Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2022-34753

Publication date:

13/07/2022

A CWE-78: Improper Neutralization of Special Elements used in an OS Command (&#39;OS Command Injection&#39;) vulnerability exists that could cause remote root exploit when the command is compromised. Affected Products: SpaceLogic C-Bus Home Controller (5200WHC2), formerly known as C-Bus Wiser Homer Controller MK2 (V1.31.460 and prior)

Severity CVSS v4.0: Pending analysis

Last modification:

27/07/2022

CVE-2022-34756

Publication date:

13/07/2022

A CWE-120: Buffer Copy without Checking Size of Input vulnerability exists that could result in remote code execution or the crash of HTTPs stack which is used for the device Web HMI. Affected Products: Easergy P5 (V01.401.102 and prior)

Severity CVSS v4.0: Pending analysis

Last modification:

27/07/2022

CVE-2022-34757

Publication date:

13/07/2022

A CWE-327: Use of a Broken or Risky Cryptographic Algorithm vulnerability exists where weak cipher suites can be used for the SSH connection between Easergy Pro software and the device, which may allow an attacker to observe protected communication details. Affected Products: Easergy P5 (V01.401.102 and prior)

Severity CVSS v4.0: Pending analysis

Last modification:

27/07/2022

CVE-2022-34758

Publication date:

13/07/2022

A CWE-20: Improper Input Validation vulnerability exists that could cause the device watchdog function to be disabled if the attacker had access to privileged user credentials. Affected Products: Easergy P5 (V01.401.102 and prior)

Severity CVSS v4.0: Pending analysis

Last modification:

27/07/2022

CVE-2022-34759

Publication date:

13/07/2022

A CWE-787: Out-of-bounds Write vulnerability exists that could cause a denial of service of the webserver due to improper parsing of the HTTP Headers. Affected Products: X80 advanced RTU Communication Module (BMENOR2200H) (V1.0), OPC UA Modicon Communication Module (BMENUA0100) (V1.10 and prior)

Severity CVSS v4.0: Pending analysis

Last modification:

27/07/2022

CVE-2022-34763

Publication date:

13/07/2022

A CWE-345: Insufficient Verification of Data Authenticity vulnerability exists that could cause loading of unauthorized firmware images due to improper verification of the firmware signature. Affected Products: X80 advanced RTU Communication Module (BMENOR2200H) (V2.01 and later), OPC UA Modicon Communication Module (BMENUA0100) (V1.10 and prior)

Severity CVSS v4.0: Pending analysis

Last modification:

27/07/2022

CVE-2022-34760

Publication date:

13/07/2022

A CWE-835: Loop with Unreachable Exit Condition (&#39;Infinite Loop&#39;) vulnerability exists that could cause a denial of service of the webserver due to improper handling of the cookies. Affected Products: X80 advanced RTU Communication Module (BMENOR2200H) (V1.0), OPC UA Modicon Communication Module (BMENUA0100) (V1.10 and prior)

Severity CVSS v4.0: Pending analysis

Last modification:

27/07/2022

CVE-2022-34761

Publication date:

13/07/2022

A CWE-476: NULL Pointer Dereference vulnerability exists that could cause a denial of service of the webserver when parsing JSON content type. Affected Products: X80 advanced RTU Communication Module (BMENOR2200H) (V2.01 and later), OPC UA Modicon Communication Module (BMENUA0100) (V1.10 and prior)

Severity CVSS v4.0: Pending analysis

Last modification:

27/07/2022

CVE-2022-34762

Publication date:

13/07/2022

A CWE-22: Improper Limitation of a Pathname to a Restricted Directory (&#39;Path Traversal&#39;) vulnerability exists that could cause unauthorized firmware image loading when unsigned images are added to the firmware image path. Affected Products: X80 advanced RTU Communication Module (BMENOR2200H) (V2.01 and later), OPC UA Modicon Communication Module (BMENUA0100) (V1.10 and prior)

Severity CVSS v4.0: Pending analysis

Last modification:

28/07/2022

CVE-2022-32114

Publication date:

13/07/2022

An unrestricted file upload vulnerability in the Add New Assets function of Strapi 4.1.12 allows attackers to conduct XSS attacks via a crafted PDF file. NOTE: the project documentation suggests that a user with the Media Library "Create (upload)" permission is supposed to be able to upload PDF files containing JavaScript, and that all files in a public assets folder are accessible to the outside world (unless the filename begins with a dot character). The administrator can choose to allow only image, video, and audio files (i.e., not PDF) if desired.

Severity CVSS v4.0: Pending analysis

Last modification:

03/08/2024

CVE-2022-32308

Publication date:

13/07/2022

Cross Site Scripting (XSS) vulnerability in uBlock Origin extension before 1.41.1 allows remote attackers to run arbitrary code via a spoofed &#39;MessageSender.url&#39; to the browser renderer process.

Severity CVSS v4.0: Pending analysis

Last modification:

15/07/2022