Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2020-35625

Publication date:

21/12/2020

An issue was discovered in the Widgets extension for MediaWiki through 1.35.1. Any user with the ability to edit pages within the Widgets namespace could call any static function within any class (defined within PHP or MediaWiki) via a crafted HTML comment, related to a Smarty template. For example, a person in the Widget Editors group could use \MediaWiki\Shell\Shell::command within a comment.

Severity CVSS v4.0: Pending analysis

Last modification:

21/07/2021

CVE-2020-26277

Publication date:

21/12/2020

DBdeployer is a tool that deploys MySQL database servers easily. In DBdeployer before version 1.58.2, users unpacking a tarball may use a maliciously packaged tarball that contains symlinks to files external to the target. In such scenario, an attacker could induce dbdeployer to write into a system file, thus altering the computer defenses. For the attack to succeed, the following factors need to contribute: 1) The user is logged in as root. While dbdeployer is usable as root, it was designed to run as unprivileged user. 2) The user has taken a tarball from a non secure source, without testing the checksum. When the tarball is retrieved through dbdeployer, the checksum is compared before attempting to unpack. This has been fixed in version 1.58.2.

Severity CVSS v4.0: Pending analysis

Last modification:

23/12/2020

CVE-2020-29596

Publication date:

21/12/2020

MiniWeb HTTP server 0.8.19 allows remote attackers to cause a denial of service (daemon crash) via a long name for the first parameter in a POST request.

Severity CVSS v4.0: Pending analysis

Last modification:

23/12/2020

CVE-2020-8995

Publication date:

21/12/2020

Programi Bilanc Build 007 Release 014 31.01.2020 supplies a .exe file containing several hardcoded credentials to different servers that allow remote attackers to gain access to the complete infrastructure including the website, update server, and external issue tracking tools.

Severity CVSS v4.0: Pending analysis

Last modification:

22/12/2020

CVE-2020-26281

Publication date:

21/12/2020

async-h1 is an asynchronous HTTP/1.1 parser for Rust (crates.io). There is a request smuggling vulnerability in async-h1 before version 2.3.0. This vulnerability affects any webserver that uses async-h1 behind a reverse proxy, including all such Tide applications. If the server does not read the body of a request which is longer than some buffer length, async-h1 will attempt to read a subsequent request from the body content starting at that offset into the body. One way to exploit this vulnerability would be for an adversary to craft a request such that the body contains a request that would not be noticed by a reverse proxy, allowing it to forge forwarded/x-forwarded headers. If an application trusted the authenticity of these headers, it could be misled by the smuggled request. Another potential concern with this vulnerability is that if a reverse proxy is sending multiple http clients&#39; requests along the same keep-alive connection, it would be possible for the smuggled request to specify a long content and capture another user&#39;s request in its body. This content could be captured in a post request to an endpoint that allows the content to be subsequently retrieved by the adversary. This has been addressed in async-h1 2.3.0 and previous versions have been yanked.

Severity CVSS v4.0: Pending analysis

Last modification:

16/02/2021

CVE-2020-35151

Publication date:

21/12/2020

The Online Marriage Registration System 1.0 post parameter "searchdata" in the user/search.php request is vulnerable to Time Based Sql Injection.

Severity CVSS v4.0: Pending analysis

Last modification:

14/11/2023

CVE-2020-11717

Publication date:

21/12/2020

An issue was discovered in Programi 014 31.01.2020. It has multiple SQL injection vulnerabilities.

Severity CVSS v4.0: Pending analysis

Last modification:

22/12/2020

CVE-2018-7580

Publication date:

21/12/2020

Philips Hue is vulnerable to a Denial of Service attack. Sending a SYN flood on port tcp/80 will freeze Philips Hue&#39;s hub and it will stop responding. The "hub" will stop operating and be frozen until the flood stops. During the flood, the user won&#39;t be able to turn on/off the lights, and all of the hub&#39;s functionality will be unresponsive. The cloud service also won&#39;t work with the hub.

Severity CVSS v4.0: Pending analysis

Last modification:

06/08/2022

CVE-2020-35606

Publication date:

21/12/2020

Arbitrary command execution can occur in Webmin through 1.962. Any user authorized for the Package Updates module can execute arbitrary commands with root privileges via vectors involving %0A and %0C. NOTE: this issue exists because of an incomplete fix for CVE-2019-12840.

Severity CVSS v4.0: Pending analysis

Last modification:

26/04/2022

CVE-2020-35605

Publication date:

21/12/2020

The Graphics Protocol feature in graphics.c in kitty before 0.19.3 allows remote attackers to execute arbitrary code because a filename containing special characters can be included in an error message.

Severity CVSS v4.0: Pending analysis

Last modification:

24/04/2025