Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2022-30371

Publication date:

13/05/2022

Air Cargo Management System 1.0 is vulnerable to SQL Injection via /acms/admin/cargo_types/view_cargo_type.php?id=.

Severity CVSS v4.0: Pending analysis

Last modification:

23/05/2022

CVE-2022-30370

Publication date:

13/05/2022

Air Cargo Management System 1.0 is vulnerable to SQL Injection via /acms/classes/Master.php?f=delete_cargo_type.

Severity CVSS v4.0: Pending analysis

Last modification:

23/05/2022

CVE-2022-29383

Publication date:

13/05/2022

NETGEAR ProSafe SSL VPN firmware FVS336Gv2 and FVS336Gv3 was discovered to contain a SQL injection vulnerability via USERDBDomains.Domainname at cgi-bin/platform.cgi.

Severity CVSS v4.0: Pending analysis

Last modification:

24/05/2022

CVE-2020-22983

Publication date:

13/05/2022

A Server-Side Request Forgery (SSRF) vulnerability exists in MicroStrategy Web SDK 11.1 and earlier, allows remote unauthenticated attackers to conduct a server-side request forgery (SSRF) attack via the srcURL parameter to the shortURL task.

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2021-42969

Publication date:

13/05/2022

Certain Anaconda3 2021.05 are affected by OS command injection. When a user installs Anaconda, an attacker can create a new file and write something in usercustomize.py. When the user opens the terminal or activates Anaconda, the command will be executed.

Severity CVSS v4.0: Pending analysis

Last modification:

14/02/2024

CVE-2021-42967

Publication date:

13/05/2022

Unrestricted file upload in /novel-admin/src/main/java/com/java2nb/common/controller/FileController.java in novel-plus all versions allows allows an attacker to upload malicious JSP files.

Severity CVSS v4.0: Pending analysis

Last modification:

13/09/2023

CVE-2022-25762

Publication date:

13/05/2022

If a web application sends a WebSocket message concurrently with the WebSocket connection closing when running on Apache Tomcat 8.5.0 to 8.5.75 or Apache Tomcat 9.0.0.M1 to 9.0.20, it is possible that the application will continue to use the socket after it has been closed. The error handling triggered in this case could cause the a pooled object to be placed in the pool twice. This could result in subsequent connections using the same object concurrently which could result in data being returned to the wrong use and/or other errors.

Severity CVSS v4.0: Pending analysis

Last modification:

23/02/2023

CVE-2022-27134

Publication date:

13/05/2022

EOSIO batdappboomx v327c04cf has an Access-control vulnerability in the `transfer` function of the smart contract which allows remote attackers to win the cryptocurrency without paying ticket fee via the `std::string memo` parameter.

Severity CVSS v4.0: Pending analysis

Last modification:

24/05/2022

CVE-2022-29218

Publication date:

13/05/2022

RubyGems is a package registry used to supply software for the Ruby language ecosystem. An ordering mistake in the code that accepts gem uploads allowed some gems (with platforms ending in numbers, like `arm64-darwin-21`) to be temporarily replaced in the CDN cache by a malicious package. The bug has been patched, and is believed to have never been exploited, based on an extensive review of logs and existing gems by rubygems. The easiest way to ensure that an application has not been exploited by this vulnerability is to verify all downloaded .gems checksums match the checksum recorded in the RubyGems.org database. RubyGems.org has been patched and is no longer vulnerable to this issue.

Severity CVSS v4.0: Pending analysis

Last modification:

02/12/2022

CVE-2021-27773

Publication date:

12/05/2022

This vulnerability allows users to execute a clickjacking attack in the meeting&#39;s chat.

Severity CVSS v4.0: Pending analysis

Last modification:

24/05/2022

CVE-2021-27777

Publication date:

12/05/2022

XML External Entity (XXE) injection vulnerabilities occur when poorly configured XML parsers process user supplied input without sufficient validation. Attackers can exploit this vulnerability to manipulate XML content and inject malicious external entity references.

Severity CVSS v4.0: Pending analysis

Last modification:

06/08/2022

CVE-2021-27768

Publication date:

12/05/2022

Using the ability to perform a Man-in-the-Middle (MITM) attack, which indicates a lack of hostname verification, sensitive account information was able to be intercepted. In this specific scenario, the application&#39;s network traffic was intercepted using a proxy server set up in &#39;transparent&#39; mode while a certificate with an invalid hostname was active. The Android application was found to have hostname verification issues during the server setup and login flows; however, the application did not process requests post-login.

Severity CVSS v4.0: Pending analysis

Last modification:

24/05/2022

Subscribe to Vulnerabilities