CVE-2022-34301

A flaw was found in CryptoPro Secure Disk bootloaders before 2022-06-01. An attacker may use this bootloader to bypass or tamper with Secure Boot protections. In order to load and execute arbitrary code in the pre-boot stage, an attacker simply needs to replace the existing signed bootloader currently in use with this bootloader. Access to the EFI System Partition is required for booting using external media.

• https://edk2-docs.gitbook.io/understanding-the-uefi-secure-boot-chain/secure_boot_chain_in_uefi/uefi_secure_bootThird Party Advisory
• https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01001.html
• https://www.kb.cert.org/vuls/id/309662Third Party Advisory, US Government Resource
• https://edk2-docs.gitbook.io/understanding-the-uefi-secure-boot-chain/secure_boot_chain_in_uefi/uefi_secure_bootThird Party Advisory
• https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01001.html
• https://www.kb.cert.org/vuls/id/309662Third Party Advisory, US Government Resource

Published

Aug 26, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-34296In Zalando Skipper before 0.13.218, a query predicate could …7.5
• CVE-2022-34297Yii Yii2 Gii through 2.2.4 allows stored XSS by injecting a …5.4
• CVE-2022-34298The NT auth module in OpenAM before 14.6.6 allows a "replace…5.3
• CVE-2022-34299There is a heap-based buffer over-read in libdwarf 0.4.0. Th…8.1
• CVE-2022-3430A potential vulnerability in the WMI Setup driver on some co…6.7
• CVE-2022-34300In tinyexr 1.0.1, there is a heap-based buffer over-read in …8.8
• CVE-2022-34302A flaw was found in New Horizon Datasys bootloaders before 2…6.7
• CVE-2022-34303A flaw was found in Eurosoft bootloaders before 2022-06-01. …6.7
• CVE-2022-34305In Apache Tomcat 10.1.0-M1 to 10.1.0-M16, 10.0.0-M1 to 10.0.…6.1
• CVE-2022-34306IBM CICS TX Standard and Advanced 11.1 is vulnerable to HTTP…5.4
• CVE-2022-34307IBM CICS TX 11.1 does not set the secure attribute on author…4.3
• CVE-2022-34308IBM CICS TX 11.1 could allow a local user to cause a denial …5.5