Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2021-45347

Publication date:

14/02/2022

An Incorrect Access Control vulnerability exists in zzcms 8.2, which lets a malicious user bypass authentication by changing the user name in the cookie to use any password.

Severity CVSS v4.0: Pending analysis

Last modification:

23/02/2022

CVE-2021-45346

Publication date:

14/02/2022

A Memory Leak vulnerability exists in SQLite Project SQLite3 3.35.1 and 3.37.0 via maliciously crafted SQL Queries (made via editing the Database File), it is possible to query a record, and leak subsequent bytes of memory that extend beyond the record, which could let a malicious user obtain sensitive information. NOTE: The developer disputes this as a vulnerability stating that If you give SQLite a corrupted database file and submit a query against the database, it might read parts of the database that you did not intend or expect.

Severity CVSS v4.0: Pending analysis

Last modification:

04/08/2024

CVE-2022-0579

Publication date:

14/02/2022

Missing Authorization in Packagist snipe/snipe-it prior to 5.3.9.

Severity CVSS v4.0: Pending analysis

Last modification:

24/02/2026

CVE-2022-23367

Publication date:

14/02/2022

Fulusso v1.1 was discovered to contain a DOM-based cross-site scripting (XSS) vulnerability in /BindAccount/SuccessTips.js. This vulnerability allows attackers to inject malicious code into a victim user&#39;s device via open redirection.

Severity CVSS v4.0: Pending analysis

Last modification:

23/02/2022

CVE-2021-39079

Publication date:

14/02/2022

IBM Cognos Analytics Mobile for Android applications prior to version 1.1.14 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 215592.

Severity CVSS v4.0: Pending analysis

Last modification:

22/02/2022

CVE-2021-39080

Publication date:

14/02/2022

Due to weak obfuscation, IBM Cognos Analytics Mobile for Android application prior to version 1.1.14 , an attacker could be able to reverse engineer the codebase to gain knowledge about the programming technique, interface, class definitions, algorithms and functions used. IBM X-Force ID: 215593.

Severity CVSS v4.0: Pending analysis

Last modification:

23/02/2022

CVE-2022-22854

Publication date:

14/02/2022

An access control issue in hprms/admin/?page=user/list of Hospital Patient Record Management System v1.0 allows attackers to escalate privileges via accessing and editing the user list.

Severity CVSS v4.0: Pending analysis

Last modification:

30/03/2022

CVE-2021-45392

Publication date:

14/02/2022

A Buffer Overflow vulnerability exists in Tenda Router AX12 V22.03.01.21_CN in the sub_422CE4 function in page /goform/setIPv6Status via the prefixDelegate parameter, which causes a Denial of Service.

Severity CVSS v4.0: Pending analysis

Last modification:

23/02/2022

CVE-2022-0512

Publication date:

14/02/2022

Authorization Bypass Through User-Controlled Key in NPM url-parse prior to 1.5.6.

Severity CVSS v4.0: Pending analysis

Last modification:

23/02/2023

CVE-2021-46371

Publication date:

14/02/2022

antd-admin 5.5.0 is affected by an incorrect access control vulnerability. Unauthorized access to some interfaces in the foreground leads to leakage of sensitive information.

Severity CVSS v4.0: Pending analysis

Last modification:

12/07/2022

CVE-2022-24686

Publication date:

14/02/2022

HashiCorp Nomad and Nomad Enterprise 0.3.0 through 1.0.17, 1.1.11, and 1.2.5 artifact download functionality has a race condition such that the Nomad client agent could download the wrong artifact into the wrong destination. Fixed in 1.0.18, 1.1.12, and 1.2.6

Severity CVSS v4.0: Pending analysis

Last modification:

11/05/2022

CVE-2021-45420

Publication date:

14/02/2022

Emerson Dixell XWEB-500 products are affected by arbitrary file write vulnerability in /cgi-bin/logo_extra_upload.cgi, /cgi-bin/cal_save.cgi, and /cgi-bin/lo_utils.cgi. An attacker will be able to write any file on the target system without any kind of authentication mechanism, and this can lead to denial of service and potentially remote code execution. Note: the product has not been supported since 2018 and should be removed or replaced

Severity CVSS v4.0: Pending analysis

Last modification:

04/08/2024

Subscribe to Vulnerabilities