Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2021-33655

Publication date:

18/07/2022

When sending malicous data to kernel by ioctl cmd FBIOPUT_VSCREENINFO,kernel will write memory out of bounds.

Severity CVSS v4.0: Pending analysis

Last modification:

29/10/2022

CVE-2022-32450

Publication date:

18/07/2022

AnyDesk 7.0.9 allows a local user to gain SYSTEM privileges via a symbolic link because the user can write to their own %APPDATA% folder (used for ad.trace and chat) but the product runs as SYSTEM when writing chat-room data there.

Severity CVSS v4.0: Pending analysis

Last modification:

22/07/2022

CVE-2022-30621

Publication date:

18/07/2022

Allows a remote user to read files on the camera&#39;s OS "GetFileContent.cgi". Reading arbitrary files on the camera&#39;s OS as root user.

Severity CVSS v4.0: Pending analysis

Last modification:

22/07/2022

CVE-2022-30623

Publication date:

18/07/2022

The server checks the user&#39;s cookie in a non-standard way, and a value is entered in the cookie value name of the status and its value is set to true to bypass the identification with the system using a username and password.

Severity CVSS v4.0: Pending analysis

Last modification:

23/07/2022

CVE-2022-30624

Publication date:

18/07/2022

Browsing the admin.html page allows the user to reset the admin password. Also appears in the JS code for the password.

Severity CVSS v4.0: Pending analysis

Last modification:

23/07/2022

CVE-2022-30625

Publication date:

18/07/2022

Directory listing is a web server function that displays the directory contents when there is no index file in a specific website directory. A directory listing provides an attacker with the complete index of all the resources located inside of the directory. The specific risks and consequences vary depending on which files are listed and accessible.

Severity CVSS v4.0: Pending analysis

Last modification:

23/07/2022

CVE-2022-30626

Publication date:

18/07/2022

Browsing the path: http://ip/wifi_ap_pata_get.cmd, will show in the name of the existing access point on the component, and a password in clear text.

Severity CVSS v4.0: Pending analysis

Last modification:

23/07/2022

CVE-2022-30627

Publication date:

18/07/2022

This vulnerability affects all of the company&#39;s products that also include the FW versions: update_i90_cv2.021_b20210104, update_i50_v1.0.55_b20200509, update_x6_v2.1.2_b202001127, update_b5_v2.0.9_b20200706. This vulnerability makes it possible to extract from the FW the existing user passwords on their operating systems and passwords.

Severity CVSS v4.0: Pending analysis

Last modification:

23/07/2022

CVE-2022-35404

Publication date:

18/07/2022

ManageEngine Password Manager Pro 12100 and prior and OPManager 126100 and prior are vulnerable to unauthorized file and directory creation on a server machine.

Severity CVSS v4.0: Pending analysis

Last modification:

08/08/2023

CVE-2022-24688

Publication date:

18/07/2022

An issue was discovered in DSK DSKNet 2.16.136.0 and 2.17.136.5. The Touch settings allow unrestricted file upload (and consequently Remote Code Execution) via PDF upload with PHP content and a .php extension. The attacker must hijack or obtain privileged user access to the Parameters page in order to exploit this issue. (That can be easily achieved by exploiting the Broken Access Control with further Brute-force attack or SQL Injection.) The uploaded file is stored within the database and copied to the sync web folder if the attacker visits a certain .php?action= page.

Severity CVSS v4.0: Pending analysis

Last modification:

25/07/2022

CVE-2022-24690

Publication date:

18/07/2022

An issue was discovered in DSK DSKNet 2.16.136.0 and 2.17.136.5. A PresAbs.php SQL Injection vulnerability allows unauthenticated users to taint database data and extract sensitive information via crafted HTTP requests. The type of SQL Injection is blind boolean based. (An unauthenticated attacker can discover the endpoint by abusing a Broken Access Control issue with further SQL injection attacks to gather all user&#39;s badge numbers and PIN codes.)

Severity CVSS v4.0: Pending analysis

Last modification:

27/07/2022

CVE-2022-24691

Publication date:

18/07/2022

An issue was discovered in DSK DSKNet 2.16.136.0 and 2.17.136.5. A SQL Injection vulnerability allows authenticated users to taint database data and extract sensitive information via crafted HTTP requests. The type of SQL Injection is blind boolean based.

Severity CVSS v4.0: Pending analysis

Last modification:

27/07/2022

Subscribe to Vulnerabilities