Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2022-21167

Publication date:

01/05/2022

All versions of package masuit.tools.core are vulnerable to Arbitrary Code Execution via the ReceiveVarData function in the SocketClient.cs component. The socket client in the package can pass in the payload via the user-controllable input after it has been established, because this socket client transmission does not have the appropriate restrictions or type bindings for the BinaryFormatter.

Severity CVSS v4.0: Pending analysis

Last modification:

07/10/2022

CVE-2022-24437

Publication date:

01/05/2022

The package git-pull-or-clone before 2.0.2 are vulnerable to Command Injection due to the use of the --upload-pack feature of git which is also supported for git clone. The source includes the use of the secure child process API spawn(). However, the outpath parameter passed to it may be a command-line argument to the git clone command and result in arbitrary command injection.

Severity CVSS v4.0: Pending analysis

Last modification:

08/08/2023

CVE-2022-25645

Publication date:

01/05/2022

All versions of package dset are vulnerable to Prototype Pollution via &#39;dset/merge&#39; mode, as the dset function checks for prototype pollution by validating if the top-level path contains __proto__, constructor or protorype. By crafting a malicious object, it is possible to bypass this check and achieve prototype pollution.

Severity CVSS v4.0: Pending analysis

Last modification:

12/09/2023

CVE-2022-25844

Publication date:

01/05/2022

The package angular after 1.7.0 are vulnerable to Regular Expression Denial of Service (ReDoS) by providing a custom locale rule that makes it possible to assign the parameter in posPre: &#39; &#39;.repeat() of NUMBER_FORMATS.PATTERNS[1].posPre with a very high value. **Note:** 1) This package has been deprecated and is no longer maintained. 2) The vulnerable versions are 1.7.0 and higher.

Severity CVSS v4.0: Pending analysis

Last modification:

20/11/2025

CVE-2022-21144

Publication date:

01/05/2022

This affects all versions of package libxmljs. When invoking the libxmljs.parseXml function with a non-buffer argument the V8 code will attempt invoking the .toString method of the argument. If the argument&#39;s toString value is not a Function object V8 will crash.

Severity CVSS v4.0: Pending analysis

Last modification:

08/08/2023

CVE-2022-28481

Publication date:

01/05/2022

CSV-Safe gem

Severity CVSS v4.0: Pending analysis

Last modification:

09/05/2022

CVE-2022-23060

Publication date:

01/05/2022

A Stored Cross Site Scripting (XSS) vulnerability exists in Shopizer versions 2.0 through 2.17.0, where a privileged user (attacker) can inject malicious JavaScript in the filename under the “Manage files” tab

Severity CVSS v4.0: Pending analysis

Last modification:

09/05/2022

CVE-2022-23061

Publication date:

01/05/2022

In Shopizer versions 2.0 to 2.17.0 a regular admin can permanently delete a superadmin (although this cannot happen according to the documentation) via Insecure Direct Object Reference (IDOR) vulnerability.

Severity CVSS v4.0: Pending analysis

Last modification:

09/05/2022

CVE-2022-1544

Publication date:

01/05/2022

Formula Injection/CSV Injection due to Improper Neutralization of Formula Elements in CSV File in GitHub repository luyadev/yii-helpers prior to 1.2.1. Successful exploitation can lead to impacts such as client-sided command injection, code execution, or remote ex-filtration of contained confidential data.

Severity CVSS v4.0: Pending analysis

Last modification:

12/05/2022

CVE-2021-41993

Publication date:

30/04/2022

A misconfiguration of RSA in PingID Android app prior to 1.19 is vulnerable to pre-computed dictionary attacks, leading to an offline MFA bypass when using PingID Windows Login.

Severity CVSS v4.0: Pending analysis

Last modification:

10/05/2022

CVE-2021-41994

Publication date:

30/04/2022

A misconfiguration of RSA in PingID iOS app prior to 1.19 is vulnerable to pre-computed dictionary attacks, leading to an offline MFA bypass when using PingID Windows Login.

Severity CVSS v4.0: Pending analysis

Last modification:

10/05/2022

CVE-2021-42001

Publication date:

30/04/2022

PingID Desktop prior to 1.7.3 has a misconfiguration in the encryption libraries which can lead to sensitive data exposure. An attacker capable of exploiting this vulnerability may be able to successfully complete an MFA challenge via OTP.

Severity CVSS v4.0: Pending analysis

Last modification:

17/07/2023

Subscribe to Vulnerabilities