Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

Go to Calendar     Go to Press Room     Go to Newsletters subscription

Search

Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2021-23624
Publication date:
03/11/2021
This affects the package dotty before 0.1.2. A type confusion vulnerability can lead to a bypass of CVE-2021-25912 when the user-provided keys used in the path parameter are arrays.
Severity CVSS v4.0: Pending analysis
Last modification:
05/11/2021

CVE-2021-23509
Publication date:
03/11/2021
This affects the package json-ptr before 3.0.0. A type confusion vulnerability can lead to a bypass of CVE-2020-7766 when the user-provided keys used in the pointer parameter are arrays.
Severity CVSS v4.0: Pending analysis
Last modification:
05/11/2021

CVE-2021-41174
Publication date:
03/11/2021
Grafana is an open-source platform for monitoring and observability. In affected versions if an attacker is able to convince a victim to visit a URL referencing a vulnerable page, arbitrary JavaScript content may be executed within the context of the victim's browser. The user visiting the malicious link must be unauthenticated and the link must be for a page that contains the login button in the menu bar. The url has to be crafted to exploit AngularJS rendering and contain the interpolation binding for AngularJS expressions. AngularJS uses double curly braces for interpolation binding: {{ }} ex: {{constructor.constructor(‘alert(1)’)()}}. When the user follows the link and the page renders, the login button will contain the original link with a query parameter to force a redirect to the login page. The URL is not validated and the AngularJS rendering engine will execute the JavaScript expression contained in the URL. Users are advised to upgrade as soon as possible. If for some reason you cannot upgrade, you can use a reverse proxy or similar to block access to block the literal string {{ in the path.
Severity CVSS v4.0: Pending analysis
Last modification:
29/11/2021

CVE-2020-18259
Publication date:
03/11/2021
ED01-CMS v1.0 was discovered to contain a reflective cross-site scripting (XSS) vulnerability in the component sposts.php. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload inserted into the Post title or Post content fields.
Severity CVSS v4.0: Pending analysis
Last modification:
05/11/2021

CVE-2020-18261
Publication date:
03/11/2021
An arbitrary file upload vulnerability in the image upload function of ED01-CMS v1.0 allows attackers to execute arbitrary commands.
Severity CVSS v4.0: Pending analysis
Last modification:
05/11/2021

CVE-2020-18263
Publication date:
03/11/2021
PHP-CMS v1.0 was discovered to contain a SQL injection vulnerability in the component search.php via the search parameter. This vulnerability allows attackers to access sensitive database information.
Severity CVSS v4.0: Pending analysis
Last modification:
05/11/2021

CVE-2020-18262
Publication date:
03/11/2021
ED01-CMS v1.0 was discovered to contain a SQL injection in the component cposts.php via the cid parameter.
Severity CVSS v4.0: Pending analysis
Last modification:
05/11/2021

CVE-2020-24000
Publication date:
03/11/2021
SQL Injection vulnerability in eyoucms cms v1.4.7, allows attackers to execute arbitrary code and disclose sensitive information, via the tid parameter to index.php.
Severity CVSS v4.0: Pending analysis
Last modification:
04/11/2021

CVE-2020-23126
Publication date:
03/11/2021
Chamilo LMS version 1.11.10 contains an XSS vulnerability in the personal profile edition form, affecting the user him/herself and social network friends.
Severity CVSS v4.0: Pending analysis
Last modification:
04/11/2021

CVE-2020-24743
Publication date:
03/11/2021
An issue was found in /showReports.do Zoho ManageEngine Applications Manager up to 14550, allows attackers to gain escalated privileges via the resourceid parameter.
Severity CVSS v4.0: Pending analysis
Last modification:
05/11/2021

CVE-2021-26786
Publication date:
03/11/2021
An issue was discoverered in in customercentric-selling-poland PlayTube, allows authenticated attackers to execute arbitrary code via the purchace code to the config.php.
Severity CVSS v4.0: Pending analysis
Last modification:
05/11/2021

CVE-2020-23679
Publication date:
03/11/2021
Buffer overflow vulnerability in Renleilei1992 Linux_Network_Project 1.0, allows attackers to execute arbitrary code, via the password field.
Severity CVSS v4.0: Pending analysis
Last modification:
05/11/2021
Subscribe to Vulnerabilities