Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2021-37028

Publication date:

13/08/2021

There is a command injection vulnerability in the HG8045Q product. When the command-line interface is enabled, which is disabled by default, attackers with administrator privilege could execute part of commands.

Severity CVSS v4.0: Pending analysis

Last modification:

25/08/2021

CVE-2021-32072

Publication date:

13/08/2021

The MiCollab Client Service component in Mitel MiCollab before 9.3 could allow an attacker to get source code information (disclosing sensitive application data) due to insufficient output sanitization. A successful exploit could allow an attacker to view source code methods.

Severity CVSS v4.0: Pending analysis

Last modification:

25/08/2021

CVE-2021-37586

Publication date:

13/08/2021

The PowerPlay Web component of Mitel Interaction Recording Multitenancy systems before 6.7 could allow a user (with Administrator rights) to replay a previously recorded conversation of another tenant due to insufficient validation.

Severity CVSS v4.0: Pending analysis

Last modification:

25/08/2021

CVE-2021-34398

Publication date:

13/08/2021

NVIDIA DCGM, all versions prior to 2.2.9, contains a vulnerability in the DIAG module where any user can inject shared libraries into the DCGM server, which is usually running as root, which may lead to privilege escalation, total loss of confidentiality and integrity, and complete denial of service.

Severity CVSS v4.0: Pending analysis

Last modification:

27/08/2021

CVE-2021-37703

Publication date:

13/08/2021

Discourse is an open-source platform for community discussion. In Discourse before versions 2.7.8 and 2.8.0.beta5, a user&#39;s read state for a topic such as the last read post number and the notification level is exposed.

Severity CVSS v4.0: Pending analysis

Last modification:

30/08/2021

CVE-2021-29880

Publication date:

13/08/2021

IBM QRadar SIEM 7.4.3 GA - 7.4.3 Fix Pack 1 when using domains or multi-tenancy could be vulnerable to information disclosure between tenants by routing SIEM data to the incorrect domain. IBM X-Force ID: 206979.

Severity CVSS v4.0: Pending analysis

Last modification:

12/07/2022

CVE-2021-36380

Publication date:

13/08/2021

Sunhillo SureLine before 8.7.0.1.1 allows Unauthenticated OS Command Injection via shell metacharacters in ipAddr or dnsAddr /cgi/networkDiag.cgi.

Severity CVSS v4.0: Pending analysis

Last modification:

05/11/2025

CVE-2021-38619

Publication date:

13/08/2021

openBaraza HCM 3.1.6 does not properly neutralize user-controllable input: an unauthenticated remote attacker can conduct a stored cross-site scripting (XSS) attack against an administrative user from hr/subscription.jsp and hr/application.jsp and and hr/index.jsp (with view=).

Severity CVSS v4.0: Pending analysis

Last modification:

23/08/2021

CVE-2021-38621

Publication date:

13/08/2021

The remove API in v1/controller/cloudStorage/alibabaCloud/remove/index.ts in netless Agora Flat Server before 2021-07-30 mishandles file ownership.

Severity CVSS v4.0: Pending analysis

Last modification:

12/07/2022

CVE-2021-3573

Publication date:

13/08/2021

A use-after-free in function hci_sock_bound_ioctl() of the Linux kernel HCI subsystem was found in the way user calls ioct HCIUNBLOCKADDR or other way triggers race condition of the call hci_unregister_dev() together with one of the calls hci_sock_blacklist_add(), hci_sock_blacklist_del(), hci_get_conn_info(), hci_get_auth_info(). A privileged local user could use this flaw to crash the system or escalate their privileges on the system. This flaw affects the Linux kernel versions prior to 5.13-rc5.

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2021-3635

Publication date:

13/08/2021

A flaw was found in the Linux kernel netfilter implementation in versions prior to 5.5-rc7. A user with root (CAP_SYS_ADMIN) access is able to panic the system when issuing netfilter netflow commands.

Severity CVSS v4.0: Pending analysis

Last modification:

23/08/2021

CVE-2021-38583

Publication date:

13/08/2021

openBaraza HCM 3.1.6 does not properly neutralize user-controllable input, which allows reflected cross-site scripting (XSS) on multiple pages: hr/subscription.jsp and hr/application.jsp and and hr/index.jsp (with view= and data=).

Severity CVSS v4.0: Pending analysis

Last modification:

24/08/2021

Subscribe to Vulnerabilities