Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

Go to Calendar     Go to Press Room     Go to Newsletters subscription

Search

Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2021-26356
Publication date:
09/05/2023
A TOCTOU in ASP bootloader may allow an attacker<br /> to tamper with the SPI ROM following data read to memory potentially resulting<br /> in S3 data corruption and information disclosure.<br /> <br /> <br /> <br /> <br /> <br /> <br /> <br /> <br />
Severity CVSS v4.0: Pending analysis
Last modification:
28/01/2025

CVE-2021-26379
Publication date:
09/05/2023
Insufficient input validation of mailbox data in the<br /> SMU may allow an attacker to coerce the SMU to corrupt SMRAM, potentially<br /> leading to a loss of integrity and privilege escalation.<br /> <br /> <br /> <br />
Severity CVSS v4.0: Pending analysis
Last modification:
28/01/2025

CVE-2021-26371
Publication date:
09/05/2023
A compromised or malicious ABL or UApp could<br /> send a SHA256 system call to the bootloader, which may result in exposure of<br /> ASP memory to userspace, potentially leading to information disclosure.<br /> <br /> <br /> <br /> <br /> <br /> <br /> <br /> <br />
Severity CVSS v4.0: Pending analysis
Last modification:
28/01/2025

CVE-2021-26354
Publication date:
09/05/2023
Insufficient bounds checking in ASP may allow an<br /> attacker to issue a system call from a compromised ABL which may cause<br /> arbitrary memory values to be initialized to zero, potentially leading to a<br /> loss of integrity.<br /> <br /> <br /> <br /> <br />
Severity CVSS v4.0: Pending analysis
Last modification:
28/01/2025

CVE-2021-26365
Publication date:
09/05/2023
Certain size values in firmware binary headers<br /> could trigger out of bounds reads during signature validation, leading to<br /> denial of service or potentially limited leakage of information about<br /> out-of-bounds memory contents.<br /> <br /> <br /> <br /> <br /> <br /> <br /> <br /> <br /> <br /> <br /> <br />
Severity CVSS v4.0: Pending analysis
Last modification:
28/01/2025

CVE-2021-26397
Publication date:
09/05/2023
Insufficient address validation, may allow an<br /> attacker with a compromised ABL and UApp to corrupt sensitive memory locations<br /> potentially resulting in a loss of integrity or availability.<br /> <br /> <br /> <br /> <br /> <br /> <br /> <br />
Severity CVSS v4.0: Pending analysis
Last modification:
28/01/2025

CVE-2021-46749
Publication date:
09/05/2023
Insufficient bounds checking in ASP (AMD Secure<br /> Processor) may allow for an out of bounds read in SMI (System Management<br /> Interface) mailbox checksum calculation triggering a data abort, resulting in a<br /> potential denial of service.<br /> <br /> <br /> <br /> <br />
Severity CVSS v4.0: Pending analysis
Last modification:
28/01/2025

CVE-2021-26406
Publication date:
09/05/2023
Insufficient validation in parsing Owner&amp;#39;s<br /> Certificate Authority (OCA) certificates in SEV (AMD Secure Encrypted Virtualization)<br /> and SEV-ES user application can lead to a host crash potentially resulting in<br /> denial of service.<br /> <br /> <br /> <br /> <br />
Severity CVSS v4.0: Pending analysis
Last modification:
28/01/2025

CVE-2023-29341
Publication date:
09/05/2023
AV1 Video Extension Remote Code Execution Vulnerability
Severity CVSS v4.0: Pending analysis
Last modification:
29/05/2024

CVE-2023-31474
Publication date:
09/05/2023
An issue was discovered on GL.iNet devices before 3.216. Through the software installation feature, it is possible to inject arbitrary parameters in a request to cause opkg to obtain a list of files in a specific directory, by using the regex feature in a package name.
Severity CVSS v4.0: Pending analysis
Last modification:
29/01/2025

CVE-2023-29343
Publication date:
09/05/2023
SysInternals Sysmon for Windows Elevation of Privilege Vulnerability
Severity CVSS v4.0: Pending analysis
Last modification:
29/05/2024

CVE-2023-31472
Publication date:
09/05/2023
An issue was discovered on GL.iNet devices before 3.216. There is an arbitrary file write in which an empty file can be created anywhere on the filesystem. This is caused by a command injection vulnerability with a filter applied.
Severity CVSS v4.0: Pending analysis
Last modification:
29/01/2025
Subscribe to Vulnerabilities