Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2021-23340

Publication date:

18/02/2021

This affects the package pimcore/pimcore before 6.8.8. A Local FIle Inclusion vulnerability exists in the downloadCsvAction function of the CustomReportController class (bundles/AdminBundle/Controller/Reports/CustomReportController.php). An authenticated user can reach this function with a GET request at the following endpoint: /admin/reports/custom-report/download-csv?exportFile=&91;filename]. Since exportFile variable is not sanitized, an attacker can exploit a local file inclusion vulnerability.

Severity CVSS v4.0: Pending analysis

Last modification:

25/02/2021

CVE-2020-4933

Publication date:

18/02/2021

IBM Jazz Reporting Service 6.0.6.1, 7.0, 7.0.1, and 7.0.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 191751.

Severity CVSS v4.0: Pending analysis

Last modification:

22/02/2021

CVE-2020-28496

Publication date:

18/02/2021

This affects the package three before 0.125.0. This can happen when handling rgb or hsl colors. PoC: var three = require(&#39;three&#39;) function build_blank (n) { var ret = "rgb(" for (var i = 0; i

Severity CVSS v4.0: Pending analysis

Last modification:

25/02/2021

CVE-2020-28490

Publication date:

18/02/2021

The package async-git before 1.13.2 are vulnerable to Command Injection via shell meta-characters (back-ticks). For example: git.reset(&#39;atouch HACKEDb&#39;)

Severity CVSS v4.0: Pending analysis

Last modification:

21/07/2021

CVE-2019-18255

Publication date:

18/02/2021

HMI/SCADA iFIX (Versions 6.1 and prior) allows a local authenticated user to modify system-wide iFIX configurations through section objects. This may allow privilege escalation.

Severity CVSS v4.0: Pending analysis

Last modification:

24/02/2021

CVE-2020-35577

Publication date:

18/02/2021

In Endalia Selection Portal before 4.205.0, an Insecure Direct Object Reference (IDOR) allows any authenticated user to download every file uploaded to the platform by changing the value of the file identifier (aka CommonDownload identification number).

Severity CVSS v4.0: Pending analysis

Last modification:

26/02/2021

CVE-2020-29664

Publication date:

18/02/2021

A command injection issue in dji_sys in DJI Mavic 2 Remote Controller before firmware version 01.00.0510 allows for code execution via a malicious firmware upgrade packet.

Severity CVSS v4.0: Pending analysis

Last modification:

21/07/2021

CVE-2021-27124

Publication date:

18/02/2021

SQL injection in the expertise parameter in search_result.php in Doctor Appointment System v1.0 allows an authenticated patient user to dump the database credentials via a SQL injection attack.

Severity CVSS v4.0: Pending analysis

Last modification:

24/02/2021

CVE-2021-27377

Publication date:

18/02/2021

An issue was discovered in the yottadb crate before 1.2.0 for Rust. For some memory-allocation patterns, ydb_subscript_next_st and ydb_subscript_prev_st have a use-after-free.

Severity CVSS v4.0: Pending analysis

Last modification:

25/02/2021

CVE-2021-27376

Publication date:

18/02/2021

An issue was discovered in the nb-connect crate before 1.0.3 for Rust. It may have invalid memory access for certain versions of the standard library because it relies on a direct cast of std::net::SocketAddrV4 and std::net::SocketAddrV6 data structures.

Severity CVSS v4.0: Pending analysis

Last modification:

25/02/2021

CVE-2021-27378

Publication date:

18/02/2021

An issue was discovered in the rand_core crate before 0.6.2 for Rust. Because read_u32_into and read_u64_into mishandle certain buffer-length checks, a random number generator may be seeded with too little data.

Severity CVSS v4.0: Pending analysis

Last modification:

12/07/2022