Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2020-35512

Publication date:

15/02/2021

A use-after-free flaw was found in D-Bus Development branch

Severity CVSS v4.0: Pending analysis

Last modification:

27/12/2023

CVE-2021-23338

Publication date:

15/02/2021

This affects all versions of package qlib. The workflow function in cli part of qlib was using an unsafe YAML load function.

Severity CVSS v4.0: Pending analysis

Last modification:

25/02/2021

CVE-2020-29026

Publication date:

15/02/2021

A directory traversal vulnerability exists in the file upload function of the GateManager that allows an authenticated attacker with administrative permissions to read and write arbitrary files in the Linux file system. This issue affects: GateManager all versions prior to 9.2c.

Severity CVSS v4.0: Pending analysis

Last modification:

22/02/2021

CVE-2020-29031

Publication date:

15/02/2021

An Insecure Direct Object Reference vulnerability exists in the web UI of the GateManager which allows an authenticated attacker to reset the password of any user in its domain or any sub-domain, via escalation of privileges. This issue affects all GateManager versions prior to 9.2c

Severity CVSS v4.0: Pending analysis

Last modification:

26/02/2021

CVE-2020-4955

Publication date:

15/02/2021

IBM Spectrum Protect Operations Center 7.1 and 8.1could allow a remote attacker to execute arbitrary code on the system, caused by improper parameter validation. By creating an unspecified servlet request with specially crafted input parameters, an attacker could exploit this vulnerability to load a malicious .dll with elevated privileges. IBM X-Force ID: 192155.

Severity CVSS v4.0: Pending analysis

Last modification:

17/02/2021

CVE-2020-4956

Publication date:

15/02/2021

IBM Spectrum Protect Operations Center 7.1 and 8.1 is vulnerable to a denial of service, caused by a RPC that allows certain cache values to be set and dumped to a file. By setting a grossly large cache value and dumping that cached value to a file multiple times, a remote attacker could exploit this vulnerability to cause the consumption of all memory resources. IBM X-Force ID: 192156.

Severity CVSS v4.0: Pending analysis

Last modification:

17/02/2021

CVE-2020-4954

Publication date:

15/02/2021

IBM Spectrum Protect Operations Center 7.1 and 8.1 could allow a remote attacker to bypass authentication restrictions, caused by improper session validation . By using the configuration panel to obtain a valid session using an attacker controlled IBM Spectrum Protect server, an attacker could exploit this vulnerability to bypass authentication and gain access to a limited number of debug functions, such as logging levels. IBM X-Force ID: 192153.

Severity CVSS v4.0: Pending analysis

Last modification:

17/02/2021

CVE-2020-35775

Publication date:

15/02/2021

CITSmart before 9.1.2.23 allows LDAP Injection.

Severity CVSS v4.0: Pending analysis

Last modification:

19/04/2021

CVE-2021-25299

Publication date:

15/02/2021

Nagios XI version xi-5.7.5 is affected by cross-site scripting (XSS). The vulnerability exists in the file /usr/local/nagiosxi/html/admin/sshterm.php due to improper sanitization of user-controlled input. A maliciously crafted URL, when clicked by an admin user, can be used to steal his/her session cookies or it can be chained with the previous bugs to get one-click remote command execution (RCE) on the Nagios XI server.

Severity CVSS v4.0: Pending analysis

Last modification:

04/03/2021

CVE-2021-23337

Publication date:

15/02/2021

Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.

Severity CVSS v4.0: Pending analysis

Last modification:

13/09/2022

CVE-2021-25298

Publication date:

15/02/2021

Nagios XI version xi-5.7.5 is affected by OS command injection. The vulnerability exists in the file /usr/local/nagiosxi/html/includes/configwizards/cloud-vm/cloud-vm.inc.php due to improper sanitization of authenticated user-controlled input by a single HTTP request, which can lead to OS command injection on the Nagios XI server.

Severity CVSS v4.0: Pending analysis

Last modification:

03/11/2025

CVE-2021-25297

Publication date:

15/02/2021

Nagios XI version xi-5.7.5 is affected by OS command injection. The vulnerability exists in the file /usr/local/nagiosxi/html/includes/configwizards/switch/switch.inc.php due to improper sanitization of authenticated user-controlled input by a single HTTP request, which can lead to OS command injection on the Nagios XI server.

Severity CVSS v4.0: Pending analysis

Last modification:

03/11/2025

Subscribe to Vulnerabilities