Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2022-3072

Publication date:

01/09/2022

Cross-site Scripting (XSS) - Stored in GitHub repository francoisjacquet/rosariosis prior to 8.9.3.

Severity CVSS v4.0: Pending analysis

Last modification:

02/09/2022

CVE-2022-36449

Publication date:

01/09/2022

An issue was discovered in the Arm Mali GPU Kernel Driver. A non-privileged user can make improper GPU processing operations to gain access to already freed memory, write a limited amount outside of buffer bounds, or to disclose details of memory mappings. This affects Midgard r4p0 through r32p0, Bifrost r0p0 through r38p0 and r39p0 before r38p1, and Valhall r19p0 through r38p0 and r39p0 before r38p1.

Severity CVSS v4.0: Pending analysis

Last modification:

07/04/2025

CVE-2022-36671

Publication date:

01/09/2022

Novel-Plus v3.6.2 was discovered to contain an arbitrary file download vulnerability via the background file download API.

Severity CVSS v4.0: Pending analysis

Last modification:

13/09/2023

CVE-2022-36672

Publication date:

01/09/2022

Novel-Plus v3.6.2 was discovered to contain a hard-coded JWT key located in the project config file. This vulnerability allows attackers to create a custom user session.

Severity CVSS v4.0: Pending analysis

Last modification:

13/09/2023

CVE-2022-36674

Publication date:

01/09/2022

Simple Task Scheduling System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /schedules/view_schedule.php.

Severity CVSS v4.0: Pending analysis

Last modification:

02/09/2022

CVE-2022-36675

Publication date:

01/09/2022

Simple Task Scheduling System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /schedules/manage_schedule.php.

Severity CVSS v4.0: Pending analysis

Last modification:

02/09/2022

CVE-2022-36676

Publication date:

01/09/2022

Simple Task Scheduling System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /categories/view_category.php.

Severity CVSS v4.0: Pending analysis

Last modification:

02/09/2022

CVE-2022-36130

Publication date:

01/09/2022

HashiCorp Boundary up to 0.10.1 did not properly perform data integrity checks to ensure the resources were associated with the correct scopes, allowing potential privilege escalation for authorized users of another scope. Fixed in Boundary 0.10.2.

Severity CVSS v4.0: Pending analysis

Last modification:

09/09/2022

CVE-2022-36051

Publication date:

31/08/2022

ZITADEL combines the ease of Auth0 and the versatility of Keycloak.**Actions**, introduced in ZITADEL **1.42.0** on the API and **1.56.0** for Console, is a feature, where users with role.`ORG_OWNER` are able to create Javascript Code, which is invoked by the system at certain points during the login. **Actions**, for example, allow creating authorizations (user grants) on newly created users programmatically. Due to a missing authorization check, **Actions** were able to grant authorizations for projects that belong to other organizations inside the same Instance. Granting authorizations via API and Console is not affected by this vulnerability. There is currently no known workaround, users should update.

Severity CVSS v4.0: Pending analysis

Last modification:

09/09/2022

CVE-2022-37123

Publication date:

31/08/2022

D-link DIR-816 A2_v1.10CNB04.img is vulnerable to Command injection via /goform/form2userconfig.cgi.

Severity CVSS v4.0: Pending analysis

Last modification:

08/08/2023

CVE-2022-37129

Publication date:

31/08/2022

D-Link DIR-816 A2_v1.10CNB04.img is vulnerable to Command Injection via /goform/SystemCommand. After the user passes in the command parameter, it will be spliced into byte_4836B0 by snprintf, and finally doSystem(&byte_4836B0); will be executed, resulting in a command injection.

Severity CVSS v4.0: Pending analysis

Last modification:

08/08/2023

CVE-2022-37130

Publication date:

31/08/2022

In D-Link DIR-816 A2_v1.10CNB04, DIR-878 DIR_878_FW1.30B08.img a command injection vulnerability occurs in /goform/Diagnosis, after the condition is met, setnum will be spliced into v10 by snprintf, and the system will be executed, resulting in a command injection vulnerability

Severity CVSS v4.0: Pending analysis

Last modification:

08/08/2023

Subscribe to Vulnerabilities