Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2021-38343

Publication date:

30/08/2021

The Nested Pages WordPress plugin

Severity CVSS v4.0: Pending analysis

Last modification:

18/12/2023

CVE-2021-38342

Publication date:

30/08/2021

The Nested Pages WordPress plugin

Severity CVSS v4.0: Pending analysis

Last modification:

18/12/2023

CVE-2021-37417

Publication date:

30/08/2021

Zoho ManageEngine ADSelfService Plus version 6103 and prior allows CAPTCHA bypass due to improper parameter validation.

Severity CVSS v4.0: Pending analysis

Last modification:

12/07/2022

CVE-2021-37421

Publication date:

30/08/2021

Zoho ManageEngine ADSelfService Plus 6103 and prior is vulnerable to admin portal access-restriction bypass.

Severity CVSS v4.0: Pending analysis

Last modification:

12/07/2022

CVE-2021-36370

Publication date:

30/08/2021

An issue was discovered in Midnight Commander through 4.8.26. When establishing an SFTP connection, the fingerprint of the server is neither checked nor displayed. As a result, a user connects to the server without the ability to verify its authenticity.

Severity CVSS v4.0: Pending analysis

Last modification:

08/09/2021

CVE-2021-37416

Publication date:

30/08/2021

Zoho ManageEngine ADSelfService Plus version 6103 and prior is vulnerable to reflected XSS on the loadframe page.

Severity CVSS v4.0: Pending analysis

Last modification:

02/09/2021

CVE-2021-22021

Publication date:

30/08/2021

VMware vRealize Log Insight (8.x prior to 8.4) contains a Cross Site Scripting (XSS) vulnerability due to improper user input validation. An attacker with user privileges may be able to inject a malicious payload via the Log Insight UI which would be executed when the victim accesses the shared dashboard link.

Severity CVSS v4.0: Pending analysis

Last modification:

02/09/2021

CVE-2021-33055

Publication date:

30/08/2021

Zoho ManageEngine ADSelfService Plus through 6102 allows unauthenticated remote code execution in non-English editions.

Severity CVSS v4.0: Pending analysis

Last modification:

02/09/2021

CVE-2021-34066

Publication date:

30/08/2021

An issue was discovered in EdgeGallery/developer before v1.0. There is a "Deserialization of yaml file" vulnerability that can allow attackers to execute system command through uploading the malicious constructed YAML file.

Severity CVSS v4.0: Pending analysis

Last modification:

07/09/2021

CVE-2021-35061

Publication date:

30/08/2021

Multiple cross-site scripting (XSS) vulnerabilities in DRK Odenwaldkreis Testerfassung March-2021 allow remote attackers to inject arbitrary web script or HTML via all parameters to HTML form fields in all components.

Severity CVSS v4.0: Pending analysis

Last modification:

21/09/2021

CVE-2021-29630

Publication date:

30/08/2021

In FreeBSD 13.0-STABLE before n246938-0729ba2f49c9, 12.2-STABLE before r370383, 11.4-STABLE before r370381, 13.0-RELEASE before p4, 12.2-RELEASE before p10, and 11.4-RELEASE before p13, the ggatec daemon does not validate the size of a response before writing it to a fixed-sized buffer allowing a malicious attacker in a privileged network position to overwrite the stack of ggatec and potentially execute arbitrary code.

Severity CVSS v4.0: Pending analysis

Last modification:

14/12/2021

CVE-2021-34646

Publication date:

30/08/2021

Versions up to, and including, 5.4.3, of the Booster for WooCommerce WordPress plugin are vulnerable to authentication bypass via the process_email_verification function due to a random token generation weakness in the reset_and_mail_activation_link function found in the ~/includes/class-wcj-emails-verification.php file. This allows attackers to impersonate users and trigger an email address verification for arbitrary accounts, including administrative accounts, and automatically be logged in as that user, including any site administrators. This requires the Email Verification module to be active in the plugin and the Login User After Successful Verification setting to be enabled, which it is by default.

Severity CVSS v4.0: Pending analysis

Last modification:

12/08/2022

Subscribe to Vulnerabilities