Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2020-14523

Publication date:

11/02/2022

Multiple Mitsubishi Electric Factory Automation products have a vulnerability that allows an attacker to execute arbitrary code.

Severity CVSS v4.0: Pending analysis

Last modification:

01/03/2022

CVE-2021-22785

Publication date:

11/02/2022

A CWE-200: Information Exposure vulnerability exists that could cause sensitive information of files located in the web root directory to leak when an attacker sends a HTTP request to the web server of the device. Affected Product: Modicon M340 CPUs: BMXP34 (Versions prior to V3.40), Modicon M340 X80 Ethernet Communication Modules: BMXNOE0100 (H), BMXNOE0110 (H), BMXNOC0401, BMXNOR0200H RTU (All Versions), Modicon Premium Processors with integrated Ethernet (Copro): TSXP574634, TSXP575634, TSXP576634 (All Versions), Modicon Quantum Processors with Integrated Ethernet (Copro): 140CPU65xxxxx (All Versions), Modicon Quantum Communication Modules: 140NOE771x1, 140NOC78x00, 140NOC77101 (All Versions), Modicon Premium Communication Modules: TSXETY4103, TSXETY5103 (All Versions)

Severity CVSS v4.0: Pending analysis

Last modification:

10/04/2024

CVE-2021-23597

Publication date:

11/02/2022

This affects the package fastify-multipart before 5.3.1. By providing a name=constructor property it is still possible to crash the application. **Note:** This is a bypass of CVE-2020-8136 (https://security.snyk.io/vuln/SNYK-JS-FASTIFYMULTIPART-1290382).

Severity CVSS v4.0: Pending analysis

Last modification:

12/07/2022

CVE-2021-45387

Publication date:

11/02/2022

tcpreplay 4.3.4 has a Reachable Assertion in add_tree_ipv4() at tree.c.

Severity CVSS v4.0: Pending analysis

Last modification:

28/10/2022

CVE-2021-45386

Publication date:

11/02/2022

tcpreplay 4.3.4 has a Reachable Assertion in add_tree_ipv6() at tree.c

Severity CVSS v4.0: Pending analysis

Last modification:

28/10/2022

CVE-2020-13672

Publication date:

11/02/2022

Cross-site Scripting (XSS) vulnerability in Drupal core&#39;s sanitization API fails to properly filter cross-site scripting under certain circumstances. This issue affects: Drupal Core 9.1.x versions prior to 9.1.7; 9.0.x versions prior to 9.0.12; 8.9.x versions prior to 8.9.14; 7.x versions prior to 7.80.

Severity CVSS v4.0: Pending analysis

Last modification:

12/04/2022

CVE-2020-13670

Publication date:

11/02/2022

Information Disclosure vulnerability in file module of Drupal Core allows an attacker to gain access to the file metadata of a permanent private file that they do not have access to by guessing the ID of the file. This issue affects: Drupal Core 8.8.x versions prior to 8.8.10; 8.9.x versions prior to 8.9.6; 9.0.x versions prior to 9.0.6.

Severity CVSS v4.0: Pending analysis

Last modification:

23/02/2022

CVE-2020-13668

Publication date:

11/02/2022

Access Bypass vulnerability in Drupal Core allows for an attacker to leverage the way that HTML is rendered for affected forms in order to exploit the vulnerability. This issue affects: Drupal Core 8.8.x versions prior to 8.8.10; 8.9.x versions prior to 8.9.6; 9.0.x versions prior to 9.0.6.

Severity CVSS v4.0: Pending analysis

Last modification:

23/02/2022

CVE-2020-13669

Publication date:

11/02/2022

Cross-site Scripting (XSS) vulnerability in ckeditor of Drupal Core allows attacker to inject XSS. This issue affects: Drupal Core 8.8.x versions prior to 8.8.10.; 8.9.x versions prior to 8.9.6; 9.0.x versions prior to 9.0.6.

Severity CVSS v4.0: Pending analysis

Last modification:

17/02/2022

CVE-2020-13674

Publication date:

11/02/2022

The QuickEdit module does not properly validate access to routes, which could allow cross-site request forgery under some circumstances and lead to possible data integrity issues. Sites are only affected if the QuickEdit module (which comes with the Standard profile) is installed. Removing the "access in-place editing" permission from untrusted users will not fully mitigate the vulnerability.

Severity CVSS v4.0: Pending analysis

Last modification:

18/02/2022

CVE-2020-13675

Publication date:

11/02/2022

Drupal&#39;s JSON:API and REST/File modules allow file uploads through their HTTP APIs. The modules do not correctly run all file validation, which causes an access bypass vulnerability. An attacker might be able to upload files that bypass the file validation process implemented by modules on the site.

Severity CVSS v4.0: Pending analysis

Last modification:

18/02/2022

CVE-2020-36062

Publication date:

11/02/2022

Dairy Farm Shop Management System v1.0 was discovered to contain hardcoded credentials in the source code which allows attackers access to the control panel if compromised.

Severity CVSS v4.0: Pending analysis

Last modification:

04/10/2023

Subscribe to Vulnerabilities