Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

Go to Calendar     Go to Press Room     Go to Newsletters subscription

Search

Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2021-3950
Publication date:
19/11/2021
django-helpdesk is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Severity CVSS v4.0: Pending analysis
Last modification:
23/11/2021

CVE-2021-3957
Publication date:
19/11/2021
kimai2 is vulnerable to Cross-Site Request Forgery (CSRF)
Severity CVSS v4.0: Pending analysis
Last modification:
23/11/2021

CVE-2021-3974
Publication date:
19/11/2021
vim is vulnerable to Use After Free
Severity CVSS v4.0: Pending analysis
Last modification:
07/11/2023

CVE-2021-3976
Publication date:
19/11/2021
kimai2 is vulnerable to Cross-Site Request Forgery (CSRF)
Severity CVSS v4.0: Pending analysis
Last modification:
23/11/2021

CVE-2021-39231
Publication date:
19/11/2021
In Apache Ozone versions prior to 1.2.0, Various internal server-to-server RPC endpoints are available for connections, making it possible for an attacker to download raw data from Datanode and Ozone manager and modify Ratis replication configuration.
Severity CVSS v4.0: Pending analysis
Last modification:
21/01/2024

CVE-2021-39232
Publication date:
19/11/2021
In Apache Ozone versions prior to 1.2.0, certain admin related SCM commands can be executed by any authenticated users, not just by admins.
Severity CVSS v4.0: Pending analysis
Last modification:
22/12/2023

CVE-2021-39233
Publication date:
19/11/2021
In Apache Ozone versions prior to 1.2.0, Container related Datanode requests of Ozone Datanode were not properly authorized and can be called by any client.
Severity CVSS v4.0: Pending analysis
Last modification:
07/11/2023

CVE-2021-39236
Publication date:
19/11/2021
In Apache Ozone before 1.2.0, Authenticated users with valid Ozone S3 credentials can create specific OM requests, impersonating any other user.
Severity CVSS v4.0: Pending analysis
Last modification:
22/12/2023

CVE-2021-39235
Publication date:
19/11/2021
In Apache Ozone before 1.2.0, Ozone Datanode doesn't check the access mode parameter of the block token. Authenticated users with valid READ block token can do any write operation on the same block.
Severity CVSS v4.0: Pending analysis
Last modification:
22/12/2023

CVE-2021-39234
Publication date:
19/11/2021
In Apache Ozone versions prior to 1.2.0, Authenticated users knowing the ID of an existing block can craft specific request allowing access those blocks, bypassing other security checks like ACL.
Severity CVSS v4.0: Pending analysis
Last modification:
19/11/2021

CVE-2021-41532
Publication date:
19/11/2021
In Apache Ozone before 1.2.0, Recon HTTP endpoints provide access to OM, SCM and Datanode metadata. Due to a bug, any unauthenticated user can access the data from these endpoints.
Severity CVSS v4.0: Pending analysis
Last modification:
09/08/2022

CVE-2021-36372
Publication date:
19/11/2021
In Apache Ozone versions prior to 1.2.0, Initially generated block tokens are persisted to the metadata database and can be retrieved with authenticated users with permission to the key. Authenticated users may use them even after access is revoked.
Severity CVSS v4.0: Pending analysis
Last modification:
31/01/2024
Subscribe to Vulnerabilities