Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2022-39201

Publication date:

13/10/2022

Grafana is an open source observability and data visualization platform. Starting with version 5.0.0-beta1 and prior to versions 8.5.14 and 9.1.8, Grafana could leak the authentication cookie of users to plugins. The vulnerability impacts data source and plugin proxy endpoints under certain conditions. The destination plugin could receive a user&#39;s Grafana authentication cookie. Versions 9.1.8 and 8.5.14 contain a patch for this issue. There are no known workarounds.

Severity CVSS v4.0: Pending analysis

Last modification:

19/10/2022

CVE-2022-39229

Publication date:

13/10/2022

Grafana is an open source data visualization platform for metrics, logs, and traces. Versions prior to 9.1.8 and 8.5.14 allow one user to block another user&#39;s login attempt by registering someone else&#39;e email address as a username. A Grafana user’s username and email address are unique fields, that means no other user can have the same username or email address as another user. A user can have an email address as a username. However, the login system allows users to log in with either username or email address. Since Grafana allows a user to log in with either their username or email address, this creates an usual behavior where `user_1` can register with one email address and `user_2` can register their username as `user_1`’s email address. This prevents `user_1` logging into the application since `user_1`&#39;s password won’t match with `user_2`&#39;s email address. Versions 9.1.8 and 8.5.14 contain a patch. There are no workarounds for this issue.

Severity CVSS v4.0: Pending analysis

Last modification:

19/10/2022

CVE-2022-35136

Publication date:

13/10/2022

Boodskap IoT Platform v4.4.9-02 allows attackers to make unauthenticated API requests.

Severity CVSS v4.0: Pending analysis

Last modification:

15/05/2025

CVE-2022-35134

Publication date:

13/10/2022

Boodskap IoT Platform v4.4.9-02 contains a cross-site scripting (XSS) vulnerability.

Severity CVSS v4.0: Pending analysis

Last modification:

15/05/2025

CVE-2022-35135

Publication date:

13/10/2022

Boodskap IoT Platform v4.4.9-02 allows attackers to escalate privileges via a crafted request sent to /api/user/upsert/.

Severity CVSS v4.0: Pending analysis

Last modification:

15/05/2025

CVE-2022-34021

Publication date:

13/10/2022

Multiple Cross Site Scripting (XSS) vulnerabilities in ResIOT IOT Platform + LoRaWAN Network Server through 4.1.1000114 via the form fields.

Severity CVSS v4.0: Pending analysis

Last modification:

16/05/2025

CVE-2022-31130

Publication date:

13/10/2022

Grafana is an open source observability and data visualization platform. Versions of Grafana for endpoints prior to 9.1.8 and 8.5.14 could leak authentication tokens to some destination plugins under some conditions. The vulnerability impacts data source and plugin proxy endpoints with authentication tokens. The destination plugin could receive a user&#39;s Grafana authentication token. Versions 9.1.8 and 8.5.14 contain a patch for this issue. As a workaround, do not use API keys, JWT authentication, or any HTTP Header based authentication.

Severity CVSS v4.0: Pending analysis

Last modification:

17/10/2022

CVE-2022-34022

Publication date:

13/10/2022

SQL injection vulnerability in ResIOT IOT Platform + LoRaWAN Network Server through 4.1.1000114 via a crafted POST request to /ResiotQueryDBActive.

Severity CVSS v4.0: Pending analysis

Last modification:

15/05/2025

CVE-2022-39300

Publication date:

13/10/2022

node SAML is a SAML 2.0 library based on the SAML implementation of passport-saml. A remote attacker may be able to bypass SAML authentication on a website using passport-saml. A successful attack requires that the attacker is in possession of an arbitrary IDP signed XML element. Depending on the IDP used, fully unauthenticated attacks (e.g without access to a valid user) might also be feasible if generation of a signed message can be triggered. Users should upgrade to node-saml version 4.0.0-beta5 or newer. Disabling SAML authentication may be done as a workaround.

Severity CVSS v4.0: Pending analysis

Last modification:

14/10/2022

CVE-2022-31123

Publication date:

13/10/2022

Grafana is an open source observability and data visualization platform. Versions prior to 9.1.8 and 8.5.14 are vulnerable to a bypass in the plugin signature verification. An attacker can convince a server admin to download and successfully run a malicious plugin even though unsigned plugins are not allowed. Versions 9.1.8 and 8.5.14 contain a patch for this issue. As a workaround, do not install plugins downloaded from untrusted sources.

Severity CVSS v4.0: Pending analysis

Last modification:

03/12/2022

CVE-2022-35944

Publication date:

13/10/2022

October is a self-hosted Content Management System (CMS) platform based on the Laravel PHP Framework. This vulnerability only affects installations that rely on the safe mode restriction, commonly used when providing public access to the admin panel. Assuming an attacker has access to the admin panel and permission to open the "Editor" section, they can bypass the Safe Mode (`cms.safe_mode`) restriction to introduce new PHP code in a CMS template using a specially crafted request. The issue has been patched in versions 2.2.34 and 3.0.66.

Severity CVSS v4.0: Pending analysis

Last modification:

18/10/2022