Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2021-30139

Publication date:

21/04/2021

In Alpine Linux apk-tools before 2.12.5, the tarball parser allows a buffer overflow and crash.

Severity CVSS v4.0: Pending analysis

Last modification:

22/04/2021

CVE-2020-35980

Publication date:

21/04/2021

An issue was discovered in GPAC version 0.8.0 and 1.0.1. There is a use-after-free in the function gf_isom_box_del() in isomedia/box_funcs.c.

Severity CVSS v4.0: Pending analysis

Last modification:

27/05/2023

CVE-2021-21642

Publication date:

21/04/2021

Jenkins Config File Provider Plugin 3.7.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

Severity CVSS v4.0: Pending analysis

Last modification:

25/10/2023

CVE-2021-21647

Publication date:

21/04/2021

Jenkins CloudBees CD Plugin 1.1.21 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Item/Read permission to schedule builds of projects without having Item/Build permission.

Severity CVSS v4.0: Pending analysis

Last modification:

25/10/2023

CVE-2021-21646

Publication date:

21/04/2021

Jenkins Templating Engine Plugin 2.1 and earlier does not protect its pipeline configurations using Script Security Plugin, allowing attackers with Job/Configure permission to execute arbitrary code in the context of the Jenkins controller JVM.

Severity CVSS v4.0: Pending analysis

Last modification:

25/10/2023

CVE-2021-21644

Publication date:

21/04/2021

A cross-site request forgery (CSRF) vulnerability in Jenkins Config File Provider Plugin 3.7.0 and earlier allows attackers to delete configuration files corresponding to an attacker-specified ID.

Severity CVSS v4.0: Pending analysis

Last modification:

30/11/2023

CVE-2021-21645

Publication date:

21/04/2021

Jenkins Config File Provider Plugin 3.7.0 and earlier does not perform permission checks in several HTTP endpoints, attackers with Overall/Read permission to enumerate configuration file IDs.

Severity CVSS v4.0: Pending analysis

Last modification:

25/10/2023

CVE-2021-21643

Publication date:

21/04/2021

Jenkins Config File Provider Plugin 3.7.0 and earlier does not correctly perform permission checks in several HTTP endpoints, allowing attackers with global Job/Configure permission to enumerate system-scoped credentials IDs of credentials stored in Jenkins.

Severity CVSS v4.0: Pending analysis

Last modification:

25/10/2023

CVE-2021-20454

Publication date:

21/04/2021

IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 196649.

Severity CVSS v4.0: Pending analysis

Last modification:

23/04/2021

CVE-2021-20501

Publication date:

21/04/2021

IBM i 7.1, 7.2, 7.3, and 7.4 SMTP allows a network attacker to send emails to non-existent local-domain recipients to the SMTP server, caused by using a non-default configuration. An attacker could exploit this vulnerability to consume unnecessary network bandwidth and disk space, and allow remote attackers to send spam email. IBM X-Force ID: 198056.

Severity CVSS v4.0: Pending analysis

Last modification:

12/07/2022

CVE-2021-28965

Publication date:

21/04/2021

The REXML gem before 3.2.5 in Ruby before 2.6.7, 2.7.x before 2.7.3, and 3.x before 3.0.1 does not properly address XML round-trip issues. An incorrect document can be produced after parsing and serializing.

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2021-29462

Publication date:

20/04/2021

The Portable SDK for UPnP Devices is an SDK for development of UPnP device and control point applications. The server part of pupnp (libupnp) appears to be vulnerable to DNS rebinding attacks because it does not check the value of the `Host` header. This can be mitigated by using DNS revolvers which block DNS-rebinding attacks. The vulnerability is fixed in version 1.14.6 and later.

Severity CVSS v4.0: Pending analysis

Last modification:

03/08/2022

Subscribe to Vulnerabilities