Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

Go to Calendar     Go to Press Room     Go to Newsletters subscription

Search

Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2022-35695
Publication date:
19/12/2022
Adobe Experience Manager version 6.5.14 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
Severity CVSS v4.0: Pending analysis
Last modification:
06/01/2023

CVE-2022-41418
Publication date:
19/12/2022
An issue in the component BlogEngine/BlogEngine.NET/AppCode/Api/UploadController.cs of BlogEngine.NET v3.3.8.0 allows attackers to execute arbitrary code via uploading a crafted PNG file.
Severity CVSS v4.0: Pending analysis
Last modification:
17/04/2025

CVE-2022-40607
Publication date:
19/12/2022
<br /> IBM Spectrum Scale 5.1 could allow users with permissions to create pod, persistent volume and persistent volume claim to access files and directories outside of the volume, including on the host filesystem. IBM X-Force ID: 235740.<br /> <br />
Severity CVSS v4.0: Pending analysis
Last modification:
07/11/2023

CVE-2022-3775
Publication date:
19/12/2022
When rendering certain unicode sequences, grub2&amp;#39;s font code doesn&amp;#39;t proper validate if the informed glyph&amp;#39;s width and height is constrained within bitmap size. As consequence an attacker can craft an input which will lead to a out-of-bounds write into grub2&amp;#39;s heap, leading to memory corruption and availability issues. Although complex, arbitrary code execution could not be discarded.
Severity CVSS v4.0: Pending analysis
Last modification:
25/11/2023

CVE-2022-35693
Publication date:
19/12/2022
Adobe Experience Manager version 6.5.14 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim&amp;#39;s browser.
Severity CVSS v4.0: Pending analysis
Last modification:
06/01/2023

CVE-2022-30679
Publication date:
19/12/2022
Adobe Experience Manager version 6.5.14 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim&amp;#39;s browser.
Severity CVSS v4.0: Pending analysis
Last modification:
06/01/2023

CVE-2022-43289
Publication date:
19/12/2022
Deark v.1.6.2 was discovered to contain a stack overflow via the do_prism_read_palette() function at /modules/atari-img.c.
Severity CVSS v4.0: Pending analysis
Last modification:
17/04/2025

CVE-2022-40435
Publication date:
19/12/2022
Employee Performance Evaluation System v1.0 was discovered to contain a persistent cross-site scripting (XSS) vulnerability via adding new entries under the Departments and Designations module.
Severity CVSS v4.0: Pending analysis
Last modification:
17/04/2025

CVE-2022-42945
Publication date:
19/12/2022
DWG TrueViewTM 2023 version has a DLL Search Order Hijacking vulnerability. Successful exploitation by a malicious attacker could result in remote code execution on the target system.
Severity CVSS v4.0: Pending analysis
Last modification:
17/04/2025

CVE-2022-47512
Publication date:
19/12/2022
Sensitive information was stored in plain text in a file that is accessible by a user with a local account in Hybrid Cloud Observability (HCO)/ SolarWinds Platform 2022.4. No other versions are affected
Severity CVSS v4.0: Pending analysis
Last modification:
16/09/2024

CVE-2022-31683
Publication date:
19/12/2022
Concourse (7.x.y prior to 7.8.3 and 6.x.y prior to 6.7.9) contains an authorization bypass issue. A Concourse user can send a request with body including :team_name=team2 to bypass team scope check to gain access to certain resources belong to any other team.
Severity CVSS v4.0: Pending analysis
Last modification:
16/04/2025

CVE-2022-42946
Publication date:
19/12/2022
Parsing a maliciously crafted X_B and PRT file can force Autodesk Maya 2023 and 2022 to read beyond allocated buffer. This vulnerability in conjunction with other vulnerabilities could lead to code execution in the context of the current process.
Severity CVSS v4.0: Pending analysis
Last modification:
17/04/2025
Subscribe to Vulnerabilities