Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2019-16957

Publication date:

18/12/2020

SolarWinds Web Help Desk 12.7.0 allows XSS via the First Name field of a User Account.

Severity CVSS v4.0: Pending analysis

Last modification:

18/12/2020

CVE-2020-35551

Publication date:

18/12/2020

An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), and Q(10.0) (Exynos chipsets) software. They allow attackers to conduct RPMB state-change attacks because an unauthorized RPMB write operation can be replayed, a related issue to CVE-2020-13799. The Samsung ID is SVE-2020-18100 (December 2020).

Severity CVSS v4.0: Pending analysis

Last modification:

18/12/2020

CVE-2020-35550

Publication date:

18/12/2020

An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), Q(10.0), and R(11.0) software. Attackers can bypass Factory Reset Protection (FRP) via StatusBar. The Samsung ID is SVE-2020-17888 (December 2020).

Severity CVSS v4.0: Pending analysis

Last modification:

18/12/2020

CVE-2020-35549

Publication date:

18/12/2020

An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), and Q(10.0) software. Any application may establish itself as the default dialer, without user interaction. The Samsung ID is SVE-2020-19172 (December 2020).

Severity CVSS v4.0: Pending analysis

Last modification:

21/12/2020

CVE-2020-35548

Publication date:

18/12/2020

An issue was discovered in Finder on Samsung mobile devices with Q(10.0) software. A call to a non-existent provider allows attackers to cause a denial of service. The Samsung ID is SVE-2020-18629 (December 2020).

Severity CVSS v4.0: Pending analysis

Last modification:

21/12/2020

CVE-2020-35474

Publication date:

18/12/2020

In MediaWiki before 1.35.1, the combination of Html::rawElement and Message::text leads to XSS because the definition of MediaWiki:recentchanges-legend-watchlistexpiry can be changed onwiki so that the output is raw HTML.

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2020-35475

Publication date:

18/12/2020

In MediaWiki before 1.35.1, the messages userrights-expiry-current and userrights-expiry-none can contain raw HTML. XSS can happen when a user visits Special:UserRights but does not have rights to change all userrights, and the table on the left side has unchangeable groups in it. (The right column with the changeable groups is not affected and is escaped correctly.)

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2020-35477

Publication date:

18/12/2020

MediaWiki before 1.35.1 blocks legitimate attempts to hide log entries in some situations. If one sets MediaWiki:Mainpage to Special:MyLanguage/Main Page, visits a log entry on Special:Log, and toggles the "Change visibility of selected log entries" checkbox (or a tags checkbox) next to it, there is a redirection to the main page&#39;s action=historysubmit (instead of the desired behavior in which a revision-deletion form appears).

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2020-35480

Publication date:

18/12/2020

An issue was discovered in MediaWiki before 1.35.1. Missing users (accounts that don&#39;t exist) and hidden users (accounts that have been explicitly hidden due to being abusive, or similar) that the viewer cannot see are handled differently, exposing sensitive information about the hidden status to unprivileged viewers. This exists on various code paths.

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2020-35478

Publication date:

18/12/2020

MediaWiki before 1.35.1 allows XSS via BlockLogFormatter.php. MediaWiki:blanknamespace potentially can be output as raw HTML with SCRIPT tags via LogFormatter::makePageLink(). This affects MediaWiki 1.33.0 and later.

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2020-35479

Publication date:

18/12/2020

MediaWiki before 1.35.1 allows XSS via BlockLogFormatter.php. Language::translateBlockExpiry itself does not escape in all code paths. For example, the return of Language::userTimeAndDate is is always unsafe for HTML in a month value. This affects MediaWiki 1.12.0 and later.

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2020-25609

Publication date:

18/12/2020

The NuPoint Messenger Portal of Mitel MiCollab before 9.2 could allow an authenticated attacker to execute arbitrary scripts due to insufficient input validation, aka XSS. A successful exploit could allow an attacker to view and modify user data.

Severity CVSS v4.0: Pending analysis

Last modification:

18/12/2020

Subscribe to Vulnerabilities