Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2021-32069

Publication date:

13/08/2021

The AWV component of Mitel MiCollab before 9.3 could allow an attacker to perform a Man-In-the-Middle attack due to improper TLS negotiation. A successful exploit could allow an attacker to view and modify data.

Severity CVSS v4.0: Pending analysis

Last modification:

23/08/2021

CVE-2021-32068

Publication date:

13/08/2021

The AWV and MiCollab Client Service components in Mitel MiCollab before 9.3 could allow an attacker to perform a Man-In-the-Middle attack by sending multiple session renegotiation requests, due to insufficient TLS session controls. A successful exploit could allow an attacker to modify application data and state.

Severity CVSS v4.0: Pending analysis

Last modification:

23/08/2021

CVE-2021-32067

Publication date:

13/08/2021

The MiCollab Client Service component in Mitel MiCollab before 9.3 could allow an attacker to view sensitive system information through an HTTP response due to insufficient output sanitization.

Severity CVSS v4.0: Pending analysis

Last modification:

23/08/2021

CVE-2021-27402

Publication date:

13/08/2021

The SAS Admin portal of Mitel MiCollab before 9.2 FP2 could allow an unauthenticated attacker to access (view and modify) user data by injecting arbitrary directory paths due to improper URL validation, aka Directory Traversal.

Severity CVSS v4.0: Pending analysis

Last modification:

23/08/2021

CVE-2021-27401

Publication date:

13/08/2021

The Join Meeting page of Mitel MiCollab Web Client before 9.2 FP2 could allow an attacker to access (view and modify) user data by executing arbitrary code due to insufficient input validation, aka Cross-Site Scripting (XSS).

Severity CVSS v4.0: Pending analysis

Last modification:

23/08/2021

CVE-2021-1104

Publication date:

13/08/2021

The RISC-V Instruction Set Manual contains a documented ambiguity for the Machine Trap Vector Base Address (MTVEC) register that may lead to a vulnerability due to the initial state of the register not being defined, potentially leading to information disclosure, data tampering and denial of service.

Severity CVSS v4.0: Pending analysis

Last modification:

23/08/2021

CVE-2021-37693

Publication date:

13/08/2021

Discourse is an open-source platform for community discussion. In Discourse before versions 2.7.8 and 2.8.0.beta4, when adding additional email addresses to an existing account on a Discourse site an email token is generated as part of the email verification process. Deleting the additional email address does not invalidate an unused token which can then be used in other contexts, including reseting a password.

Severity CVSS v4.0: Pending analysis

Last modification:

30/08/2021

CVE-2021-37028

Publication date:

13/08/2021

There is a command injection vulnerability in the HG8045Q product. When the command-line interface is enabled, which is disabled by default, attackers with administrator privilege could execute part of commands.

Severity CVSS v4.0: Pending analysis

Last modification:

25/08/2021

CVE-2021-32072

Publication date:

13/08/2021

The MiCollab Client Service component in Mitel MiCollab before 9.3 could allow an attacker to get source code information (disclosing sensitive application data) due to insufficient output sanitization. A successful exploit could allow an attacker to view source code methods.

Severity CVSS v4.0: Pending analysis

Last modification:

25/08/2021

CVE-2021-37586

Publication date:

13/08/2021

The PowerPlay Web component of Mitel Interaction Recording Multitenancy systems before 6.7 could allow a user (with Administrator rights) to replay a previously recorded conversation of another tenant due to insufficient validation.

Severity CVSS v4.0: Pending analysis

Last modification:

25/08/2021

CVE-2021-34398

Publication date:

13/08/2021

NVIDIA DCGM, all versions prior to 2.2.9, contains a vulnerability in the DIAG module where any user can inject shared libraries into the DCGM server, which is usually running as root, which may lead to privilege escalation, total loss of confidentiality and integrity, and complete denial of service.

Severity CVSS v4.0: Pending analysis

Last modification:

27/08/2021

CVE-2021-37703

Publication date:

13/08/2021

Discourse is an open-source platform for community discussion. In Discourse before versions 2.7.8 and 2.8.0.beta5, a user&#39;s read state for a topic such as the last read post number and the notification level is exposed.

Severity CVSS v4.0: Pending analysis

Last modification:

30/08/2021

Subscribe to Vulnerabilities