Tianocore vulnerabilities, page 2
52 vulnerabilities
Known vulnerabilities in Tianocore products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 2 products.
CVE-2014-8271tianocoreedk2
EPSS score0.40%
Buffer overflow in the Reclaim function in Tianocore EDK2 before SVN 16280 allows physically proximate attackers to gain privileges via a long variable name.CVE-2022-36763debianedk2+2EPSS score0.29%
EDK2 is susceptible to a vulnerability in the Tcg2MeasureGptTable() function, allowing a user to trigger a heap buffer overflow via a local network. Successful exploitation of this vulnerability may result in a compromise of confidentiality, integrity, and/or availability.CVE-2022-36765debianedk2+19EPSS score0.29%
EDK2 is susceptible to a vulnerability in the CreateHob() function, allowing a user to trigger a integer overflow to buffer overflow via a local network. Successful exploitation of this vulnerability may result in a compromise of confidentiality, integrity, and/or availability.CVE-2022-36764debianedk2+2EPSS score0.29%
EDK2 is susceptible to a vulnerability in the Tcg2MeasurePeImage() function, allowing a user to trigger a heap buffer overflow via a local network. Successful exploitation of this vulnerability may result in a compromise of confidentiality, integrity, and/or availability.CVE-2017-5731ubuntuedk2+1EPSS score0.39%
Bounds checking in Tianocompress before November 7, 2017 may allow an authenticated user to potentially enable an escalation of privilege via local access.CVE-2024-1298debianedk2+15EPSS score0.22%
EDK2 contains a vulnerability when S3 sleep is activated where an Attacker may cause a Division-By-Zero due to a UNIT32 overflow via local access. A successful exploit of this vulnerability may lead to a loss of Availability.CVE-2024-38796debianedk2+9EPSS score0.37%
EDK2 contains a vulnerability in the PeCoffLoaderRelocateImage(). An Attacker may cause memory corruption due to an overflow via an adjacent network. A successful exploit of this vulnerability may lead to a loss of Confidentiality, Integrity, and/or Availability.CVE-2024-38798debianedk2+2EPSS score0.14%
EDK2 contains a vulnerability in BIOS where an attacker may cause “Exposure of Sensitive Information to an Unauthorized Actor” by local access. Successful exploitation of this vulnerability will lead to
possible information disclosure or escalation of privilege
and impact Confidentiality.CVE-2024-38805debianedk2+2EPSS score0.21%
EDK2 contains a vulnerability in BIOS where a user may cause an Integer Overflow or Wraparound by network means. A successful exploitation of this vulnerability may lead to denial of service.CVE-2024-38797debianedk2+2EPSS score0.21%
EDK2 contains a vulnerability in the HashPeImageByType(). A user may cause a read out of bounds when a corrupted data pointer and length are sent via an adjecent network. A successful exploit of this vulnerability may lead to a loss of Integrity and/or Availability.CVE-2019-11098debianedk2+21EPSS score0.34%
Insufficient input validation in MdeModulePkg in EDKII may allow an unauthenticated user to potentially enable escalation of privilege, denial of service and/or information disclosure via physical access.CVE-2019-0161debianedk2+10EPSS score0.40%
Stack overflow in XHCI for EDK II may allow an unauthenticated user to potentially enable denial of service via local access.CVE-2019-0160debianedk2+9EPSS score1.34%
Buffer overflow in system firmware for EDK II may allow unauthenticated user to potentially enable escalation of privilege and/or denial of service via network access.CVE-2019-14563debianedk2+6EPSS score0.40%
Integer truncation in EDK II may allow an authenticated user to potentially enable escalation of privilege via local access.CVE-2019-14587debianedk2+3EPSS score0.64%
Logic issue EDK II may allow an unauthenticated user to potentially enable denial of service via adjacent access.CVE-2019-14584debianedk2+10EPSS score0.33%
Null pointer dereference in Tianocore EDK2 may allow an authenticated user to potentially enable escalation of privilege via local access.CVE-2019-14553debianedk2+2EPSS score1.36%
Improper authentication in EDK II may allow a privileged user to potentially enable information disclosure via network access.CVE-2019-14586debianedk2+3EPSS score0.74%
Use after free vulnerability in EDK II may allow an authenticated user to potentially enable escalation of privilege, information disclosure and/or denial of service via adjacent access.CVE-2019-14559debianedk2+11EPSS score1.32%
Uncontrolled resource consumption in EDK II may allow an unauthenticated user to potentially enable denial of service via network access.CVE-2019-14562debianedk2+17EPSS score0.31%
Integer overflow in DxeImageVerificationHandler() EDK II may allow an authenticated user to potentially enable denial of service via local access.