Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

Go to Calendar     Go to Press Room     Go to Newsletters subscription

Search

Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2022-24351
Publication date:
16/12/2023
TOCTOU race-condition vulnerability in Insyde InsydeH2O with Kernel 5.2 before version 05.27.29, Kernel 5.3 before version 05.36.29, Kernel 5.4 version before 05.44.13, and Kernel 5.5 before version 05.52.13 allows an attacker to alter data and code used by the remainder of the boot process.
Severity CVSS v4.0: Pending analysis
Last modification:
20/12/2023

CVE-2023-31813
Publication date:
16/12/2023
Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: CVE-2023-2804. Reason: This record is a duplicate of CVE-2023-2804. Notes: All CVE users should reference CVE-2023-2804 instead of this record. All references and descriptions in this record have been removed to prevent accidental usage.
Severity CVSS v4.0: Pending analysis
Last modification:
16/12/2023

CVE-2023-39340
Publication date:
16/12/2023
A vulnerability exists on all versions of Ivanti Connect Secure below 22.6R2 where an attacker can send a specific request which may lead to Denial of Service (DoS) of the appliance.
Severity CVSS v4.0: Pending analysis
Last modification:
20/12/2023

CVE-2021-42794
Publication date:
16/12/2023
An issue was discovered in AVEVA Edge (formerly InduSoft Web Studio) versions R2020 and prior. The application allows a client to provide a malicious connection string that could allow an adversary to port scan the LAN, depending on the hosts' responses.
Severity CVSS v4.0: Pending analysis
Last modification:
20/12/2023

CVE-2021-42796
Publication date:
16/12/2023
An issue was discovered in ExecuteCommand() in AVEVA Edge (formerly InduSoft Web Studio) versions R2020 and prior that allows unauthenticated arbitrary commands to be executed.
Severity CVSS v4.0: Pending analysis
Last modification:
07/10/2024

CVE-2021-42797
Publication date:
16/12/2023
Path traversal vulnerability in AVEVA Edge (formerly InduSoft Web Studio) versions R2020 and prior allows an unauthenticated user to steal the Windows access token of the user account configured for accessing external DB resources.
Severity CVSS v4.0: Pending analysis
Last modification:
20/12/2023

CVE-2020-17483
Publication date:
16/12/2023
An improper access control vulnerability exists in Uffizio's GPS Tracker all versions that lead to sensitive information disclosure of all the connected devices. By visiting the vulnerable host at port 9000, we see it responds with a JSON body that has all the details about the devices which have been deployed.
Severity CVSS v4.0: Pending analysis
Last modification:
17/06/2026

CVE-2020-17484
Publication date:
16/12/2023
An Open Redirection vulnerability exists in Uffizio's GPS Tracker all versions allows an attacker to construct a URL within the application that causes a redirection to an arbitrary external domain.
Severity CVSS v4.0: Pending analysis
Last modification:
17/06/2026

CVE-2020-17485
Publication date:
16/12/2023
A Remote Code Execution vulnerability exist in Uffizio's GPS Tracker all versions. The web server can be compromised by uploading and executing a web/reverse shell. An attacker could then run commands, browse system files, and browse local resources
Severity CVSS v4.0: Pending analysis
Last modification:
17/06/2026

CVE-2023-27317
Publication date:
15/12/2023
ONTAP 9 versions 9.12.1P8, 9.13.1P4, and 9.13.1P5 are susceptible to a <br /> vulnerability which will cause all SAS-attached FIPS 140-2 drives to <br /> become unlocked after a system reboot or power cycle or a single <br /> SAS-attached FIPS 140-2 drive to become unlocked after reinsertion. This<br /> could lead to disclosure of sensitive information to an attacker with <br /> physical access to the unlocked drives. <br /> <br />
Severity CVSS v4.0: Pending analysis
Last modification:
19/12/2023

CVE-2023-28022
Publication date:
15/12/2023
HCL Connections is vulnerable to an information disclosure vulnerability which could allow a user to obtain sensitive information they are not entitled to, caused by improper handling of request data.<br />
Severity CVSS v4.0: Pending analysis
Last modification:
20/12/2023

CVE-2023-50728
Publication date:
15/12/2023
octokit/webhooks is a GitHub webhook events toolset for Node.js. Starting in 9.26.0 and prior to 9.26.3, 10.9.2, 11.1.2, and 12.0.4, there is a problem caused by an issue with error handling in the @octokit/webhooks library because the error can be undefined in some cases. The resulting request was found to cause an uncaught exception that ends the nodejs process. The bug is fixed in octokit/webhooks.js 9.26.3, 10.9.2, 11.1.2, and 12.0.4, app.js 14.02, octokit.js 3.1.2, and Protobot 12.3.3.
Severity CVSS v4.0: Pending analysis
Last modification:
19/12/2023
Subscribe to Vulnerabilities