Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2022-42908

Publication date:

03/02/2023

WEPA Print Away is vulnerable to a stored XSS. It does not properly sanitize uploaded filenames, allowing an attacker to deceive a user into uploading a document with a malicious filename, which will be included in subsequent HTTP responses, allowing a stored XSS to occur. This attack is persistent across victim sessions.

Severity CVSS v4.0: Pending analysis

Last modification:

10/02/2023

CVE-2022-31733

Publication date:

03/02/2023

Starting with diego-release 2.55.0 and up to 2.69.0, and starting with CF Deployment 17.1 and up to 23.2.0, apps are accessible via another port on diego cells, allowing application ingress without a client certificate. If mTLS route integrity is enabled AND unproxied ports are turned off, then an attacker could connect to an application that should be only reachable via mTLS, without presenting a client certificate.

Severity CVSS v4.0: Pending analysis

Last modification:

25/03/2025

CVE-2023-23088

Publication date:

03/02/2023

Buffer OverFlow Vulnerability in Barenboim json-parser master and v1.1.0 fixed in v1.1.1 allows an attacker to execute arbitrary code via the json_value_parse function.

Severity CVSS v4.0: Pending analysis

Last modification:

26/03/2025

CVE-2023-23087

Publication date:

03/02/2023

An issue was found in MojoJson v1.2.3 allows attackers to execute arbitary code via the destroy function.

Severity CVSS v4.0: Pending analysis

Last modification:

26/03/2025

CVE-2023-0659

Publication date:

03/02/2023

A vulnerability was found in BDCOM 1704-WGL 2.0.6314. It has been classified as critical. This affects an unknown part of the file /param.file.tgz of the component Backup File Handler. The manipulation leads to information disclosure. It is possible to initiate the attack remotely. The identifier VDB-220101 was assigned to this vulnerability.

Severity CVSS v4.0: Pending analysis

Last modification:

17/05/2024

CVE-2023-23086

Publication date:

03/02/2023

Buffer OverFlow Vulnerability in MojoJson v1.2.3 allows an attacker to execute arbitrary code via the SkipString function.

Severity CVSS v4.0: Pending analysis

Last modification:

26/03/2025

CVE-2021-37519

Publication date:

03/02/2023

Buffer Overflow vulnerability in authfile.c memcached 1.6.9 allows attackers to cause a denial of service via crafted authenticattion file.

Severity CVSS v4.0: Pending analysis

Last modification:

26/03/2025

CVE-2021-37518

Publication date:

03/02/2023

Universal Cross Site Scripting (UXSS) vulnerability in Vimium Extension 1.66 and earlier allows remote attackers to run arbitrary code via omnibar feature.

Severity CVSS v4.0: Pending analysis

Last modification:

26/03/2025

CVE-2021-37502

Publication date:

03/02/2023

Cross Site Scripting (XSS) vulnerability in automad 1.7.5 allows remote attackers to run arbitrary code via the user name field when adding a user.

Severity CVSS v4.0: Pending analysis

Last modification:

26/03/2025

CVE-2021-37497

Publication date:

03/02/2023

SQL injection vulnerability in route of PbootCMS 3.0.5 allows remote attackers to run arbitrary SQL commands via crafted GET request.

Severity CVSS v4.0: Pending analysis

Last modification:

04/04/2025

CVE-2021-37379

Publication date:

03/02/2023

Cross Site Scripting (XSS) vulnerability in Teradek Sphere all firmware versions allows remote attackers to run arbitrary code via the Friendly Name field in System Information Settings. NOTE: Vedor states the product has reached End of Life and will not be receiving any firmware updates to address this issue.

Severity CVSS v4.0: Pending analysis

Last modification:

04/08/2024

CVE-2021-37377

Publication date:

03/02/2023

Cross Site Scripting (XSS) vulnerability in Teradek Brik firmware version 7.2.x and earlier allows remote attackers to run arbitrary code via the Friendly Name field in System Information Settings. NOTE: Vedor states the product has reached End of Life and will not be receiving any firmware updates to address this issue.

Severity CVSS v4.0: Pending analysis

Last modification:

04/08/2024

Subscribe to Vulnerabilities