Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

Go to Calendar     Go to Press Room     Go to Newsletters subscription

Search

Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2022-24238
Publication date:
02/06/2022
ACEweb Online Portal 3.5.065 was discovered to contain a cross-site scripting (XSS) vulnerability via the txtNmName1 parameter in person.awp.
Severity CVSS v4.0: Pending analysis
Last modification:
11/06/2022

CVE-2022-24239
Publication date:
02/06/2022
ACEweb Online Portal 3.5.065 was discovered to contain an unrestricted file upload vulnerability via attachments.awp.
Severity CVSS v4.0: Pending analysis
Last modification:
11/06/2022

CVE-2022-24240
Publication date:
02/06/2022
ACEweb Online Portal 3.5.065 was discovered to contain a SQL injection vulnerability via the criteria parameter in showschedule.awp.
Severity CVSS v4.0: Pending analysis
Last modification:
11/06/2022

CVE-2022-24241
Publication date:
02/06/2022
ACEweb Online Portal 3.5.065 was discovered to contain an External Controlled File Path and Name vulnerability via the txtFilePath parameter in attachments.awp.
Severity CVSS v4.0: Pending analysis
Last modification:
11/06/2022

CVE-2022-22767
Publication date:
02/06/2022
Specific BD Pyxis™ products were installed with default credentials and may presently still operate with these credentials. There may be scenarios where BD Pyxis™ products are installed with the same default local operating system credentials or domain-joined server(s) credentials that may be shared across product types. If exploited, threat actors may be able to gain privileged access to the underlying file system and could potentially exploit or gain access to ePHI or other sensitive information.
Severity CVSS v4.0: Pending analysis
Last modification:
11/06/2022

CVE-2022-1943
Publication date:
02/06/2022
A flaw out of bounds memory write in the Linux kernel UDF file system functionality was found in the way user triggers some file operation which triggers udf_write_fi(). A local user could use this flaw to crash the system or potentially
Severity CVSS v4.0: Pending analysis
Last modification:
16/05/2023

CVE-2022-1968
Publication date:
02/06/2022
Use After Free in GitHub repository vim/vim prior to 8.2.
Severity CVSS v4.0: Pending analysis
Last modification:
03/05/2023

CVE-2022-1949
Publication date:
02/06/2022
An access control bypass vulnerability found in 389-ds-base. That mishandling of the filter that would yield incorrect results, but as that has progressed, can be determined that it actually is an access control bypass. This may allow any remote unauthenticated user to issue a filter that allows searching for database items they do not have access to, including but not limited to potentially userPassword hashes and other sensitive data.
Severity CVSS v4.0: Pending analysis
Last modification:
13/12/2024

CVE-2022-1789
Publication date:
02/06/2022
With shadow paging enabled, the INVPCID instruction results in a call to kvm_mmu_invpcid_gva. If INVPCID is executed with CR0.PG=0, the invlpg callback is not set and the result is a NULL pointer dereference.
Severity CVSS v4.0: Pending analysis
Last modification:
07/11/2023

CVE-2022-1797
Publication date:
02/06/2022
A malformed Class 3 common industrial protocol message with a cached connection can cause a denial-of-service condition in Rockwell Automation Logix Controllers, resulting in a major nonrecoverable fault. If the target device becomes unavailable, a user would have to clear the fault and redownload the user project file to bring the device back online.
Severity CVSS v4.0: Pending analysis
Last modification:
11/06/2022

CVE-2022-1786
Publication date:
02/06/2022
A use-after-free flaw was found in the Linux kernel’s io_uring subsystem in the way a user sets up a ring with IORING_SETUP_IOPOLL with more than one task completing submissions on this ring. This flaw allows a local user to crash or escalate their privileges on the system.
Severity CVSS v4.0: Pending analysis
Last modification:
01/03/2023

CVE-2022-1661
Publication date:
02/06/2022
The affected products are vulnerable to directory traversal, which may allow an attacker to obtain arbitrary operating system files.
Severity CVSS v4.0: Pending analysis
Last modification:
27/06/2023
Subscribe to Vulnerabilities