Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2022-0763

Publication date:

26/02/2022

Cross-site Scripting (XSS) - Stored in GitHub repository microweber/microweber prior to 1.3.

Severity CVSS v4.0: Pending analysis

Last modification:

08/03/2022

CVE-2022-0762

Publication date:

26/02/2022

Incorrect Authorization in GitHub repository microweber/microweber prior to 1.3.<br /> <br />

Severity CVSS v4.0: Pending analysis

Last modification:

02/08/2023

CVE-2022-23308

Publication date:

26/02/2022

valid.c in libxml2 before 2.9.13 has a use-after-free of ID and IDREF attributes.

Severity CVSS v4.0: Pending analysis

Last modification:

05/05/2025

CVE-2022-24986

Publication date:

26/02/2022

KDE KCron through 21.12.2 uses a temporary file in /tmp when saving, but reuses the filename during an editing session. Thus, someone watching it be created the first time could potentially intercept the file the following time, enabling that person to run unauthorized commands.

Severity CVSS v4.0: Pending analysis

Last modification:

08/08/2023

CVE-2022-25359

Publication date:

26/02/2022

On ICL ScadaFlex II SCADA Controller SC-1 and SC-2 1.03.07 devices, unauthenticated remote attackers can overwrite, delete, or create files.

Severity CVSS v4.0: Pending analysis

Last modification:

08/08/2023

CVE-2020-36516

Publication date:

26/02/2022

An issue was discovered in the Linux kernel through 5.16.11. The mixed IPID assignment method with the hash-based IPID assignment policy allows an off-path attacker to inject data into a victim&#39;s TCP session or terminate that session.

Severity CVSS v4.0: Pending analysis

Last modification:

09/11/2023

CVE-2021-46702

Publication date:

26/02/2022

Tor Browser 9.0.7 on Windows 10 build 10586 is vulnerable to information disclosure. This could allow local attackers to bypass the intended anonymity feature and obtain information regarding the onion services visited by a local user. This can be accomplished by analyzing RAM memory even several hours after the local user used the product. This occurs because the product doesn&#39;t properly free memory.

Severity CVSS v4.0: Pending analysis

Last modification:

10/03/2022

CVE-2022-25096

Publication date:

26/02/2022

Home Owners Collection Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter in /members/view_member.php.

Severity CVSS v4.0: Pending analysis

Last modification:

08/03/2022

CVE-2022-25095

Publication date:

26/02/2022

Home Owners Collection Management System v1.0 allows unauthenticated attackers to compromise user accounts via a crafted POST request.

Severity CVSS v4.0: Pending analysis

Last modification:

08/03/2022

CVE-2022-25094

Publication date:

26/02/2022

Home Owners Collection Management System v1.0 was discovered to contain a remote code execution (RCE) vulnerability via the parameter "cover" in SystemSettings.php.

Severity CVSS v4.0: Pending analysis

Last modification:

08/03/2022

CVE-2022-21706

Publication date:

26/02/2022

Zulip is an open-source team collaboration tool with topic-based threading. Zulip Server version 2.0.0 and above are vulnerable to insufficient access control with multi-use invitations. A Zulip Server deployment which hosts multiple organizations is vulnerable to an attack where an invitation created in one organization (potentially as a role with elevated permissions) can be used to join any other organization. This bypasses any restrictions on required domains on users&#39; email addresses, may be used to gain access to organizations which are only accessible by invitation, and may be used to gain access with elevated privileges. This issue has been patched in release 4.10. There are no known workarounds for this issue. ### Patches _Has the problem been patched? What versions should users upgrade to?_ ### Workarounds _Is there a way for users to fix or remediate the vulnerability without upgrading?_ ### References _Are there any links users can visit to find out more?_ ### For more information If you have any questions or comments about this advisory, you can discuss them on the [developer community Zulip server](https://zulip.com/developer-community/), or email the [Zulip security team](mailto:security@zulip.com).

Severity CVSS v4.0: Pending analysis

Last modification:

24/07/2023

CVE-2022-24710

Publication date:

25/02/2022

Weblate is a copyleft software web-based continuous localization system. Versions prior to 4.11 do not properly neutralize user input used in user name and language fields. Due to this improper neutralization it is possible to perform cross-site scripting via these fields. The issues were fixed in the 4.11 release. Users unable to upgrade are advised to add their own neutralize logic.

Severity CVSS v4.0: Pending analysis

Last modification:

08/03/2022

Subscribe to Vulnerabilities