U.S. flag   An official website of the United States government
Dot gov

Official websites use .gov
A .gov website belongs to an official government organization in the United States.

Https

Secure .gov websites use HTTPS
A lock (Dot gov) or https:// means you've safely connected to the .gov website. Share sensitive information only on official, secure websites.

Search Results (Refine Search)

Search Parameters:
  • Results Type: Overview
  • Keyword (text search): cpe:2.3:a:tianocore:edk2:202008:*:*:*:*:*:*:*
  • CPE Name Search: true
There are 17 matching records.
Displaying matches 1 through 17.
Vuln ID Summary CVSS Severity
CVE-2023-45237

EDK2's Network Package is susceptible to a predictable TCP Initial Sequence Number. This vulnerability can be exploited by an attacker to gain unauthorized access and potentially lead to a loss of Confidentiality.

Published: January 16, 2024; 11:15:13 AM -0500
V3.1: 7.5 HIGH
V2.0:(not available)
CVE-2023-45236

EDK2's Network Package is susceptible to a predictable TCP Initial Sequence Number. This vulnerability can be exploited by an attacker to gain unauthorized access and potentially lead to a loss of Confidentiality.

Published: January 16, 2024; 11:15:12 AM -0500
V3.1: 7.5 HIGH
V2.0:(not available)
CVE-2023-45235

EDK2's Network Package is susceptible to a buffer overflow vulnerability when handling Server ID option from a DHCPv6 proxy Advertise message. This vulnerability can be exploited by an attacker to gain unauthorized access and potentially lead to a loss of Confidentiality, Integrity and/or Availability.

Published: January 16, 2024; 11:15:12 AM -0500
V3.1: 8.8 HIGH
V2.0:(not available)
CVE-2023-45234

EDK2's Network Package is susceptible to a buffer overflow vulnerability when processing DNS Servers option from a DHCPv6 Advertise message. This vulnerability can be exploited by an attacker to gain unauthorized access and potentially lead to a loss of Confidentiality, Integrity and/or Availability.

Published: January 16, 2024; 11:15:12 AM -0500
V3.1: 8.8 HIGH
V2.0:(not available)
CVE-2023-45233

EDK2's Network Package is susceptible to an infinite lop vulnerability when parsing a PadN option in the Destination Options header of IPv6. This vulnerability can be exploited by an attacker to gain unauthorized access and potentially lead to a loss of Availability.

Published: January 16, 2024; 11:15:12 AM -0500
V3.1: 7.5 HIGH
V2.0:(not available)
CVE-2023-45232

EDK2's Network Package is susceptible to an infinite loop vulnerability when parsing unknown options in the Destination Options header of IPv6. This vulnerability can be exploited by an attacker to gain unauthorized access and potentially lead to a loss of Availability.

Published: January 16, 2024; 11:15:12 AM -0500
V3.1: 7.5 HIGH
V2.0:(not available)
CVE-2023-45231

EDK2's Network Package is susceptible to an out-of-bounds read vulnerability when processing  Neighbor Discovery Redirect message. This vulnerability can be exploited by an attacker to gain unauthorized access and potentially lead to a loss of Confidentiality.

Published: January 16, 2024; 11:15:11 AM -0500
V3.1: 6.5 MEDIUM
V2.0:(not available)
CVE-2023-45230

EDK2's Network Package is susceptible to a buffer overflow vulnerability via a long server ID option in DHCPv6 client. This vulnerability can be exploited by an attacker to gain unauthorized access and potentially lead to a loss of Confidentiality, Integrity and/or Availability.

Published: January 16, 2024; 11:15:11 AM -0500
V3.1: 8.8 HIGH
V2.0:(not available)
CVE-2023-45229

EDK2's Network Package is susceptible to an out-of-bounds read vulnerability when processing the IA_NA or IA_TA option in a DHCPv6 Advertise message. This vulnerability can be exploited by an attacker to gain unauthorized access and potentially lead to a loss of Confidentiality.

Published: January 16, 2024; 11:15:11 AM -0500
V3.1: 6.5 MEDIUM
V2.0:(not available)
CVE-2022-36765

EDK2 is susceptible to a vulnerability in the CreateHob() function, allowing a user to trigger a integer overflow to buffer overflow via a local network. Successful exploitation of this vulnerability may result in a compromise of confidentiality, integrity, and/or availability.

Published: January 09, 2024; 11:15:43 AM -0500
V3.1: 7.8 HIGH
V2.0:(not available)
CVE-2022-36764

EDK2 is susceptible to a vulnerability in the Tcg2MeasurePeImage() function, allowing a user to trigger a heap buffer overflow via a local network. Successful exploitation of this vulnerability may result in a compromise of confidentiality, integrity, and/or availability.

Published: January 09, 2024; 11:15:43 AM -0500
V3.1: 7.8 HIGH
V2.0:(not available)
CVE-2022-36763

EDK2 is susceptible to a vulnerability in the Tcg2MeasureGptTable() function, allowing a user to trigger a heap buffer overflow via a local network. Successful exploitation of this vulnerability may result in a compromise of confidentiality, integrity, and/or availability.

Published: January 09, 2024; 11:15:43 AM -0500
V3.1: 7.8 HIGH
V2.0:(not available)
CVE-2021-38578

Existing CommBuffer checks in SmmEntryPoint will not catch underflow when computing BufferSize.

Published: March 03, 2022; 5:15:08 PM -0500
V3.1: 9.8 CRITICAL
V2.0: 7.5 HIGH
CVE-2021-38576

A BIOS bug in firmware for a particular PC model leaves the Platform authorization value empty. This can be used to permanently brick the TPM in multiple ways, as well as to non-permanently DoS the system.

Published: January 03, 2022; 5:15:09 PM -0500
V3.1: 7.5 HIGH
V2.0: 7.8 HIGH
CVE-2021-38575

NetworkPkg/IScsiDxe has remotely exploitable buffer overflows.

Published: December 01, 2021; 1:15:07 PM -0500
V3.1: 8.1 HIGH
V2.0: 6.8 MEDIUM
CVE-2021-28211

A heap overflow in LzmaUefiDecompressGetInfo function in EDK II.

Published: June 11, 2021; 12:15:12 PM -0400
V3.1: 6.7 MEDIUM
V2.0: 4.6 MEDIUM
CVE-2014-8271

Buffer overflow in the Reclaim function in Tianocore EDK2 before SVN 16280 allows physically proximate attackers to gain privileges via a long variable name.

Published: February 06, 2020; 10:15:10 AM -0500
V3.1: 6.8 MEDIUM
V2.0: 4.6 MEDIUM