Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

Go to Calendar     Go to Press Room     Go to Newsletters subscription

Search

Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2020-11198
Publication date:
22/02/2021
Key material used for TZ diag buffer encryption and other data related to log buffer is not wiped securely due to improper usage of memset in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking
Severity CVSS v4.0: Pending analysis
Last modification:
21/07/2021

CVE-2020-35681
Publication date:
22/02/2021
Django Channels 3.x before 3.0.3 allows remote attackers to obtain sensitive information from a different request scope. The legacy channels.http.AsgiHandler class, used for handling HTTP type requests in an ASGI environment prior to Django 3.0, did not correctly separate request scopes in Channels 3.0. In many cases this would result in a crash but, with correct timing, responses could be sent to the wrong client, resulting in potential leakage of session identifiers and other sensitive data. Note that this affects only the legacy Channels provided class, and not Django's similar ASGIHandler, available from Django 3.0.
Severity CVSS v4.0: Pending analysis
Last modification:
26/02/2021

CVE-2020-35664
Publication date:
22/02/2021
An issue was discovered in Acronis Cyber Protect before 15 Update 1 build 26172. There is cross-site scripting (XSS) in the console.
Severity CVSS v4.0: Pending analysis
Last modification:
26/02/2021

CVE-2020-35571
Publication date:
22/02/2021
An issue was discovered in MantisBT through 2.24.3. In the helper_ensure_confirmed call in manage_custom_field_update.php, the custom field name is not sanitized. This may be problematic depending on CSP settings.
Severity CVSS v4.0: Pending analysis
Last modification:
26/02/2021

CVE-2020-35556
Publication date:
22/02/2021
An issue was discovered in Acronis Cyber Protect before 15 Update 1 build 26172. Because the local notification service misconfigures CORS, information disclosure can occur.
Severity CVSS v4.0: Pending analysis
Last modification:
21/07/2021

CVE-2021-24115
Publication date:
22/02/2021
In Botan before 2.17.3, constant-time computations are not used for certain decoding and encoding operations (base32, base58, base64, and hex).
Severity CVSS v4.0: Pending analysis
Last modification:
26/02/2021

CVE-2021-3149
Publication date:
22/02/2021
On Netshield NANO 25 10.2.18 devices, /usr/local/webmin/System/manual_ping.cgi allows OS command injection (after authentication by the attacker) because the system C library function is used unsafely.
Severity CVSS v4.0: Pending analysis
Last modification:
25/07/2022

CVE-2021-26120
Publication date:
22/02/2021
Smarty before 3.1.39 allows code injection via an unexpected function name after a {function name= substring.
Severity CVSS v4.0: Pending analysis
Last modification:
14/10/2022

CVE-2021-26119
Publication date:
22/02/2021
Smarty before 3.1.39 allows a Sandbox Escape because $smarty.template_object can be accessed in sandbox mode.
Severity CVSS v4.0: Pending analysis
Last modification:
14/10/2022

CVE-2021-27513
Publication date:
22/02/2021
The module admin_ITSM in EyesOfNetwork 5.3-10 allows remote authenticated users to upload arbitrary .xml.php files because it relies on "le filtre userside."
Severity CVSS v4.0: Pending analysis
Last modification:
26/02/2021

CVE-2021-27514
Publication date:
22/02/2021
EyesOfNetwork 5.3-10 uses an integer of between 8 and 10 digits for the session ID, which might be leveraged for brute-force authentication bypass (such as in CVE-2021-27513 exploitation).
Severity CVSS v4.0: Pending analysis
Last modification:
26/02/2021

CVE-2021-27516
Publication date:
22/02/2021
URI.js (aka urijs) before 1.19.6 mishandles certain uses of backslash such as http:\/ and interprets the URI as a relative path.
Severity CVSS v4.0: Pending analysis
Last modification:
29/11/2022
Subscribe to Vulnerabilities