element_nuc13sbbi5f_firmwarenuc_boards_nuc11tnhi70lnuc_12_extreme_compute_element_nuc12dcmi7nuc_boards_nuc11tnhi50l_firmwarenuc_extreme_nuc12dcmi7nuc_pro_board_nuc12wshi30l_firmwarenuc_boards_nuc11tnhi30znuc_extreme_nuc12edbi7_firmwarenuc_12_extreme_compute_element_nuc12edbi9_firmwarenuc_pro_kit_nuc12wsbi50znuc_11_performance_kit_nuc11paqi50wa_firmwarenuc_pro_board_nuc11tnbv5_firmwarenuc_13_extreme_kit_nuc13rngi5nuc_pro_kit_nuc12wshi7_firmwarenuc_pro_kit_nuc12wshi7nuc_laptop_kit_lapbc510nuc_extreme_compute_element_nuc11dbbi9_firmwarenuc_pro_mini_pc_nuc11tnhv50lnuc_boards_nuc11tnbi7nuc_pro_ki_nuc11tnkv7_firmwarenuc_11_performance_kit_nuc11paki5_firmwarenuc_boards_nuc11tnhi30lnuc_pro_kit_nuc12wski30z_firmwarenuc_pro_ki_nuc11tnbv5_firmwarenuc_pro_ki_nuc11tnkv7nuc_essential_nuc11atkpe_firmwarenuc_pro_board_nuc12wsbi3_firmwarenuc_pro_kit_nuc12wshi5nuc_pro_board_nuc12wski50z_firmwarenuc_extreme_compute_element_nuc11btmi7nuc_extreme_nuc12edbi7nuc_pro_kit_nuc12wski5nuc_boards_nuc11tnhi7nuc_pro_mini_pc_nuc11tnhv7nuc_11_performance_kit_nuc11pahi5_firmwarenuc_pro_board_nuc12wski3nuc_12_extreme_compute_element_nuc12edbi7_firmwarenuc_12_compute_element_elm12hbi5_firmwarenuc_pro_kit_nuc12wshi50z_firmwarenuc_pro_mini_pc_nuc11tnbv5nuc_pro_board_nuc11tnkv7_firmwarenuc_boards_nuc11tnbi50z_firmwarenuc_11_performance_kit_nuc11paki3nuc_12_compute_element_elm12hbi7nuc_13_extreme_compute_element_nuc13sbbi5fnuc_pro_kit_nuc12wshi3nuc_11_performance_mini_pc_nuc11pahi30z_firmwarenuc_boards_nuc11tnhi70z_firmwarenuc_11_performance_kit_nuc11paqi70qanuc_pro_board_nuc11tnkv7nuc_nuc11phki7caa_firmwarenuc_pro_board_nuc12wski30znuc_boards_nuc11tnbi3_firmwarenuc_boards_nuc11tnhi5nuc_pro_ki_nuc11tnhv50lnuc_pro_board_nuc11tnhv5_firmwarenuc_11_performance_mini_pc_nuc11pahi3_firmwarenuc_pro_ki_nuc11tnhv7_firmwarenuc_extreme_nuc12dcmi9nuc_boards_nuc11tnhi50wnuc_13_extreme_compute_element_nuc13sbbi9nuc_boards_nuc11tnbi70z_firmwarenuc_pro_ki_nuc11tnbv7_firmwarenuc_extreme_compute_element_nuc11btmi9_firmwarenuc_enthusiast_nuc12snki72va_firmwarenuc_pro_mini_pc_nuc11tnhv5nuc_boards_nuc11tnki3nuc_pro_board_nuc12wski50znuc_11_performance_kit_nuc11paqi70qa_firmwarenuc_11_performance_mini_pc_nuc11paqi50wanuc_boards_nuc11tnki70z_firmwarenuc_pro_kit_nuc12wsbi50z_firmwarenuc_11_performance_kit_nuc11paki7_firmwarenuc_11_performance_mini_pc_nuc11paqi50wa_firmwarenuc_pro_kit_nuc12wshi70z_firmwarenuc_11_performance_kit_nuc11pahi7nuc_pro_board_nuc12wski70znuc_laptop_kits_lapac71gnuc_pro_mini_pc_nuc11tnhv50l_firmwarenuc_laptop_kit_laprc510nuc_pro_board_nuc11tnbv7nuc_11_compute_element_cm11ebc4wnuc_pro_board_nuc12wski7_firmwarenuc_pro_mini_pc_nuc11tnkv5nuc_pro_kit_nuc12wshi70znuc_boards_nuc11tnhi70qnuc_extreme_nuc12edbi9nuc_laptop_kit_lapkc71f_firmwarenuc_nuc11phki7caanuc_pro_mini_pc_nuc11tnkv7nuc_pro_kit_nuc12wsbi70z_firmwarenuc_11_performance_kit_nuc11paki5nuc_extreme_compute_element_nuc11btmi9nuc_pro_board_nuc12wski5nuc_pro_board_nuc11tnkv5nuc_pro_board_nuc11tnhv70l_firmwarenuc_11_compute_element_cm11ebi716w_firmwarenuc_13_extreme_compute_element_nuc13sbbi7nuc_13_extreme_kit_nuc13rngi5_firmwarenuc_11_performance_kit_nuc11pahi70z_firmwarenuc_extreme_compute_element_nuc11btmi7_firmwarenuc_boards_nuc11tnbi70znuc_12_extreme_compute_element_nuc12dcmi7_firmwarenuc_12_extreme_compute_element_nuc12edbi7nuc_laptop_kits_lapac71h_firmwarenuc_extreme_nuc12edbi9_firmwarenuc_12_compute_element_elm12hbi7_firmwarenuc_12_compute_element_elm12hbi3_firmwarenuc_extreme_compute_element_nuc11dbbi7_firmwarenuc_boards_nuc11tnbi5nuc_11_performance_mini_pc_nuc11pahi30znuc_pro_board_nuc12wsbi5nuc_pro_board_nuc11tnhv70lnuc_boards_nuc11tnhi5_firmwarenuc_pro_kit_nuc12wshi30z_firmwarenuc_laptop_kits_lapac71hnuc_11_compute_element_cm11ebi58w_firmwarenuc_pro_kit_nuc12wsbi30z_firmwarenuc_11_performance_kit_nuc11pahi5nuc_boards_nuc11tnhi30pnuc_essential_nuc11atbc4nuc_11_performance_kit_nuc11pahi7_firmwarenuc_pro_kit_nuc12wsbi30znuc_pro_board_nuc12wshi5nuc_pro_kit_nuc12wshi30lnuc_pro_ki_nuc11tnkv5nuc_pro_kit_nuc12wshi3_firmwarenuc_pro_mini_pc_nuc11tnkv50znuc_12_extreme_compute_element_nuc12dcmi9nuc_pro_kit_nuc12wski50znuc_enthusiast_nuc12snki72_firmwarenuc_boards_nuc11tnbi3nuc_pro_board_nuc12wshi3_firmwarenuc_pro_board_nuc11tnhv7nuc_11_performance_mini_pc_nuc11paki5_firmwarenuc_12_extreme_compute_element_nuc12edbi9nuc_pro_mini_pc_nuc11tnhv70l_firmwarenuc_pro_board_nuc12wshi50z_firmwarenuc_laptop_kit_laprc710nuc_pro_board_nuc12wsbi30z_firmwarenuc_pro_kit_nuc12wski5_firmwarenuc_pro_board_nuc11tnhv5Intel(R) NUC BIOS firmwarebios
CWE ID-CWE-20
Improper Input Validation
CVE-2022-24379
Matching Score-4
Assigner-Intel Corporation
ShareView Details
Matching Score-4
Assigner-Intel Corporation
CVSS Score-7.5||HIGH
EPSS-0.07% / 20.52%
||
7 Day CHG~0.00%
Published-14 Nov, 2023 | 19:05
Updated-30 Aug, 2024 | 16:35
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Improper input validation in some Intel(R) Server System M70KLP Family BIOS firmware before version 01.04.0029 may allow a privileged user to potentially enable escalation of privilege via local access.

Action-Not Available
Vendor-n/aIntel Corporation
Product-server_system_m70klp4s2uhhserver_board_m70klp2sb_firmwareserver_system_m70klp4s2uhh_firmwareserver_board_m70klp2sbIntel(R) Server System M70KLP Family BIOS firmwareintel_server_system_m70klp_family_bios_firmware
CWE ID-CWE-20
Improper Input Validation
CVE-2022-23432
Matching Score-4
Assigner-Samsung Mobile
ShareView Details
Matching Score-4
Assigner-Samsung Mobile
CVSS Score-6.4||MEDIUM
EPSS-0.02% / 3.06%
||
7 Day CHG~0.00%
Published-11 Feb, 2022 | 17:40
Updated-03 Aug, 2024 | 03:43
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

An improper input validation in SMC_SRPMB_WSM handler of RPMB ldfw prior to SMR Feb-2022 Release 1 allows arbitrary memory write and code execution.

Action-Not Available
Vendor-Google LLCSamsungSamsung Electronics
Product-androidexynosSamsung Mobile Devices with Exynos chipsets
CWE ID-CWE-20
Improper Input Validation
CWE ID-CWE-787
Out-of-bounds Write
CVE-2022-24382
Matching Score-4
Assigner-Intel Corporation
ShareView Details
Matching Score-4
Assigner-Intel Corporation
CVSS Score-6.7||MEDIUM
EPSS-0.06% / 19.72%
||
7 Day CHG~0.00%
Published-12 May, 2022 | 16:35
Updated-05 May, 2025 | 17:18
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Improper input validation in firmware for some Intel(R) NUCs may allow a privileged user to potentially enable escalation of privilege via local access.

Action-Not Available
Vendor-n/aIntel Corporation
Product-nuc_11_pro_kit_nuc11tnhi30l_firmwarenuc11dbbi7_firmwarenuc_9_pro_compute_element_nuc9vxqnb_firmwarenuc_11_pro_kit_nuc11tnki7nuc11pa_firmwarenuc8i3cysnnuc_9_pro_kit_nuc9vxqnx_firmwarenuc_11_compute_element_cm11ebi58w_firmwarenuc_11_pro_board_nuc11tnbi50znuc_11_pro_kit_nuc11tnki30z_firmwarenuc_8_compute_element_cm8pcbnuc_8_compute_element_cm8pcb_firmwarelapkc71fnuc_11_pro_board_nuc11tnbi70z_firmwarenuc_11_pro_board_nuc11tnbi7nuc_11_compute_element_cm11ebc4w_firmwarenuc_11_pro_kit_nuc11tnki50znuc_11_pro_kit_nuc11tnki5nuc_kit_nuc8i5benuc8i3cysmlapbc710nuc_11_pro_kit_nuc11tnhi50znuc_8_compute_element_cm8i3cbnuc8i3cysn_firmwarenuc_kit_nuc8i5be_firmwarenuc11pahnuc_11_pro_board_nuc11tnbi30z_firmwarenuc_9_pro_kit_nuc9v7qnx_firmwarenuc_8_compute_element_cm8ccbnuc11dbbi9_firmwarenuc_11_pro_board_nuc11tnbi5nuc_9_pro_compute_element_nuc9v7qnblapbc710_firmwarelapkc51enuc_11_pro_kit_nuc11tnki3nuc_11_pro_kit_nuc11tnki70znuc_8_compute_element_cm8i7cblapkc71f_firmwarenuc_11_enthusiast_kit_nuc11phki7cnuc11panuc_11_pro_kit_nuc11tnhi70lnuc_11_pro_kit_nuc11tnhi50lnuc_8_compute_element_cm8i7cb_firmwarenuc9i9qnnuc_11_pro_board_nuc11tnbi70znuc_11_pro_kit_nuc11tnhi30znuc_11_pro_kit_nuc11tnhi50w_firmwarelapbc510_firmwarenuc_11_compute_element_cm11ebi716wnuc_11_pro_kit_nuc11tnki30znuc_kit_nuc8i3b_firmwarenuc11btmi9nuc11btmi7nuc9i7qnnuc9i7qn_firmwarenuc_8_compute_element_cm8i5cb_firmwarenuc_11_compute_element_cm11ebi38w_firmwarenuc_11_pro_kit_nuc11tnhi70l_firmwarenuc_11_pro_kit_nuc11tnhi70qnuc_11_pro_kit_nuc11tnhi70znuc9i5qn_firmwarenuc_kit_nuc8i7be_firmwarenuc_11_pro_kit_nuc11tnhi30lnuc8i3cysm_firmwarelapkc71e_firmwarenuc_11_pro_kit_nuc11tnhi30z_firmwarenuc_11_pro_board_nuc11tnbi5_firmwarenuc_11_pro_kit_nuc11tnki50z_firmwarenuc11paq_firmwarenuc_11_pro_board_nuc11tnbi3_firmwarenuc_11_pro_kit_nuc11tnhi5_firmwarenuc_11_pro_kit_nuc11tnhi7_firmwarenuc_kit_nuc8i3bnuc_11_pro_kit_nuc11tnhi50l_firmwarenuc_11_enthusiast_mini_pc_nuc11phki7caanuc11btmi9_firmwarenuc_9_pro_kit_nuc9vxqnxnuc_11_pro_board_nuc11tnbi30znuc_11_pro_kit_nuc11tnhi3nuc_11_enthusiast_kit_nuc11phki7c_firmwarenuc_11_pro_board_nuc11tnbi3nuc_11_pro_kit_nuc11tnhi7nuc_11_pro_board_nuc11tnbi7_firmwarenuc_11_pro_kit_nuc11tnki5_firmwarelapbc510nuc_11_pro_kit_nuc11tnki3_firmwarenuc_8_compute_element_cm8i5cbnuc_11_pro_kit_nuc11tnhi70q_firmwarenuc11pah_firmwarenuc_8_compute_element_cm8i3cb_firmwarelapkc51e_firmwarenuc_11_compute_element_cm11ebi716w_firmwarenuc11paqnuc_9_pro_compute_element_nuc9v7qnb_firmwarenuc_11_pro_kit_nuc11tnki70z_firmwarenuc_9_pro_kit_nuc9v7qnxnuc_11_compute_element_cm11ebi58wnuc_11_pro_kit_nuc11tnhi5nuc_11_pro_kit_nuc11tnhi3_firmwarenuc_11_pro_board_nuc11tnbi50z_firmwarenuc_11_compute_element_cm11ebc4wnuc11dbbi9nuc11btmi7_firmwarenuc_11_pro_kit_nuc11tnhi50wnuc_kit_nuc8i7benuc_11_pro_kit_nuc11tnki7_firmwarenuc_11_pro_kit_nuc11tnhi30p_firmwarenuc_11_pro_kit_nuc11tnhi30pnuc_11_pro_kit_nuc11tnhi70z_firmwarenuc_8_compute_element_cm8ccb_firmwarenuc_11_enthusiast_mini_pc_nuc11phki7caa_firmwarenuc9i5qnnuc11dbbi7nuc9i9qn_firmwarenuc_11_pro_kit_nuc11tnhi50z_firmwarenuc_9_pro_compute_element_nuc9vxqnblapkc71enuc_11_compute_element_cm11ebi38wIntel(R) NUCs
CWE ID-CWE-20
Improper Input Validation
CVE-2024-41167
Matching Score-4
Assigner-Intel Corporation
ShareView Details
Matching Score-4
Assigner-Intel Corporation
CVSS Score-8.7||HIGH
EPSS-0.03% / 8.31%
||
7 Day CHG~0.00%
Published-13 Nov, 2024 | 21:10
Updated-19 Nov, 2024 | 19:45
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Improper input validation in UEFI firmware in some Intel(R) Server Board M10JNP2SB Family may allow a privileged user to potentially enable escalation of privilege via local access.

Action-Not Available
Vendor-n/aIntel Corporation
Product-m10jnp2sb_firmwarem10jnp2sbIntel(R) Server Board M10JNP2SB Familym10jnp2sb_firmware
CWE ID-CWE-20
Improper Input Validation
CVE-2022-21933
Matching Score-4
Assigner-TWCERT/CC
ShareView Details
Matching Score-4
Assigner-TWCERT/CC
CVSS Score-6.7||MEDIUM
EPSS-0.05% / 15.39%
||
7 Day CHG~0.00%
Published-21 Jan, 2022 | 09:05
Updated-16 Sep, 2024 | 20:06
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
ASUS VivoMini/Mini PC - improper input validation

ASUS VivoMini/Mini PC device has an improper input validation vulnerability. A local attacker with system privilege can use system management interrupt (SMI) to modify memory, resulting in arbitrary code execution for controlling the system or disrupting service.

Action-Not Available
Vendor-ASUS (ASUSTeK Computer Inc.)
Product-pb61vpn60un65u_firmwarepa90vc65-c1pn60_firmwarepb50pb60s_firmwarepb60g_firmwarepa90_firmwarevc65-c1_firmwarepn30pb60_firmwarets10pb60un65upn30_firmwarets10_firmwarepb60vpb60gpb61v_firmwarepb60spb60v_firmwarepn40pb50_firmwarepn40_firmwarePB60GVC65-C1PA90PN40PB50UN65UPN60PB60SPB61VTS10PN30PB60VPB60
CWE ID-CWE-20
Improper Input Validation
CWE ID-CWE-787
Out-of-bounds Write
CVE-2023-25951
Matching Score-4
Assigner-Intel Corporation
ShareView Details
Matching Score-4
Assigner-Intel Corporation
CVSS Score-6||MEDIUM
EPSS-0.07% / 20.56%
||
7 Day CHG~0.00%
Published-14 Feb, 2024 | 13:37
Updated-29 Oct, 2024 | 15:52
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Improper input validation for some Intel(R) PROSet/Wireless and Intel(R) Killer(TM) Wi-Fi software before version 22.240 may allow a privileged user to potentially enable escalation of privilege via local access.

Action-Not Available
Vendor-n/aIntel Corporation
Product-killer_wi-fi_6e_ax1690proset\/wirelesswi-fi_6e_ax211killerkiller_wi-fi_6e_ax1675wi-fi_6e_ax411proset_wi-fi_6e_ax210Intel(R) PROSet/Wireless and Intel(R) Killer(TM) Wi-Fi softwareproset\/wirelesskiller_wifi_software
CWE ID-CWE-20
Improper Input Validation
CVE-2024-33031
Matching Score-4
Assigner-Qualcomm, Inc.
ShareView Details
Matching Score-4
Assigner-Qualcomm, Inc.
CVSS Score-6.7||MEDIUM
EPSS-0.03% / 7.26%
||
7 Day CHG~0.00%
Published-04 Nov, 2024 | 10:04
Updated-16 Nov, 2024 | 04:55
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Improper Input Validation in RIL

Memory corruption while processing the update SIM PB records request.

Action-Not Available
Vendor-Qualcomm Technologies, Inc.
Product-fastconnect_7800qca8337_firmwaresnapdragon_x72_5g_modem-rf_systemqcn6274_firmwaresdm429wqca8337snapdragon_x75_5g_modem-rf_system_firmwareqfw7124qcn6224_firmwaresdm429w_firmwarewcd9340qcn6274qcn6224fastconnect_7800_firmwaresnapdragon_x72_5g_modem-rf_system_firmwaresnapdragon_x75_5g_modem-rf_systemqca8081qcc710qfw7114_firmwarear8035wcd9340_firmwarewcn3660bqcc710_firmwarewcn3620_firmwarewcn3660b_firmwarewcn3620snapdragon_429_mobile_platform_firmwareqca8081_firmwareqfw7124_firmwareqfw7114snapdragon_429_mobile_platformar8035_firmwareSnapdragonqca8337_firmwareqcn6274_firmwareqfw7114_firmwaresnapdragon_x75_5g_modem-rf_system_firmwarewcd9340_firmwareqcc710_firmwareqcn6224_firmwarewcn3620_firmwaresdm429w_firmwarewcn3660b_firmwaresnapdragon_429_mobile_platform_firmwarefastconnect_7800_firmwareqca8081_firmwaresnapdragon_x72_5g_modem-rf_system_firmwareqfw7124_firmwarear8035_firmware
CWE ID-CWE-20
Improper Input Validation
CVE-2024-36482
Matching Score-4
Assigner-Intel Corporation
ShareView Details
Matching Score-4
Assigner-Intel Corporation
CVSS Score-7.1||HIGH
EPSS-0.05% / 13.41%
||
7 Day CHG~0.00%
Published-13 Nov, 2024 | 21:11
Updated-04 Feb, 2025 | 18:27
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Improper input validation in some Intel(R) CIP software before version 2.4.10852 may allow a privileged user to potentially enable escalation of privilege via local access.

Action-Not Available
Vendor-n/aIntel Corporation
Product-computing_improvement_programIntel(R) CIP softwarecip_software
CWE ID-CWE-20
Improper Input Validation
CVE-2022-20459
Matching Score-4
Assigner-Android (associated with Google Inc. or Open Handset Alliance)
ShareView Details
Matching Score-4
Assigner-Android (associated with Google Inc. or Open Handset Alliance)
CVSS Score-6.7||MEDIUM
EPSS-0.01% / 0.59%
||
7 Day CHG~0.00%
Published-17 Nov, 2022 | 00:00
Updated-30 Apr, 2025 | 15:15
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

In (TBD) of (TBD), there is a possible way to redirect code execution due to improper input validation. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-239556260References: N/A

Action-Not Available
Vendor-n/aGoogle LLC
Product-androidAndroid
CWE ID-CWE-20
Improper Input Validation
CVE-2023-21627
Matching Score-4
Assigner-Qualcomm, Inc.
ShareView Details
Matching Score-4
Assigner-Qualcomm, Inc.
CVSS Score-6.7||MEDIUM
EPSS-0.03% / 7.05%
||
7 Day CHG~0.00%
Published-08 Aug, 2023 | 09:14
Updated-02 Aug, 2024 | 09:44
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Incorrect Type Conversion or Cast in Trusted Execution Environment

Memory corruption in Trusted Execution Environment while calling service API with invalid address.

Action-Not Available
Vendor-Qualcomm Technologies, Inc.
Product-wsa8830sda429w_firmwaresa6150p_firmwarewcd9380_firmwaresa8145p_firmwaresw5100psd865_5gqcc5100sdx55m_firmwarewcn6856_firmwarewsa8835sd_8_gen1_5gwcd9380sa8150p_firmwaresd888_5gqca6420_firmwareqca6595au_firmwareqca6390_firmwarewcn6855_firmwareqca6426qca6430_firmwarewcn3980wcn3998wcd9385_firmwaresdxr2_5g_firmwaresd_8_gen1_5g_firmwarewcn3660bsd855wsa8815wcn6850qca6426_firmwarewcn3660b_firmwarewcn7850qca6574au_firmwarewcn3680b_firmwareqca6595auwcn3998_firmwarewcn3980_firmwareqca6391wcn3610_firmwareqca6420qca6436_firmwaresdx55mqcc5100_firmwareaqt1000_firmwaresa6155p_firmwareqcs8155wcn7851sdxr2_5gwcn6851_firmwarewcn3988_firmwareqca6430qca6574ausa6145p_firmwaresa8155p_firmwaresa8195pwsa8810_firmwarewcd9341_firmwaresw5100wsa8810sd870qca6436wcn6851wcn6855sa6155psw5100p_firmwarewcn7851_firmwarewcn6856sa6145pwcn3680bwcd9385wcd9341qca6696_firmwaresa8145psd870_firmwareqca6696qca6391_firmwareqca6390aqt1000sa8150psa6150psa8155pwsa8830_firmwaresda429wsd855_firmwaresd865_5g_firmwarewcn3988sd888_5g_firmwarewcn6850_firmwarewcn7850_firmwarewsa8815_firmwarewsa8835_firmwaresa8195p_firmwareqcs8155_firmwaresw5100_firmwarewcn3610Snapdragon
CWE ID-CWE-20
Improper Input Validation
CWE ID-CWE-704
Incorrect Type Conversion or Cast
CVE-2023-20721
Matching Score-4
Assigner-MediaTek, Inc.
ShareView Details
Matching Score-4
Assigner-MediaTek, Inc.
CVSS Score-8.4||HIGH
EPSS-0.01% / 0.45%
||
7 Day CHG~0.00%
Published-15 May, 2023 | 00:00
Updated-24 Jan, 2025 | 15:15
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

In isp, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07162155; Issue ID: ALPS07162155.

Action-Not Available
Vendor-yoctoprojectGoogle LLCMediaTek Inc.
Product-mt6895mt6983mt8673androidmt8395yoctomt8195mt6879MT6879, MT6895, MT6983, MT8195, MT8395, MT8673
CWE ID-CWE-787
Out-of-bounds Write
CWE ID-CWE-20
Improper Input Validation
CVE-2023-20718
Matching Score-4
Assigner-MediaTek, Inc.
ShareView Details
Matching Score-4
Assigner-MediaTek, Inc.
CVSS Score-6.7||MEDIUM
EPSS-0.02% / 3.64%
||
7 Day CHG~0.00%
Published-15 May, 2023 | 00:00
Updated-24 Jan, 2025 | 17:15
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

In vcu, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07645181; Issue ID: ALPS07645181.

Action-Not Available
Vendor-yoctoprojectGoogle LLCMediaTek Inc.
Product-mt6781mt6853tmt6855mt8789mt6889mt6893mt6833mt8365mt6769androidmt6877mt8175mt8195yoctomt8791tmt8168mt6768mt6785mt8786mt6873mt6891mt6853mt6789mt8673mt6883mt8797mt8395mt6875mt6885mt6779mt8781MT6768, MT6769, MT6779, MT6781, MT6785, MT6789, MT6833, MT6853, MT6853T, MT6855, MT6873, MT6875, MT6877, MT6883, MT6885, MT6889, MT6891, MT6893, MT8168, MT8175, MT8195, MT8365, MT8395, MT8673, MT8781, MT8786, MT8789, MT8791T, MT8797
CWE ID-CWE-20
Improper Input Validation
CVE-2023-20722
Matching Score-4
Assigner-MediaTek, Inc.
ShareView Details
Matching Score-4
Assigner-MediaTek, Inc.
CVSS Score-6.7||MEDIUM
EPSS-0.01% / 0.45%
||
7 Day CHG~0.00%
Published-15 May, 2023 | 00:00
Updated-24 Jan, 2025 | 19:15
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

In m4u, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07771518; Issue ID: ALPS07680084.

Action-Not Available
Vendor-Google LLCMediaTek Inc.
Product-mt6768mt8768androidmt6765MT6765, MT6768, MT8768
CWE ID-CWE-1284
Improper Validation of Specified Quantity in Input
CWE ID-CWE-20
Improper Input Validation
CVE-2023-20626
Matching Score-4
Assigner-MediaTek, Inc.
ShareView Details
Matching Score-4
Assigner-MediaTek, Inc.
CVSS Score-6.7||MEDIUM
EPSS-0.01% / 2.02%
||
7 Day CHG~0.00%
Published-07 Mar, 2023 | 00:00
Updated-06 Mar, 2025 | 17:15
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

In msdc, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07405223; Issue ID: ALPS07405223.

Action-Not Available
Vendor-Google LLCMediaTek Inc.
Product-mt6853mt6893mt8768androidmt6768mt6781mt6889mt6833mt6873mt6739mt6765mt8766mt6761mt6883mt8797mt6885mt6779mt8791mt6877mt8667mt8675mt8765mt6771mt8666mt8789mt8785mt6785MT6739, MT6761, MT6765, MT6768, MT6771, MT6779, MT6781, MT6785, MT6833, MT6853, MT6873, MT6877, MT6883, MT6885, MT6889, MT6893, MT8666, MT8667, MT8675, MT8765, MT8766, MT8768, MT8785, MT8789, MT8791, MT8797
CWE ID-CWE-787
Out-of-bounds Write
CWE ID-CWE-20
Improper Input Validation
CVE-2023-20636
Matching Score-4
Assigner-MediaTek, Inc.
ShareView Details
Matching Score-4
Assigner-MediaTek, Inc.
CVSS Score-6.7||MEDIUM
EPSS-0.02% / 3.64%
||
7 Day CHG~0.00%
Published-07 Mar, 2023 | 00:00
Updated-06 Mar, 2025 | 18:15
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

In display drm, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07292593; Issue ID: ALPS07292593.

Action-Not Available
Vendor-Google LLCMediaTek Inc.
Product-androidmt6985mt8781mt6895mt8168MT6895, MT6985, MT8168, MT8781
CWE ID-CWE-20
Improper Input Validation
CVE-2023-20639
Matching Score-4
Assigner-MediaTek, Inc.
ShareView Details
Matching Score-4
Assigner-MediaTek, Inc.
CVSS Score-6.7||MEDIUM
EPSS-0.02% / 3.64%
||
7 Day CHG~0.00%
Published-07 Mar, 2023 | 00:00
Updated-06 Mar, 2025 | 18:15
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

In ril, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07628587; Issue ID: ALPS07628587.

Action-Not Available
Vendor-Google LLCMediaTek Inc.
Product-mt8768androidmt8781mt6983mt6879mt8765mt8786mt8791tmt6895mt8797mt8766mt8788mt8321mt8789MT6879, MT6895, MT6983, MT8321, MT8765, MT8766, MT8768, MT8781, MT8786, MT8788, MT8789, MT8791T, MT8797
CWE ID-CWE-20
Improper Input Validation
CVE-2023-20564
Matching Score-4
Assigner-Advanced Micro Devices Inc.
ShareView Details
Matching Score-4
Assigner-Advanced Micro Devices Inc.
CVSS Score-6.7||MEDIUM
EPSS-0.03% / 5.72%
||
7 Day CHG~0.00%
Published-15 Aug, 2023 | 21:07
Updated-08 Oct, 2024 | 19:31
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Insufficient validation in the IOCTL (Input Output Control) input buffer in AMD Ryzen™ Master may permit a privileged attacker to perform memory reads/writes potentially leading to a loss of confidentiality or arbitrary kernel execution.

Action-Not Available
Vendor-Advanced Micro Devices, Inc.Microsoft Corporation
Product-ryzen_master_monitoring_sdkwindows_11ryzen_masterwindows_10Ryzen™ Masterryzen
CWE ID-CWE-20
Improper Input Validation
CVE-2023-20621
Matching Score-4
Assigner-MediaTek, Inc.
ShareView Details
Matching Score-4
Assigner-MediaTek, Inc.
CVSS Score-6.7||MEDIUM
EPSS-0.01% / 0.92%
||
7 Day CHG~0.00%
Published-07 Mar, 2023 | 00:00
Updated-06 Mar, 2025 | 14:33
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

In tinysys, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07664755; Issue ID: ALPS07664755.

Action-Not Available
Vendor-Google LLCMediaTek Inc.
Product-mt6895mt6893mt6789mt6771androidmt6739mt6885mt6761mt6983mt6762mt6765mt6879mt6883MT6739, MT6761, MT6762, MT6765, MT6771, MT6789, MT6879, MT6883, MT6885, MT6893, MT6895, MT6983
CWE ID-CWE-20
Improper Input Validation
CVE-2023-20708
Matching Score-4
Assigner-MediaTek, Inc.
ShareView Details
Matching Score-4
Assigner-MediaTek, Inc.
CVSS Score-6.7||MEDIUM
EPSS-0.01% / 1.15%
||
7 Day CHG~0.00%
Published-15 May, 2023 | 00:00
Updated-24 Jan, 2025 | 20:15
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

In keyinstall, there is a possible out of bounds read due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07581655; Issue ID: ALPS07581655.

Action-Not Available
Vendor-Google LLCMediaTek Inc.
Product-mt6895mt6983mt6757cdmt6769androidmt6877mt8768mt8791tmt6768mt6763mt6739mt6785mt8185mt8766mt6891mt6789mt8797mt8667mt6757cmt6885mt6779mt6757mt8781mt6781mt6853tmt6855mt8789mt6889mt6893mt6833mt6762mt6765mt6735mt8666mt8791mt8385mt6879mt6731mt6757chmt8321mt8786mt6873mt6753mt6853mt8788mt6883mt6737mt6771mt8765mt6875mt6761mt6580MT6580, MT6731, MT6735, MT6737, MT6739, MT6753, MT6757, MT6757C, MT6757CD, MT6757CH, MT6761, MT6762, MT6763, MT6765, MT6768, MT6769, MT6771, MT6779, MT6781, MT6785, MT6789, MT6833, MT6853, MT6853T, MT6855, MT6873, MT6875, MT6877, MT6879, MT6883, MT6885, MT6889, MT6891, MT6893, MT6895, MT6983, MT8185, MT8321, MT8385, MT8666, MT8667, MT8765, MT8766, MT8768, MT8781, MT8786, MT8788, MT8789, MT8791, MT8791T, MT8797
CWE ID-CWE-1284
Improper Validation of Specified Quantity in Input
CWE ID-CWE-20
Improper Input Validation
CVE-2023-20642
Matching Score-4
Assigner-MediaTek, Inc.
ShareView Details
Matching Score-4
Assigner-MediaTek, Inc.
CVSS Score-6.7||MEDIUM
EPSS-0.02% / 3.64%
||
7 Day CHG~0.00%
Published-07 Mar, 2023 | 00:00
Updated-06 Mar, 2025 | 18:15
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

In ril, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07628586; Issue ID: ALPS07628586.

Action-Not Available
Vendor-Google LLCMediaTek Inc.
Product-mt8768androidmt8781mt6983mt6879mt8765mt8786mt8791tmt6895mt8797mt8766mt8788mt8321mt8789MT6879, MT6895, MT6983, MT8321, MT8765, MT8766, MT8768, MT8781, MT8786, MT8788, MT8789, MT8791T, MT8797
CWE ID-CWE-20
Improper Input Validation
CVE-2023-20638
Matching Score-4
Assigner-MediaTek, Inc.
ShareView Details
Matching Score-4
Assigner-MediaTek, Inc.
CVSS Score-6.7||MEDIUM
EPSS-0.02% / 3.64%
||
7 Day CHG~0.00%
Published-07 Mar, 2023 | 00:00
Updated-06 Mar, 2025 | 18:15
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

In ril, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07628537; Issue ID: ALPS07628537.

Action-Not Available
Vendor-Google LLCMediaTek Inc.
Product-androidmt6855mt6853tmt8781mt6833mt6739mt6779mt6885mt6763mt6789mt6875mt6769mt6895mt6761mt8789mt6785mt6853mt6893mt6753mt8768mt6768mt6781mt6889mt6983mt8786mt6873mt6765mt6762mt8766mt8788mt6883mt8797mt6877mt6879mt8765mt8791tmt6771mt8321MT6739, MT6753, MT6761, MT6762, MT6763, MT6765, MT6768, MT6769, MT6771, MT6779, MT6781, MT6785, MT6789, MT6833, MT6853, MT6853T, MT6855, MT6873, MT6875, MT6877, MT6879, MT6883, MT6885, MT6889, MT6893, MT6895, MT6983, MT8321, MT8765, MT8766, MT8768, MT8781, MT8786, MT8788, MT8789, MT8791T, MT8797
CWE ID-CWE-20
Improper Input Validation
CVE-2023-20634
Matching Score-4
Assigner-MediaTek, Inc.
ShareView Details
Matching Score-4
Assigner-MediaTek, Inc.
CVSS Score-6.7||MEDIUM
EPSS-0.01% / 0.45%
||
7 Day CHG~0.00%
Published-07 Mar, 2023 | 00:00
Updated-06 Mar, 2025 | 18:15
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

In widevine, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07635697; Issue ID: ALPS07635697.

Action-Not Available
Vendor-Google LLCMediaTek Inc.
Product-mt6853mt6893mt8768mt8789androidmt6768mt6781mt6855mt6853tmt6889mt6833mt8786mt6873mt6765mt6762mt8788mt6883mt8797mt6885mt6779mt6789mt6875mt6877mt6769mt6879mt6891mt6785MT6762, MT6765, MT6768, MT6769, MT6779, MT6781, MT6785, MT6789, MT6833, MT6853, MT6853T, MT6855, MT6873, MT6875, MT6877, MT6879, MT6883, MT6885, MT6889, MT6891, MT6893, MT8768, MT8786, MT8788, MT8789, MT8797
CWE ID-CWE-20
Improper Input Validation
CVE-2023-20650
Matching Score-4
Assigner-MediaTek, Inc.
ShareView Details
Matching Score-4
Assigner-MediaTek, Inc.
CVSS Score-6.7||MEDIUM
EPSS-0.02% / 3.64%
||
7 Day CHG~0.00%
Published-07 Mar, 2023 | 00:00
Updated-05 Mar, 2025 | 19:15
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

In apu, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07629577; Issue ID: ALPS07629577.

Action-Not Available
Vendor-Google LLCMediaTek Inc.
Product-mt6853mt6889mt6875mt6873mt6853tmt6877mt6885mt6983mt6895mt6891mt6879mt6883androidmt6893MT6853, MT6853T, MT6873, MT6875, MT6877, MT6879, MT6883, MT6885, MT6889, MT6891, MT6893, MT6895, MT6983
CWE ID-CWE-20
Improper Input Validation
CVE-2023-20720
Matching Score-4
Assigner-MediaTek, Inc.
ShareView Details
Matching Score-4
Assigner-MediaTek, Inc.
CVSS Score-6.7||MEDIUM
EPSS-0.02% / 3.45%
||
7 Day CHG~0.00%
Published-15 May, 2023 | 00:00
Updated-24 Jan, 2025 | 15:15
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

In pqframework, there is a possible out of bounds read due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07629586; Issue ID: ALPS07629586.

Action-Not Available
Vendor-Google LLCMediaTek Inc.
Product-mt6895mt6983mt8673androidmt8195mt8167mt8168MT6895, MT6983, MT8167, MT8168, MT8195, MT8673
CWE ID-CWE-787
Out-of-bounds Write
CWE ID-CWE-20
Improper Input Validation
CVE-2023-20643
Matching Score-4
Assigner-MediaTek, Inc.
ShareView Details
Matching Score-4
Assigner-MediaTek, Inc.
CVSS Score-6.7||MEDIUM
EPSS-0.02% / 3.64%
||
7 Day CHG~0.00%
Published-07 Mar, 2023 | 00:00
Updated-06 Mar, 2025 | 18:15
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

In ril, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07628584; Issue ID: ALPS07628584.

Action-Not Available
Vendor-Google LLCMediaTek Inc.
Product-mt6853mt8321mt6893mt8768mt8789androidmt6768mt6781mt8781mt6833mt8786mt6873mt6739mt6765mt6762mt8766mt8788mt8797mt6875mt6877mt6769mt8765mt8791tmt6761mt6891mt6785MT6739, MT6761, MT6762, MT6765, MT6768, MT6769, MT6781, MT6785, MT6833, MT6853, MT6873, MT6875, MT6877, MT6891, MT6893, MT8321, MT8765, MT8766, MT8768, MT8781, MT8786, MT8788, MT8789, MT8791T, MT8797
CWE ID-CWE-20
Improper Input Validation
CVE-2023-20707
Matching Score-4
Assigner-MediaTek, Inc.
ShareView Details
Matching Score-4
Assigner-MediaTek, Inc.
CVSS Score-6.7||MEDIUM
EPSS-0.02% / 2.72%
||
7 Day CHG~0.00%
Published-15 May, 2023 | 00:00
Updated-24 Jan, 2025 | 20:15
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

In ril, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07628556; Issue ID: ALPS07628556.

Action-Not Available
Vendor-Google LLCMediaTek Inc.
Product-mt6895mt6757cdmt6769androidmt6877mt8768mt8791tmt6768mt6763mt6739mt6785mt8766mt6891mt6789mt6757cmt6885mt6779mt6757mt8781mt6781mt6853tmt6855mt8789mt6889mt6893mt6833mt6762mt6765mt6735mt6879mt6757chmt8321mt8786mt6873mt6753mt6853mt8788mt6883mt6737mt6771mt8765mt6875mt6761MT6735, MT6737, MT6739, MT6753, MT6757, MT6757C, MT6757CD, MT6757CH, MT6761, MT6762, MT6763, MT6765, MT6768, MT6769, MT6771, MT6779, MT6781, MT6785, MT6789, MT6833, MT6853, MT6853T, MT6855, MT6873, MT6875, MT6877, MT6879, MT6883, MT6885, MT6889, MT6891, MT6893, MT6895, MT8321, MT8765, MT8766, MT8768, MT8781, MT8786, MT8788, MT8789, MT8791T, MT8797
CWE ID-CWE-1284
Improper Validation of Specified Quantity in Input
CWE ID-CWE-20
Improper Input Validation
CVE-2023-20612
Matching Score-4
Assigner-MediaTek, Inc.
ShareView Details
Matching Score-4
Assigner-MediaTek, Inc.
CVSS Score-6.7||MEDIUM
EPSS-0.04% / 11.47%
||
7 Day CHG~0.00%
Published-06 Feb, 2023 | 00:00
Updated-26 Mar, 2025 | 14:15
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

In ril, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07629571; Issue ID: ALPS07629571.

Action-Not Available
Vendor-Google LLCMediaTek Inc.
Product-mt6895mt6769mt8765mt6877mt6739mt6785mt6781mt6855mt8321mt6885mt6889mt6875mt6779mt8768mt8766mt6833mt6768mt6765androidmt6893mt8786mt8788mt8791mt6883mt6853mt8385mt6761mt6762mt6983mt8789mt6771mt6879mt8791tmt6789mt6891mt8797mt6873MT6739, MT6761, MT6762, MT6765, MT6768, MT6769, MT6771, MT6779, MT6781, MT6785, MT6789, MT6833, MT6853, MT6855, MT6873, MT6875, MT6877, MT6879, MT6883, MT6885, MT6889, MT6891, MT6893, MT6895, MT6983, MT8321, MT8385, MT8765, MT8766, MT8768, MT8786, MT8788, MT8789, MT8791, MT8791T, MT8797
CWE ID-CWE-20
Improper Input Validation
CVE-2023-20640
Matching Score-4
Assigner-MediaTek, Inc.
ShareView Details
Matching Score-4
Assigner-MediaTek, Inc.
CVSS Score-6.7||MEDIUM
EPSS-0.02% / 3.64%
||
7 Day CHG~0.00%
Published-07 Mar, 2023 | 00:00
Updated-06 Mar, 2025 | 18:15
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

In ril, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07629573; Issue ID: ALPS07629573.

Action-Not Available
Vendor-Google LLCMediaTek Inc.
Product-mt8791androidmt6983mt6879mt8791tmt6895mt8797MT6879, MT6895, MT6983, MT8791, MT8791T, MT8797
CWE ID-CWE-20
Improper Input Validation
CVE-2023-20641
Matching Score-4
Assigner-MediaTek, Inc.
ShareView Details
Matching Score-4
Assigner-MediaTek, Inc.
CVSS Score-6.7||MEDIUM
EPSS-0.02% / 3.64%
||
7 Day CHG~0.00%
Published-07 Mar, 2023 | 00:00
Updated-06 Mar, 2025 | 18:15
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

In ril, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07629574; Issue ID: ALPS07629574.

Action-Not Available
Vendor-Google LLCMediaTek Inc.
Product-mt8791androidmt6983mt6879mt8791tmt6895mt8797MT6879, MT6895, MT6983, MT8791, MT8791T, MT8797
CWE ID-CWE-20
Improper Input Validation
CVE-2021-1454
Matching Score-4
Assigner-Cisco Systems, Inc.
ShareView Details
Matching Score-4
Assigner-Cisco Systems, Inc.
CVSS Score-6||MEDIUM
EPSS-0.11% / 29.63%
||
7 Day CHG~0.00%
Published-24 Mar, 2021 | 20:06
Updated-08 Nov, 2024 | 23:34
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Cisco IOS XE SD-WAN Software Parameter Injection Vulnerabilities

Multiple vulnerabilities in the CLI of Cisco IOS XE SD-WAN Software could allow an authenticated, local attacker to access the underlying operating system with root privileges. These vulnerabilities are due to insufficient input validation of certain CLI commands. An attacker could exploit these vulnerabilities by authenticating to the device and submitting crafted input to the CLI. The attacker must be authenticated as an administrative user to execute the affected commands. A successful exploit could allow the attacker to access the underlying operating system with root privileges.

Action-Not Available
Vendor-Cisco Systems, Inc.
Product-ios_xeios_xe_sd-wanCisco IOS XE Software
CWE ID-CWE-20
Improper Input Validation
CWE ID-CWE-88
Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
CVE-2020-1619
Matching Score-4
Assigner-Juniper Networks, Inc.
ShareView Details
Matching Score-4
Assigner-Juniper Networks, Inc.
CVSS Score-6||MEDIUM
EPSS-0.04% / 10.44%
||
7 Day CHG~0.00%
Published-08 Apr, 2020 | 19:25
Updated-17 Sep, 2024 | 02:27
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Junos OS: QFX10K Series, EX9200 Series, MX Series, PTX Series: Privilege escalation vulnerability in NG-RE.

A privilege escalation vulnerability in Juniper Networks QFX10K Series, EX9200 Series, MX Series, and PTX Series with Next-Generation Routing Engine (NG-RE), allows a local authenticated high privileged user to access the underlying WRL host. This issue only affects QFX10K Series with NG-RE, EX9200 Series with NG-RE, MX Series with NG-RE and PTX Series with NG-RE; which uses vmhost. This issue affects Juniper Networks Junos OS: 16.1 versions prior to 16.1R7-S6; 16.2 versions prior to 16.2R2-S11; 17.1 versions prior to 17.1R2-S11, 17.1R3; 17.2 versions prior to 17.2R1-S9, 17.2R3-S3; 17.3 versions prior to 17.3R2-S5, 17.3R3-S7; 17.4 versions prior to 17.4R2-S7, 17.4R3; 18.1 versions prior to 18.1R3-S4; 18.2 versions prior to 18.2R3; 18.2X75 versions prior to 18.2X75-D50; 18.3 versions prior to 18.3R2; 18.4 versions prior to 18.4R2. To identify whether the device has NG-RE with vmhost, customer can run the following command: > show vmhost status Compute cluster: rainier-re-cc Compute Node: rainier-re-cn, Online If the "show vmhost status" is not supported, then the device does not have NG-RE with vmhost.

Action-Not Available
Vendor-Juniper Networks, Inc.
Product-junosJunos OS
CWE ID-CWE-264
Not Available
CWE ID-CWE-20
Improper Input Validation
CVE-2020-15375
Matching Score-4
Assigner-Brocade Communications Systems, LLC
ShareView Details
Matching Score-4
Assigner-Brocade Communications Systems, LLC
CVSS Score-6.7||MEDIUM
EPSS-0.05% / 14.80%
||
7 Day CHG~0.00%
Published-11 Dec, 2020 | 20:34
Updated-04 Aug, 2024 | 13:15
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Brocade Fabric OS versions before v9.0.0, v8.2.2c, v8.2.1e, v8.1.2k, v8.2.0_CBN3, v7.4.2g contain an improper input validation weakness in the command line interface when secccrypptocfg is invoked. The vulnerability could allow a local authenticated user to run arbitrary commands and perform escalation of privileges.

Action-Not Available
Vendor-n/aBroadcom Inc.
Product-fabric_operating_systemBrocade Fabric OS
CWE ID-CWE-20
Improper Input Validation
CVE-2022-4573
Matching Score-4
Assigner-Lenovo Group Ltd.
ShareView Details
Matching Score-4
Assigner-Lenovo Group Ltd.
CVSS Score-6.7||MEDIUM
EPSS-0.03% / 4.96%
||
7 Day CHG~0.00%
Published-30 Oct, 2023 | 14:34
Updated-06 Sep, 2024 | 21:35
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

An SMI handler input validation vulnerability in the ThinkPad X1 Fold Gen 1 could allow an attacker with local access and elevated privileges to execute arbitrary code.

Action-Not Available
Vendor-Lenovo Group Limited
Product-thinkpad_x1_fold_gen_1thinkpad_x1_fold_gen_1_firmwareThinkPad X1 Fold Gen 1thinkpad_x1_fold_gen_1
CWE ID-CWE-20
Improper Input Validation
CVE-2022-20314
Matching Score-4
Assigner-Android (associated with Google Inc. or Open Handset Alliance)
ShareView Details
Matching Score-4
Assigner-Android (associated with Google Inc. or Open Handset Alliance)
CVSS Score-6.7||MEDIUM
EPSS-0.01% / 0.53%
||
7 Day CHG~0.00%
Published-11 Aug, 2022 | 15:24
Updated-03 Aug, 2024 | 02:10
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

In KeyChain, there is a possible spoof keychain chooser activity request due to improper input validation. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-191876118

Action-Not Available
Vendor-n/aGoogle LLC
Product-androidAndroid
CWE ID-CWE-20
Improper Input Validation
CVE-2023-20637
Matching Score-4
Assigner-MediaTek, Inc.
ShareView Details
Matching Score-4
Assigner-MediaTek, Inc.
CVSS Score-6.7||MEDIUM
EPSS-0.02% / 3.64%
||
7 Day CHG~0.00%
Published-07 Mar, 2023 | 00:00
Updated-06 Mar, 2025 | 18:15
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

In ril, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07628588; Issue ID: ALPS07628588.

Action-Not Available
Vendor-Google LLCMediaTek Inc.
Product-mt8768androidmt8781mt6983mt6879mt8765mt8786mt8791tmt6895mt8797mt8766mt8788mt8321mt8789MT6879, MT6895, MT6983, MT8321, MT8765, MT8766, MT8768, MT8781, MT8786, MT8788, MT8789, MT8791T, MT8797
CWE ID-CWE-20
Improper Input Validation
CVE-2023-20613
Matching Score-4
Assigner-MediaTek, Inc.
ShareView Details
Matching Score-4
Assigner-MediaTek, Inc.
CVSS Score-6.7||MEDIUM
EPSS-0.04% / 11.47%
||
7 Day CHG~0.00%
Published-06 Feb, 2023 | 00:00
Updated-26 Mar, 2025 | 14:15
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

In ril, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07628614; Issue ID: ALPS07628614.

Action-Not Available
Vendor-Google LLCMediaTek Inc.
Product-mt6895mt6769mt8765mt6877mt6739mt6785mt6781mt6855mt8321mt6885mt6889mt6875mt6779mt8768mt8766mt6833mt6768mt6765androidmt6893mt8786mt8788mt8791mt6883mt6853mt8385mt6761mt6762mt6983mt8789mt6771mt6879mt8791tmt6789mt6891mt8797mt6873MT6739, MT6761, MT6762, MT6765, MT6768, MT6769, MT6771, MT6779, MT6781, MT6785, MT6789, MT6833, MT6853, MT6855, MT6873, MT6875, MT6877, MT6879, MT6883, MT6885, MT6889, MT6891, MT6893, MT6895, MT6983, MT8321, MT8385, MT8765, MT8766, MT8768, MT8786, MT8788, MT8789, MT8791, MT8791T, MT8797
CWE ID-CWE-20
Improper Input Validation
CVE-2022-42500
Matching Score-4
Assigner-Android (associated with Google Inc. or Open Handset Alliance)
ShareView Details
Matching Score-4
Assigner-Android (associated with Google Inc. or Open Handset Alliance)
CVSS Score-6.7||MEDIUM
EPSS-0.01% / 0.21%
||
7 Day CHG~0.00%
Published-24 Mar, 2023 | 00:00
Updated-25 Feb, 2025 | 15:03
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

In OEM_OnRequest of sced.cpp, there is a possible shell command execution due to improper input validation. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-239701389References: N/A

Action-Not Available
Vendor-n/aGoogle LLC
Product-androidAndroid
CWE ID-CWE-20
Improper Input Validation
CVE-2020-3204
Matching Score-4
Assigner-Cisco Systems, Inc.
ShareView Details
Matching Score-4
Assigner-Cisco Systems, Inc.
CVSS Score-6.7||MEDIUM
EPSS-0.06% / 18.55%
||
7 Day CHG~0.00%
Published-03 Jun, 2020 | 17:40
Updated-15 Nov, 2024 | 17:19
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Cisco IOS and IOS XE Software Tcl Arbitrary Code Execution Vulnerability

A vulnerability in the Tool Command Language (Tcl) interpreter of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, local attacker with privileged EXEC credentials to execute arbitrary code on the underlying operating system (OS) with root privileges. The vulnerability is due to insufficient input validation of data passed to the Tcl interpreter. An attacker could exploit this vulnerability by loading malicious Tcl code on an affected device. A successful exploit could allow the attacker to cause memory corruption or execute the code with root privileges on the underlying OS of the affected device.

Action-Not Available
Vendor-Cisco Systems, Inc.
Product-ios_xeiosCisco IOS 12.2(53)SE1
CWE ID-CWE-20
Improper Input Validation
CVE-2024-23386
Matching Score-4
Assigner-Qualcomm, Inc.
ShareView Details
Matching Score-4
Assigner-Qualcomm, Inc.
CVSS Score-6.7||MEDIUM
EPSS-0.03% / 7.26%
||
7 Day CHG~0.00%
Published-04 Nov, 2024 | 10:04
Updated-16 Nov, 2024 | 04:55
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Improper Input Validation in Video

memory corruption when WiFi display APIs are invoked with large random inputs.

Action-Not Available
Vendor-Qualcomm Technologies, Inc.
Product-fastconnect_7800snapdragon_8_gen_1_mobile_platformwsa8830wcd9380_firmwaresdm429wfastconnect_6900snapdragon_429_mobile_platformfastconnect_6900_firmwarewcn3660bwsa8830_firmwarewsa8835wcn3620_firmwaresdm429w_firmwarewcn3660b_firmwarewsa8835_firmwarewcn3620wcd9380snapdragon_429_mobile_platform_firmwarefastconnect_7800_firmwaresnapdragon_8_gen_1_mobile_platform_firmwareSnapdragonwsa8830_firmwarewcd9380_firmwarewcn3620_firmwaresdm429w_firmwarewcn3660b_firmwarewsa8835_firmwaresnapdragon_429_mobile_platform_firmwarefastconnect_7800_firmwarefastconnect_6900_firmwaresnapdragon_8_gen_1_mobile_platform_firmware
CWE ID-CWE-20
Improper Input Validation
CVE-2022-37336
Matching Score-4
Assigner-Intel Corporation
ShareView Details
Matching Score-4
Assigner-Intel Corporation
CVSS Score-7.9||HIGH
EPSS-0.02% / 4.41%
||
7 Day CHG~0.00%
Published-11 Aug, 2023 | 02:37
Updated-02 Oct, 2024 | 13:27
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Improper input validation in BIOS firmware for some Intel(R) NUC may allow a privileged user to potentially enable escalation of privilege via local access.

Action-Not Available
Vendor-n/aIntel Corporation
Product-nuc_10_performance_kit_nuc10i3fnhfnuc_10_performance_kit_nuc10i5fnhj_firmwarenuc_10_performance_kit_nuc10i3fnk_firmwarenuc_10_performance_kit_nuc10i7fnh_firmwarenuc_10_performance_kit_nuc10i7fnkn_firmwarenuc_10_performance_kit_nuc10i7fnhc_firmwarenuc_10_performance_mini_pc_nuc10i3fnhja_firmwarenuc_10_performance_kit_nuc10i7fnhnuc_10_performance_kit_nuc10i5fnhf_firmwarenuc_10_performance_mini_pc_nuc10i5fnhcanuc_10_performance_kit_nuc10i5fnhnuc_10_performance_kit_nuc10i7fnk_firmwarenuc_10_performance_kit_nuc10i5fnk_firmwarenuc_10_performance_kit_nuc10i3fnknuc_10_performance_kit_nuc10i7fnhnnuc_10_performance_mini_pc_nuc10i5fnkpanuc_10_performance_kit_nuc10i7fnknnuc_10_performance_kit_nuc10i5fnhjnuc_10_performance_mini_pc_nuc10i7fnhaanuc_10_performance_kit_nuc10i5fnh_firmwarenuc_10_performance_kit_nuc10i5fnhfnuc_10_performance_kit_nuc10i5fnkp_firmwarenuc_10_performance_kit_nuc10i5fnkpnuc_10_performance_kit_nuc10i5fnhnnuc_10_performance_mini_pc_nuc10i7fnkpa_firmwarenuc_10_performance_kit_nuc10i3fnhnuc_10_performance_mini_pc_nuc10i7fnhja_firmwarenuc_10_performance_mini_pc_nuc10i7fnkpanuc_10_performance_kit_nuc10i3fnhn_firmwarenuc_10_performance_mini_pc_nuc10i5fnhca_firmwarenuc_10_performance_mini_pc_nuc10i3fnhjanuc_10_performance_kit_nuc10i5fnknuc_10_performance_kit_nuc10i7fnkpnuc_10_performance_kit_nuc10i3fnhnnuc_10_performance_mini_pc_nuc10i7fnhjanuc_10_performance_kit_nuc10i7fnkp_firmwarenuc_10_performance_kit_nuc10i3fnhf_firmwarenuc_10_performance_mini_pc_nuc10i3fnhfa_firmwarenuc_10_performance_kit_nuc10i7fnhcnuc_10_performance_mini_pc_nuc10i7fnhaa_firmwarenuc_10_performance_kit_nuc10i7fnhn_firmwarenuc_10_performance_kit_nuc10i3fnh_firmwarenuc_10_performance_kit_nuc10i7fnknuc_10_performance_mini_pc_nuc10i5fnhjanuc_10_performance_mini_pc_nuc10i5fnkpa_firmwarenuc_10_performance_kit_nuc10i5fnknnuc_10_performance_mini_pc_nuc10i3fnhfanuc_10_performance_kit_nuc10i3fnkn_firmwarenuc_10_performance_mini_pc_nuc10i5fnhja_firmwarenuc_10_performance_kit_nuc10i5fnkn_firmwarenuc_10_performance_kit_nuc10i5fnhn_firmwarenuc_10_performance_kit_nuc10i3fnknIntel(R) NUC
CWE ID-CWE-20
Improper Input Validation
CVE-2022-34885
Matching Score-4
Assigner-Lenovo Group Ltd.
ShareView Details
Matching Score-4
Assigner-Lenovo Group Ltd.
CVSS Score-7.2||HIGH
EPSS-0.09% / 27.16%
||
7 Day CHG~0.00%
Published-30 Jan, 2023 | 21:43
Updated-27 Mar, 2025 | 18:49
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

An improper input sanitization vulnerability in the Motorola MR2600 router could allow a local user with elevated permissions to execute arbitrary code.

Action-Not Available
Vendor-Motorola Mobility LLC. (Lenovo Group Limited)
Product-mr2600mr2600_firmwareMR2600 Router
CWE ID-CWE-20
Improper Input Validation
CVE-2022-34152
Matching Score-4
Assigner-Intel Corporation
ShareView Details
Matching Score-4
Assigner-Intel Corporation
CVSS Score-7.7||HIGH
EPSS-0.04% / 11.69%
||
7 Day CHG~0.00%
Published-11 Nov, 2022 | 15:48
Updated-05 Feb, 2025 | 21:15
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Improper input validation in BIOS firmware for some Intel(R) NUC Boards, Intel(R) NUC Kits before version TY0070 may allow a privileged user to potentially enable escalation of privilege via local access.

Action-Not Available
Vendor-n/aIntel Corporation
Product-nuc_board_de3815tybe_firmwarenuc_board_de3815tybenuc_kit_de3815tykhenuc_kit_de3815tykhe_firmwareIntel(R) NUC Boards, Intel(R) NUC Kits
CWE ID-CWE-20
Improper Input Validation
CVE-2022-33945
Matching Score-4
Assigner-Intel Corporation
ShareView Details
Matching Score-4
Assigner-Intel Corporation
CVSS Score-8.2||HIGH
EPSS-0.07% / 20.52%
||
7 Day CHG~0.00%
Published-14 Nov, 2023 | 19:05
Updated-14 Aug, 2024 | 20:35
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Improper input validation in some Intel(R) Server board and Intel(R) Server System BIOS firmware may allow a privileged user to potentially enable escalation of privilege via local access.

Action-Not Available
Vendor-n/aIntel Corporation
Product-compute_module_hns2600bps24compute_module_hns2600bpblc24rserver_board_s2600bpsserver_board_s2600bpqrcompute_module_hns2600bps_firmwarecompute_module_hns2600bpq24_firmwarecompute_module_hns2600bpq_firmwarecompute_module_hns2600bpblc24_firmwareserver_board_s2600bpqr_firmwareserver_system_vrn2224bphy6compute_module_hns2600bpq24r_firmwarecompute_module_hns2600bps24rcompute_module_hns2600bpbserver_board_s2600bpb_firmwarecompute_module_hns2600bpsrcompute_module_liquid-cooled_hns2600bpbrctserver_system_m70klp4s2uhhserver_system_vrn2224bphy6_firmwarecompute_module_hns2600bpblc_firmwarecompute_module_hns2600bpblcrcompute_module_hns2600bpbr_firmwareserver_system_m20ntp1ur304server_system_vrn2224bpaf6compute_module_hns2600bpqrcompute_module_hns2600bpbrserver_system_vrn2224bpaf6_firmwarecompute_module_hns2600bpb_firmwareserver_board_m20ntp2sbserver_board_m10jnp2sb_firmwareserver_board_s2600bpbrserver_system_m70klp4s2uhh_firmwareserver_board_m70klp2sbcompute_module_hns2600bps24_firmwarecompute_module_hns2600bps24r_firmwareserver_system_zsb2224bpaf2compute_module_hns2600bpsr_firmwarecompute_module_hns2600bpb24_firmwareserver_system_mcb2208wfaf5_firmwarecompute_module_liquid-cooled_hns2600bpbrct_firmwareserver_board_s2600bpbr_firmwarecompute_module_hns2600bpqcompute_module_hns2600bpblcr_firmwareserver_board_s2600bpbcompute_module_hns2600bpblc24server_system_zsb2224bphy1_firmwareserver_system_m20ntp1ur304_firmwareserver_board_m70klp2sb_firmwarecompute_module_hns2600bpblc24r_firmwareserver_board_s2600bpqserver_board_m10jnp2sbserver_system_zsb2224bpaf1server_board_s2600bpq_firmwarecompute_module_hns2600bpblcserver_system_zsb2224bpaf1_firmwareserver_board_s2600bpsrcompute_module_hns2600bpqr_firmwareserver_board_s2600bps_firmwarecompute_module_hns2600bpsserver_board_s2600bpsr_firmwarecompute_module_hns2600bpb24server_system_zsb2224bphy1server_system_zsb2224bpaf2_firmwarecompute_module_hns2600bpq24rcompute_module_hns2600bpq24server_board_m20ntp2sb_firmwareserver_system_mcb2208wfaf5Intel(R) Server board and Intel(R) Server System BIOS firmwareserver_system_m70klp_familyserver_board_m10jnp2sb_familyserver_board_s2600bp_familyserver_m20ntp_family
CWE ID-CWE-20
Improper Input Validation
CVE-2022-1108
Matching Score-4
Assigner-Lenovo Group Ltd.
ShareView Details
Matching Score-4
Assigner-Lenovo Group Ltd.
CVSS Score-6.7||MEDIUM
EPSS-0.08% / 25.38%
||
7 Day CHG~0.00%
Published-22 Apr, 2022 | 20:30
Updated-02 Aug, 2024 | 23:55
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

A potential vulnerability due to improper buffer validation in the SMI handler LenovoFlashDeviceInterface in Thinkpad X1 Fold Gen 1 could be exploited by an attacker with local access and elevated privileges to execute arbitrary code.

Action-Not Available
Vendor-Lenovo Group Limited
Product-thinkpad_x1_fold_gen_1thinkpad_x1_fold_gen_1_firmwareThinkPad BIOS
CWE ID-CWE-20
Improper Input Validation
CWE ID-CWE-269
Improper Privilege Management
CVE-2024-20056
Matching Score-4
Assigner-MediaTek, Inc.
ShareView Details
Matching Score-4
Assigner-MediaTek, Inc.
CVSS Score-6.7||MEDIUM
EPSS-0.01% / 0.82%
||
7 Day CHG~0.00%
Published-06 May, 2024 | 02:51
Updated-30 Apr, 2025 | 16:41
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

In preloader, there is a possible escalation of privilege due to an insecure default value. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08528185; Issue ID: ALPS08528185.

Action-Not Available
Vendor-rdkcentralMediaTek Inc.Google LLCOpenWrt
Product-mt6880mt6855mt6886mt8678mt6761mt6890mt6989mt6895mt6789mt6873mt6897androidmt6985mt6853mt6739openwrtmt6768mt8673mt6835mt6885mt6893mt6765mt6833mt8666mt6983mt8676mt8667mt6785mt6781rdk-bMT6739, MT6761, MT6765, MT6768, MT6781, MT6785, MT6789, MT6833, MT6835, MT6853, MT6855, MT6873, MT6880, MT6885, MT6886, MT6890, MT6893, MT6895, MT6897, MT6983, MT6985, MT6989, MT8666, MT8667, MT8673, MT8676, MT8678mt6895mt6886mt6785mt6765mt8676mt6739mt6880mt6835mt6989mt8673mt8667mt6893mt6789mt6873mt6761mt6890mt6781mt8666mt6833mt6985mt6768mt6885mt6983mt6855mt6897mt6853
CWE ID-CWE-20
Improper Input Validation
CVE-2021-4211
Matching Score-4
Assigner-Lenovo Group Ltd.
ShareView Details
Matching Score-4
Assigner-Lenovo Group Ltd.
CVSS Score-6.7||MEDIUM
EPSS-0.04% / 10.91%
||
7 Day CHG~0.00%
Published-22 Apr, 2022 | 20:30
Updated-03 Aug, 2024 | 17:16
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

A potential vulnerability in the SMI callback function used in the SMBIOS event log driver in some Lenovo Desktop, ThinkStation, and ThinkEdge models may allow an attacker with local access and elevated privileges to execute arbitrary code.

Action-Not Available
Vendor-Lenovo Group Limited
Product-a340-24ickthinkcentre_m90a_\(gen_2\)thinkcentre_m90a_\(gen_2\)_firmwarev30a-24imlthinkcentre_m910xideacentre_aio_3-27itl6_firmwarethinkcentre_m720eideacentre_aio_3-22ada6ideacentre_aio_3-27itl6se30_firmwareideacentre_aio_3-22ada6_firmwarethinkstation_p320a340-22icb_firmwarethinkcentre_m800thinkstation_p320_tinyv410z_firmwareideacentre_510s-07icbthinkcentre_m900thinkcentre_m910sthinkcentre_m710q_firmwarethinkstation_p320_firmwarev520thinkcentre_m710ethinkcentre_m710t_firmwarethinkcentre_m75n_firmwarethinkstation_p310_firmwarethinkcentre_m910qthinkstation_p310thinkcentre_m720e_firmwareideacentre_5-14iob6v530-15icb_firmwareideacentre_510s-07ick_firmwarev530s-07icb_firmwarethinkcentre_m810zthinkcentre_m800_firmwarethinkcentre_m75nthinkcentre_m810z_firmwareideacentre_5-14iob6_firmwarethinkcentre_m710qideacentre_aio_3-22itl6_firmwarethinkcentre_m710tv30a-24iml_firmwarethinkcentre_m70a_firmwarea340-22ickv530-15icrideacentre_aio_3-24ada6_firmwarev530s-07icbthinkcentre_m710e_firmwarethinkcentre_m900_firmwarev530-15icba540-27icbv520s_firmwareideacentre_aio_3-22iil5_firmwareideacentre_510s-07icb_firmwarea340-24ick_firmwarev410zthinkstation_p320_tiny_firmwarea340-24icb_firmwareideacentre_creator_5-14iob6se30thinkcentre_m900x_firmwarea540-27icb_firmwarethinkcentre_m700_tinyv30a-22imlv520_firmwareideacentre_aio_3-24itl6thinkcentre_m710q_\(10yc\)ideacentre_aio_3-24ada6a540-24icbthinkcentre_m70av30a-22iml_firmwarethinkcentre_m820z_firmwareideacentre_aio_3-24itl6_firmwarev530s-07icr_firmwarev540-24iwl_firmwareideacentre_510s-07icka540-24icb_firmwarev530s-07icrthinkcentre_m710s_firmwareideacentre_aio_3-22iil5thinkcentre_m910x_firmwarethinkcentre_m910s_firmwarethinkcentre_m820zthinkcentre_m910t_firmwarev50t-13iob_g2_firmwarev50t-13iob_g2a340-22icbthinkcentre_m710sideacentre_gaming_5-14iob6_firmwarethinkcentre_m900xideacentre_aio_3-24iil5thinkcentre_m710q_\(10yc\)_firmwareideacentre_gaming_5-14iob6v520sideacentre_aio_3-22itl6thinkcentre_m910tv530-15icr_firmwareideacentre_aio_3-24iil5_firmwarethinkcentre_m700_tiny_firmwarethinkcentre_m600_firmwareideacentre_creator_5-14iob6_firmwarea340-24icbv540-24iwlthinkcentre_m600thinkcentre_m910q_firmwarea340-22ick_firmwareBIOS
CWE ID-CWE-20
Improper Input Validation
CVE-2021-4210
Matching Score-4
Assigner-Lenovo Group Ltd.
ShareView Details
Matching Score-4
Assigner-Lenovo Group Ltd.
CVSS Score-6.7||MEDIUM
EPSS-0.11% / 30.04%
||
7 Day CHG~0.00%
Published-22 Apr, 2022 | 20:30
Updated-03 Aug, 2024 | 17:16
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

A potential vulnerability in the SMI callback function used in the NVME driver in some Lenovo Desktop, ThinkStation, and ThinkEdge models may allow an attacker with local access and elevated privileges to execute arbitrary code.

Action-Not Available
Vendor-Lenovo Group Limited
Product-thinkstation_p520_firmwareideacentre_aio_3-27itl6_firmwarethinkcentre_m910zideacentre_aio_3-27itl6ideacentre_aio_3-22ada6ideacentre_aio_3-22ada6_firmwarethinkcentre_m800v410z_firmwarethinkcentre_m900ideacentre_g5-14imb05_firmwarethinkstation_p520thinkcentre_m90a_gen2v50t-13imbthinkcentre_x1thinkcentre_m700thinkcentre_m75n_firmwarethinkstation_p310_firmwarethinkstation_p310thinkedge_se30thinkcentre_m700_firmwarethinkcentre_m810zthinkcentre_m800_firmwarethinkcentre_m75nthinkcentre_m810z_firmwareideacentre_aio_3-22itl6_firmwarethinkedge_se30_firmwarethinkcentre_m70a_firmwareideacentre_aio_3-24ada6_firmwarethinkcentre_m900_firmwarea540-27icbstadia_ggp-120_firmwareideacentre_aio_3-22iil5_firmwarev410zstadia_ggp-120ideacentre_c5-14imb05thinkcentre_m900x_firmwarea540-27icb_firmwareideacentre_5-14imb05thinkcentre_m700_tinyideacentre_aio_3-24itl6thinkstation_p520c_firmwarethinkcentre_m90a_gen2_firmwareideacentre_c5-14imb05_firmwarea540-24icbthinkcentre_m70aideacentre_aio_3-24ada6thinkcentre_m820z_firmwareideacentre_aio_3-24itl6_firmwarev540-24iwl_firmwarea540-24icb_firmwareideacentre_aio_3-22iil5ideacentre_5-14imb05_firmwarev50t-13imb_firmwarethinkcentre_m820zthinkcentre_m900xideacentre_aio_3-24iil5thinkcentre_m910z_firmwareideacentre_aio_3-22itl6ideacentre_g5-14imb05thinkcentre_x1_firmwareideacentre_aio_3-24iil5_firmwarethinkcentre_m700_tiny_firmwarev540-24iwlthinkstation_p520cBIOS
CWE ID-CWE-20
Improper Input Validation
CVE-2023-6395
Matching Score-4
Assigner-Red Hat, Inc.
ShareView Details
Matching Score-4
Assigner-Red Hat, Inc.
CVSS Score-6.7||MEDIUM
EPSS-0.41% / 60.70%
||
7 Day CHG~0.00%
Published-16 Jan, 2024 | 14:33
Updated-13 Feb, 2025 | 17:26
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Mock: privilege escalation for users that can access mock configuration

The Mock software contains a vulnerability wherein an attacker could potentially exploit privilege escalation, enabling the execution of arbitrary code with root user privileges. This weakness stems from the absence of proper sandboxing during the expansion and execution of Jinja2 templates, which may be included in certain configuration parameters. While the Mock documentation advises treating users added to the mock group as privileged, certain build systems invoking mock on behalf of users might inadvertently permit less privileged users to define configuration tags. These tags could then be passed as parameters to mock during execution, potentially leading to the utilization of Jinja2 templates for remote privilege escalation and the execution of arbitrary code as the root user on the build server.

Action-Not Available
Vendor-rpm-software-managementn/aRed Hat, Inc.Fedora Project
Product-mockextra_packages_for_enterprise_linuxfedoraRed Hat Enterprise Linux 6Extra Packages for Enterprise LinuxmockFedora
CWE ID-CWE-20
Improper Input Validation
CWE ID-CWE-94
Improper Control of Generation of Code ('Code Injection')
CVE-2021-35531
Matching Score-4
Assigner-Hitachi Energy
ShareView Details
Matching Score-4
Assigner-Hitachi Energy
CVSS Score-6.7||MEDIUM
EPSS-0.07% / 23.04%
||
7 Day CHG~0.00%
Published-07 Jun, 2022 | 20:07
Updated-16 Sep, 2024 | 16:12
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Remote Code Execution in TXpert Hub CoreTec 4

Improper Input Validation vulnerability in a particular configuration setting field of Hitachi Energy TXpert Hub CoreTec 4 product, allows an attacker with access to an authorized user with ADMIN or ENGINEER role rights to inject an OS command that is executed by the system. This issue affects: Hitachi Energy TXpert Hub CoreTec 4 version 2.0.0; 2.0.1; 2.1.0; 2.1.1; 2.1.2; 2.1.3; 2.2.0; 2.2.1.

Action-Not Available
Vendor-Hitachi Energy Ltd.
Product-txpert_hub_coretec_4_firmwaretxpert_hub_coretec_4TXpert Hub CoreTec 4 version
CWE ID-CWE-20
Improper Input Validation
CWE ID-CWE-78
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
  • Previous
  • 1
  • 2
  • 3
  • 4
  • 5
  • 6
  • 7
  • Next
Details not found