CVE-2019-16284

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

A potential security vulnerability has been identified in multiple HP products and versions which involves possible execution of arbitrary code during boot services that can result in elevation of privilege. The EFI_BOOT_SERVICES structure might be overwritten by an attacker to execute arbitrary SMM (System Management Mode) code. A list of affected products and versions are available in https://support.hp.com/rs-en/document/c06456250.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Affected software

Vendor	Product	Versions
HP Inc.	Multiple - See https://support.hp.com/rs-en/document/c06456250	Multiple - See https://support.hp.com/rs-en/document/c06456250

References

https://support.hp.com/rs-en/document/c06456250Vendor Advisory
https://support.hp.com/rs-en/document/c06456250Vendor Advisory

Timeline

Published: Nov 5, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-162854.6If a local user has been configured and logged in, an unauthenticated attacker with physical access may be able to extract sensitive informa CVE-2019-162866.8An attacker may be able to bypass the OS application filter meant to restrict applications that can be executed by changing browser preferen CVE-2019-162876.8In HP ThinPro Linux 6.2, 6.2.1, 7.0 and 7.1, an attacker may be able to leverage the application filter bypass vulnerability to gain privile CVE-2019-162887.5On Tenda N301 wireless routers, a long string in the wifiSSID parameter of a goform/setWifi POST request causes the device to crash.CVE-2019-162895.4The insert-php (aka Woody ad snippets) plugin before 2.2.8 for WordPress allows authenticated XSS via the winp_item parameter.CVE-2019-16295.3A vulnerability in the configuration import utility of Cisco Integrated Management Controller (IMC) could allow an unauthenticated, remote a CVE-2019-162938.8The Create Discoveries feature of Open-AudIT before 3.2.0 allows an authenticated attacker to execute arbitrary OS commands via a crafted va CVE-2019-162947.8SciLexer.dll in Scintilla in Notepad++ (x64) before 7.7 allows remote code execution or denial of service via Unicode characters in a crafte CVE-2019-162954.6Stored XSS in filemanager2.php in CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.885 exists via the cmd_arg parameter. This can be exp CVE-2019-162977.5An issue was discovered in Open Network Operating System (ONOS) 1.14. In the P4 tutorial application (org.onosproject.p4tutorial), the host CVE-2019-162987.5An issue was discovered in Open Network Operating System (ONOS) 1.14. In the virtual broadband network gateway application (org.onosproject.CVE-2019-162997.5An issue was discovered in Open Network Operating System (ONOS) 1.14. In the mobility application (org.onosproject.mobility), the host event