Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2020-7779

Publication date:

26/11/2020

All versions of package djvalidator are vulnerable to Regular Expression Denial of Service (ReDoS) by sending crafted invalid emails - for example, --@------------------------------------------------------------------------------------------------------------------------!.

Severity CVSS v4.0: Pending analysis

Last modification:

21/07/2021

CVE-2020-7778

Publication date:

26/11/2020

This affects the package systeminformation before 4.30.2. The attacker can overwrite the properties and functions of an object, which can lead to executing OS commands.

Severity CVSS v4.0: Pending analysis

Last modification:

01/12/2020

CVE-2020-29128

Publication date:

26/11/2020

petl before 1.68, in some configurations, allows resolution of entities in an XML document.

Severity CVSS v4.0: Pending analysis

Last modification:

03/12/2020

CVE-2020-27251

Publication date:

26/11/2020

A heap overflow vulnerability exists within FactoryTalk Linx Version 6.11 and prior. This vulnerability could allow a remote, unauthenticated attacker to send malicious port ranges, which could result in remote code execution.

Severity CVSS v4.0: Pending analysis

Last modification:

30/11/2020

CVE-2020-27253

Publication date:

26/11/2020

A flaw exists in the Ingress/Egress checks routine of FactoryTalk Linx Version 6.11 and prior. This vulnerability could allow a remote, unauthenticated attacker to specifically craft a malicious packet resulting in a denial-of-service condition on the device.

Severity CVSS v4.0: Pending analysis

Last modification:

30/11/2020

CVE-2020-27255

Publication date:

26/11/2020

A heap overflow vulnerability exists within FactoryTalk Linx Version 6.11 and prior. This vulnerability could allow a remote, unauthenticated attacker to send malicious set attribute requests, which could result in the leaking of sensitive information. This information disclosure could lead to the bypass of address space layout randomization (ASLR).

Severity CVSS v4.0: Pending analysis

Last modification:

30/11/2020

CVE-2020-25652

Publication date:

26/11/2020

A flaw was found in the spice-vdagentd daemon, where it did not properly handle client connections that can be established via the UNIX domain socket in `/run/spice-vdagentd/spice-vdagent-sock`. Any unprivileged local guest user could use this flaw to prevent legitimate agents from connecting to the spice-vdagentd daemon, resulting in a denial of service. The highest threat from this vulnerability is to system availability. This flaw affects spice-vdagent versions 0.20 and prior.

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2020-25651

Publication date:

26/11/2020

A flaw was found in the SPICE file transfer protocol. File data from the host system can end up in full or in parts in the client connection of an illegitimate local user in the VM system. Active file transfers from other users could also be interrupted, resulting in a denial of service. The highest threat from this vulnerability is to data confidentiality as well as system availability. This flaw affects spice-vdagent versions 0.20 and prior.

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2020-25653

Publication date:

26/11/2020

A race condition vulnerability was found in the way the spice-vdagentd daemon handled new client connections. This flaw may allow an unprivileged local guest user to become the active agent for spice-vdagentd, possibly resulting in a denial of service or information leakage from the host. The highest threat from this vulnerability is to data confidentiality as well as system availability. This flaw affects spice-vdagent versions 0.20 and prior.

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2020-14190

Publication date:

25/11/2020

Affected versions of Atlassian Fisheye/Crucible allow remote attackers to achieve Regex Denial of Service via user-supplied regex in EyeQL. The affected versions are before version 4.8.4.

Severity CVSS v4.0: Pending analysis

Last modification:

21/07/2021

CVE-2020-29074

Publication date:

25/11/2020

scan.c in x11vnc 0.9.16 uses IPC_CREAT|0777 in shmget calls, which allows access by actors other than the current user.

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2020-14191

Publication date:

25/11/2020

Affected versions of Atlassian Fisheye/Crucible allow remote attackers to impact the application&#39;s availability via a Denial of Service (DoS) vulnerability in the MessageBundleResource within Atlassian Gadgets. The affected versions are before version 4.8.4.

Severity CVSS v4.0: Pending analysis

Last modification:

21/07/2021

Subscribe to Vulnerabilities