Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2020-12388

Publication date:

26/05/2020

The Firefox content processes did not sufficiently lockdown access control which could result in a sandbox escape. *Note: this issue only affects Firefox on Windows operating systems.*. This vulnerability affects Firefox ESR

Severity CVSS v4.0: Pending analysis

Last modification:

28/02/2023

CVE-2020-12391

Publication date:

26/05/2020

Documents formed using data: URLs in an OBJECT element failed to inherit the CSP of the creating context. This allowed the execution of scripts that should have been blocked, albeit with a unique opaque origin. This vulnerability affects Firefox

Severity CVSS v4.0: Pending analysis

Last modification:

12/07/2022

CVE-2020-12392

Publication date:

26/05/2020

The &#39;Copy as cURL&#39; feature of Devtools&#39; network tab did not properly escape the HTTP POST data of a request, which can be controlled by the website. If a user used the &#39;Copy as cURL&#39; feature and pasted the command into a terminal, it could have resulted in the disclosure of local files. This vulnerability affects Firefox ESR

Severity CVSS v4.0: Pending analysis

Last modification:

26/04/2022

CVE-2020-12389

Publication date:

26/05/2020

Severity CVSS v4.0: Pending analysis

Last modification:

27/05/2020

CVE-2020-6830

Publication date:

26/05/2020

For native-to-JS bridging, the app requires a unique token to be passed that ensures non-app code can&#39;t call the bridging functions. That token was being used for JS-to-native also, but it isn&#39;t needed in this case, and its usage was also leaking this token. This vulnerability affects Firefox for iOS

Severity CVSS v4.0: Pending analysis

Last modification:

28/05/2020

CVE-2020-12390

Publication date:

26/05/2020

Incorrect origin serialization of URLs with IPv6 addresses could lead to incorrect security checks. This vulnerability affects Firefox

Severity CVSS v4.0: Pending analysis

Last modification:

29/05/2020

CVE-2020-6831

Publication date:

26/05/2020

A buffer overflow could occur when parsing and validating SCTP chunks in WebRTC. This could have led to memory corruption and a potentially exploitable crash. This vulnerability affects Firefox ESR

Severity CVSS v4.0: Pending analysis

Last modification:

21/07/2021

CVE-2020-12387

Publication date:

26/05/2020

A race condition when running shutdown code for Web Worker led to a use-after-free vulnerability. This resulted in a potentially exploitable crash. This vulnerability affects Firefox ESR

Severity CVSS v4.0: Pending analysis

Last modification:

14/12/2021

CVE-2020-12393

Publication date:

26/05/2020

The &#39;Copy as cURL&#39; feature of Devtools&#39; network tab did not properly escape the HTTP method of a request, which can be controlled by the website. If a user used the &#39;Copy as cURL&#39; feature and pasted the command into a terminal, it could have resulted in command injection and arbitrary command execution. *Note: this issue only affects Firefox on Windows operating systems.*. This vulnerability affects Firefox ESR

Severity CVSS v4.0: Pending analysis

Last modification:

21/07/2021

CVE-2020-12394

Publication date:

26/05/2020

A logic flaw in our location bar implementation could have allowed a local attacker to spoof the current location by selecting a different origin and removing focus from the input element. This vulnerability affects Firefox

Severity CVSS v4.0: Pending analysis

Last modification:

26/04/2022

CVE-2020-12395

Publication date:

26/05/2020

Mozilla developers and community members reported memory safety bugs present in Firefox 75 and Firefox ESR 68.7. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox ESR

Severity CVSS v4.0: Pending analysis

Last modification:

26/04/2022

CVE-2020-12396

Publication date:

26/05/2020

Mozilla developers and community members reported memory safety bugs present in Firefox 75. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox

Severity CVSS v4.0: Pending analysis

Last modification:

26/04/2022

Subscribe to Vulnerabilities