Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

Go to Calendar     Go to Press Room     Go to Newsletters subscription

Search

Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2021-37699
Publication date:
12/08/2021
Next.js is an open source website development framework to be used with the React library. In affected versions specially encoded paths could be used when pages/_error.js was statically generated allowing an open redirect to occur to an external site. In general, this redirect does not directly harm users although can allow for phishing attacks by redirecting to an attacker's domain from a trusted domain. We recommend everyone to upgrade regardless of whether you can reproduce the issue or not. The issue has been patched in release 11.1.0.
Severity CVSS v4.0: Pending analysis
Last modification:
20/08/2021

CVE-2021-38590
Publication date:
11/08/2021
In cPanel before 96.0.8, weak permissions on web stats can lead to information disclosure (SEC-584).
Severity CVSS v4.0: Pending analysis
Last modification:
03/05/2022

CVE-2021-38588
Publication date:
11/08/2021
In cPanel before 96.0.13, fix_cpanel_perl lacks verification of the integrity of downloads (SEC-587).
Severity CVSS v4.0: Pending analysis
Last modification:
20/08/2021

CVE-2021-38589
Publication date:
11/08/2021
In cPanel before 96.0.13, scripts/fix-cpanel-perl does not properly restrict the overwriting of files (SEC-588).
Severity CVSS v4.0: Pending analysis
Last modification:
20/08/2021

CVE-2021-38585
Publication date:
11/08/2021
The WHM Locale Upload feature in cPanel before 98.0.1 allows unserialization attacks (SEC-585).
Severity CVSS v4.0: Pending analysis
Last modification:
20/08/2021

CVE-2021-38584
Publication date:
11/08/2021
The WHM Locale Upload feature in cPanel before 98.0.1 allows XXE attacks (SEC-585).
Severity CVSS v4.0: Pending analysis
Last modification:
20/08/2021

CVE-2021-37697
Publication date:
11/08/2021
tmerc-cogs are a collection of open source plugins for the Red Discord bot. A vulnerability has been found in the code that allows any user to access sensitive information by crafting a specific membership event message. Issue is patched in commit d63c49b4cfc30c795336e4fff08cba3795e0fcc0. As a workaround users may unload the Welcome cog.
Severity CVSS v4.0: Pending analysis
Last modification:
20/08/2021

CVE-2021-38586
Publication date:
11/08/2021
In cPanel before 98.0.1, /scripts/cpan_config performs unsafe operations on files (SEC-589).
Severity CVSS v4.0: Pending analysis
Last modification:
20/08/2021

CVE-2021-38587
Publication date:
11/08/2021
In cPanel before 96.0.13, scripts/fix-cpanel-perl mishandles the creation of temporary files (SEC-586).
Severity CVSS v4.0: Pending analysis
Last modification:
12/07/2022

CVE-2021-37696
Publication date:
11/08/2021
tmerc-cogs are a collection of open source plugins for the Red Discord bot. A vulnerability has been found in the code that allows any user to access sensitive information by crafting a specific MassDM message. Issue is patched in commit 92325be650a6c17940cc52611797533ed95dbbe1. All users are advised to update to the current commit. As a workaround users may unload the MassDM cog or globally disable the `[p]massdm` command.
Severity CVSS v4.0: Pending analysis
Last modification:
20/08/2021

CVE-2021-37627
Publication date:
11/08/2021
Contao is an open source CMS that allows creation of websites and scalable web applications. In affected versions it is possible to gain privileged rights in the Contao back end. Installations are only affected if they have untrusted back end users who have access to the form generator. All users are advised to update to Contao 4.4.56, 4.9.18 or 4.11.7. As a workaround users may disable the form generator or disable the login for untrusted back end users.
Severity CVSS v4.0: Pending analysis
Last modification:
20/08/2021

CVE-2021-37626
Publication date:
11/08/2021
Contao is an open source CMS that allows you to create websites and scalable web applications. In affected versions it is possible to load PHP files by entering insert tags in the Contao back end. Installations are only affected if they have untrusted back end users who have the rights to modify fields that are shown in the front end. Update to Contao 4.4.56, 4.9.18 or 4.11.7 to resolve. If you cannot update then disable the login for untrusted back end users.
Severity CVSS v4.0: Pending analysis
Last modification:
20/08/2021
Subscribe to Vulnerabilities