Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2021-32628

Publication date:

04/10/2021

Redis is an open source, in-memory database that persists on disk. An integer overflow bug in the ziplist data structure used by all versions of Redis can be exploited to corrupt the heap and potentially result with remote code execution. The vulnerability involves modifying the default ziplist configuration parameters (hash-max-ziplist-entries, hash-max-ziplist-value, zset-max-ziplist-entries or zset-max-ziplist-value) to a very large value, and then constructing specially crafted commands to create very large ziplists. The problem is fixed in Redis versions 6.2.6, 6.0.16, 5.0.14. An additional workaround to mitigate the problem without patching the redis-server executable is to prevent users from modifying the above configuration parameters. This can be done using ACL to restrict unprivileged users from using the CONFIG SET command.

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2021-32687

Publication date:

04/10/2021

Redis is an open source, in-memory database that persists on disk. An integer overflow bug affecting all versions of Redis can be exploited to corrupt the heap and potentially be used to leak arbitrary contents of the heap or trigger remote code execution. The vulnerability involves changing the default set-max-intset-entries configuration parameter to a very large value and constructing specially crafted commands to manipulate sets. The problem is fixed in Redis versions 6.2.6, 6.0.16 and 5.0.14. An additional workaround to mitigate the problem without patching the redis-server executable is to prevent users from modifying the set-max-intset-entries configuration parameter. This can be done using ACL to restrict unprivileged users from using the CONFIG SET command.

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2021-23856

Publication date:

04/10/2021

The web server is vulnerable to reflected XSS and therefore an attacker might be able to execute scripts on a client’s computer by sending the client a manipulated URL.

Severity CVSS v4.0: Pending analysis

Last modification:

08/10/2021

CVE-2021-23855

Publication date:

04/10/2021

The user and password data base is exposed by an unprotected web server resource. Passwords are hashed with a weak hashing algorithm and therefore allow an attacker to determine the password by using rainbow tables.

Severity CVSS v4.0: Pending analysis

Last modification:

30/08/2022

CVE-2021-23857

Publication date:

04/10/2021

Login with hash: The login routine allows the client to log in to the system not by using the password, but by using the hash of the password. Combined with CVE-2021-23858, this allows an attacker to subsequently login to the system.

Severity CVSS v4.0: Pending analysis

Last modification:

30/08/2022

CVE-2021-23858

Publication date:

04/10/2021

Information disclosure: The main configuration, including users and their hashed passwords, is exposed by an unprotected web server resource and can be accessed without authentication. Additionally, device details are exposed which include the serial number and the firmware version by another unprotected web server resource.

Severity CVSS v4.0: Pending analysis

Last modification:

30/08/2022

CVE-2021-39896

Publication date:

04/10/2021

In all versions of GitLab CE/EE since version 8.0, when an admin uses the impersonate feature twice and stops impersonating, the admin may be logged in as the second user they impersonated, which may lead to repudiation issues.

Severity CVSS v4.0: Pending analysis

Last modification:

12/10/2021

CVE-2021-39899

Publication date:

04/10/2021

In all versions of GitLab CE/EE, an attacker with physical access to a user’s machine may brute force the user’s password via the change password function. There is a rate limit in place, but the attack may still be conducted by stealing the session id from the physical compromise of the account and splitting the attack over several IP addresses and passing in the compromised session value from these various locations.

Severity CVSS v4.0: Pending analysis

Last modification:

12/10/2021

CVE-2021-39874

Publication date:

04/10/2021

In all versions of GitLab CE/EE since version 11.0, the requirement to enforce 2FA is not honored when using git commands.

Severity CVSS v4.0: Pending analysis

Last modification:

12/10/2021

CVE-2021-39877

Publication date:

04/10/2021

A vulnerability was discovered in GitLab starting with version 12.2 that allows an attacker to cause uncontrolled resource consumption with a specially crafted file.

Severity CVSS v4.0: Pending analysis

Last modification:

12/10/2021

CVE-2021-39879

Publication date:

04/10/2021

Missing authentication in all versions of GitLab CE/EE since version 7.11.0 allows an attacker with access to a victim&#39;s session to disable two-factor authentication

Severity CVSS v4.0: Pending analysis

Last modification:

12/10/2021

CVE-2021-41595

Publication date:

04/10/2021

SuiteCRM before 7.10.33 and 7.11.22 allows information disclosure via Directory Traversal. An attacker can partially include arbitrary files via the file_name parameter of the Step3 import functionality.

Severity CVSS v4.0: Pending analysis

Last modification:

12/10/2021

Subscribe to Vulnerabilities