Advisories · Technology
Insyde Software InsydeH2O.
Every CVE that names Insyde Software InsydeH2O among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 8.2 High
H19WMIHandlerSmm: unvalidated memory boundary could result in arbitrary code execution.
- Insyde Software InsydeH2O
- CWE-20
- CVSS 8.2 High
UEFI BIOS embedded Shell can be used to bypass Secure Boot
- Insyde Software InsydeH2O
- CWE-489
- CVSS 8.2 High
HDD Password Stored In Plaintext
- Insyde Software InsydeH2O
- CWE-256
- CVSS 6.7 Medium
VariableEditSmm: Error checking of UEFI variables could cause buffer overflow, leading to code execution
- Insyde Software InsydeH2O
- Memory corruption
- CVSS 6.5 Medium
SysPasswordDxe: Password hashes are exposed in runtime UEFI variables, leading to escalation of privilege
- Insyde Software InsydeH2O
- Broken access control
- CVSS 2.7 Low
FMTSWriteUseIntelLib: FMTS SMM IHISI Buffer Overflow
- Insyde Software InsydeH2O
- Memory corruption
- CVSS 8.2 High
Lack of verified boot to certain FV may cause arbitrary code execution
- Insyde Software InsydeH2O
- CWE-1277
- CVSS 8.2 High
H19Int15CallbackSmm: SMM memory corruption vulnerability in combined DXE/SMM (SMRAM write)
- Insyde Software InsydeH2O
- Memory corruption
- CVSS 7.5 High
SetupUtility: A buffer overflow vulnerability leads to arbitrary code execution.
- Insyde Software InsydeH2O
- CWE-20
- CVSS 7.5 High
Tcg2Smm: improper input validation may lead to arbitrary code execution
- Insyde Software InsydeH2O
- CWE-20
- CVSS 7.5 High
UsbCoreDxe: improper input validation may lead to arbitrary code execution
- Insyde Software InsydeH2O
- CWE-20
- CVSS 6.0 Medium
SetupAutomationSmm : SMRAM memory contents leak / information disclosure vulnerability in SMM module
- Insyde Software InsydeH2O
- Information disclosure
- CVSS 8.2 High
SetupAutomationSmm: Stack overflow vulnerability in SMI handler
- Insyde Software InsydeH2O
- Memory corruption
- CVSS 6.0 Medium
SetupAutomationSmm : Arbitrary calls to SmmSetVariable with unsanitised arguments in SMI handler
- Insyde Software InsydeH2O
- CWE-20
- CVSS 8.2 High
SetupAutomationSmm:Vulnerability in the SMM module allow attacker to write arbitrary code and lead to memory corruption
- Insyde Software InsydeH2O
- Memory corruption
- CVSS 8.2 High
EfiSmiServices : EfiPcdProtocol, SMM memory corruption vulnerabilities in SMM module
- Insyde Software InsydeH2O
- Memory corruption
- CVSS 8.2 High
EfiSmiServices: gEfiSmmCpuProtocol, SMM memory corruption vulnerabilities in SMM module
- Insyde Software InsydeH2O
- Memory corruption
- CVSS 7.8 High
SecureFlashDxe: Incorrect UEFI variable attributes check allows usage of invalid certificate
- Insyde Software InsydeH2O