CVE-2023-31276

HighCVSS 8.2/10Last modified Jun 17, 2026

Description

Heap-based buffer overflow in BMC Firmware for the Intel(R) Server Board S2600WF, Intel(R) Server Board S2600ST, Intel(R) Server Board S2600BP, before version 02.01.0017 and Intel(R) Server Board M50CYP and Intel(R) Server Board D50TNP before version R01.01.0009 may allow a privileged user to enable escalation of privilege via local access.

Metrics

CVSS 3.1 8.2/10CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-122

Affected software

No affected versions have been published.

Timeline

Published: Feb 12, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2023

CVE-2023-312777.5PiiGAB M-Bus transmits credentials in plaintext format.CVE-2023-312787.8Horner Automation Cscape lacks proper validation of user-supplied data when parsing project files (e.g., HMI). This could lead to an out-of-CVE-2023-312798.1The AirVantage platform is vulnerable to an unauthorized attacker registering previously unregistered devices on the AirVantage platform wh CVE-2023-31289.8Grafana is validating Azure AD accounts based on the email claim. On Azure AD, the profile email field is not unique and can be easily mod CVE-2023-312805.3An AirVantage online Warranty Checker tool vulnerability could allow an attacker to perform bulk enumeration of IMEI and Serial Numbers pai CVE-2023-312847.8illumos illumos-gate before 676abcb has a stack buffer overflow in /dev/net, leading to privilege escalation via a stat on a long file name CVE-2023-312856.1An XSS issue was discovered in Serenity Serene (and StartSharp) before 6.7.0. When users upload temporary files, some specific file endings CVE-2023-312865.3An issue was discovered in Serenity Serene (and StartSharp) before 6.7.0. When a password reset request occurs, the server response leaks th CVE-2023-312877.8An issue was discovered in Serenity Serene (and StartSharp) before 6.7.0. Password reset links are sent by email. A link contains a token th CVE-2023-312897.5Pexip Infinity before 31.2 has Improper Input Validation for signalling, allowing remote attackers to trigger an abort.CVE-2023-31294.8The URL Shortify WordPress plugin before 1.7.0 does not sanitise and escape some of its settings, which could allow high privilege users suc CVE-2023-312905.9Trust Wallet Core before 3.1.1, as used in the Trust Wallet browser extension before 0.0.183, allows theft of funds because the entropy is 3