Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2021-41302

Publication date:

30/09/2021

ECOA BAS controller stores sensitive data (backup exports) in clear-text, thus the unauthenticated attacker can remotely query user password and obtain user’s privilege.

Severity CVSS v4.0: Pending analysis

Last modification:

12/08/2022

CVE-2021-41292

Publication date:

30/09/2021

ECOA BAS controller suffers from an authentication bypass vulnerability. An unauthenticated attacker through cookie poisoning can remotely bypass authentication and disclose sensitive information and circumvent physical access controls in smart homes and buildings and manipulate HVAC.

Severity CVSS v4.0: Pending analysis

Last modification:

25/04/2022

CVE-2021-41301

Publication date:

30/09/2021

ECOA BAS controller is vulnerable to configuration disclosure when direct object reference is made to the specific files using an HTTP GET request. This will enable the unauthenticated attacker to remotely disclose sensitive information and help her in authentication bypass, privilege escalation and full system access.

Severity CVSS v4.0: Pending analysis

Last modification:

07/10/2021

CVE-2021-41300

Publication date:

30/09/2021

ECOA BAS controller’s special page displays user account and passwords in plain text, thus unauthenticated attackers can access the page and obtain privilege with full functionality.

Severity CVSS v4.0: Pending analysis

Last modification:

07/10/2021

CVE-2021-41299

Publication date:

30/09/2021

ECOA BAS controller is vulnerable to hard-coded credentials within its Linux distribution image, thus remote attackers can obtain administrator’s privilege without logging in.

Severity CVSS v4.0: Pending analysis

Last modification:

07/10/2021

CVE-2021-41297

Publication date:

30/09/2021

ECOA BAS controller is vulnerable to weak access control mechanism allowing authenticated user to remotely escalate privileges by disclosing credentials of administrative accounts in plain-text.

Severity CVSS v4.0: Pending analysis

Last modification:

07/10/2021

CVE-2021-41298

Publication date:

30/09/2021

ECOA BAS controller is vulnerable to insecure direct object references that occur when the application provides direct access to objects based on user-supplied input. As a result of this vulnerability, attackers with general user&#39;s privilege can remotely bypass authorization and access the hidden resources in the system and execute privileged functionalities.

Severity CVSS v4.0: Pending analysis

Last modification:

07/10/2021

CVE-2021-41296

Publication date:

30/09/2021

ECOA BAS controller uses weak set of default administrative credentials that can be easily guessed in remote password attacks and gain full control of the system.

Severity CVSS v4.0: Pending analysis

Last modification:

07/10/2021

CVE-2021-41293

Publication date:

30/09/2021

ECOA BAS controller suffers from a path traversal vulnerability, causing arbitrary files disclosure. Using the specific POST parameter, unauthenticated attackers can remotely disclose arbitrary files on the affected device and disclose sensitive and system information.

Severity CVSS v4.0: Pending analysis

Last modification:

07/10/2021

CVE-2021-41294

Publication date:

30/09/2021

ECOA BAS controller suffers from a path traversal vulnerability, causing arbitrary files deletion. Using the specific GET parameter, unauthenticated attackers can remotely delete arbitrary files on the affected device and cause denial of service scenario.

Severity CVSS v4.0: Pending analysis

Last modification:

07/10/2021

CVE-2021-41295

Publication date:

30/09/2021

ECOA BAS controller has a Cross-Site Request Forgery vulnerability, thus authenticated attacker can remotely place a forged request at a malicious web page and execute CRUD commands (GET, POST, PUT, DELETE) to perform arbitrary operations in the system.

Severity CVSS v4.0: Pending analysis

Last modification:

07/10/2021

CVE-2021-41291

Publication date:

30/09/2021

ECOA BAS controller suffers from a path traversal content disclosure vulnerability. Using the GET parameter in File Manager, unauthenticated attackers can remotely disclose directory content on the affected device.

Severity CVSS v4.0: Pending analysis

Last modification:

07/10/2021

Subscribe to Vulnerabilities