Vulnerabilities > Tianocore > High
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2022-01-03 | CVE-2021-38576 | Unspecified vulnerability in Tianocore Edk2 A BIOS bug in firmware for a particular PC model leaves the Platform authorization value empty. | 7.5 |
| 2021-12-01 | CVE-2021-38575 | Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in multiple products NetworkPkg/IScsiDxe has remotely exploitable buffer overflows. | 8.1 |
| 2021-08-05 | CVE-2021-28216 | Release of Invalid Pointer or Reference vulnerability in Tianocore EDK II BootPerformanceTable pointer is read from an NVRAM variable in PEI. | 7.8 |
| 2021-06-11 | CVE-2021-28210 | Uncontrolled Recursion vulnerability in Tianocore Edk2 An unlimited recursion in DxeCore in EDK II. | 7.8 |
| 2021-06-11 | CVE-2021-28213 | Unspecified vulnerability in Tianocore Edk2 201905 Example EDK2 encrypted private key in the IpSecDxe.efi present potential security risks. | 7.5 |
| 2021-06-03 | CVE-2019-14584 | NULL Pointer Dereference vulnerability in Tianocore Edk2 20171107 Null pointer dereference in Tianocore EDK2 may allow an authenticated user to potentially enable escalation of privilege via local access. | 7.8 |
| 2020-11-23 | CVE-2019-14586 | Use After Free vulnerability in multiple products Use after free vulnerability in EDK II may allow an authenticated user to potentially enable escalation of privilege, information disclosure and/or denial of service via adjacent access. | 8.0 |
| 2020-11-23 | CVE-2019-14575 | Logic issue in DxeImageVerificationHandler() for EDK II may allow an authenticated user to potentially enable escalation of privilege via local access. | 7.8 |
| 2020-11-23 | CVE-2019-14563 | Incorrect Conversion between Numeric Types vulnerability in multiple products Integer truncation in EDK II may allow an authenticated user to potentially enable escalation of privilege via local access. | 7.8 |
| 2020-11-23 | CVE-2019-14559 | Memory Leak vulnerability in Tianocore Edk2 Uncontrolled resource consumption in EDK II may allow an unauthenticated user to potentially enable denial of service via network access. | 7.5 |