Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2021-28657

Publication date:

31/03/2021

A carefully crafted or corrupt file may trigger an infinite loop in Tika&#39;s MP3Parser up to and including Tika 1.25. Apache Tika users should upgrade to 1.26 or later.

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2021-21413

Publication date:

30/03/2021

isolated-vm is a library for nodejs which gives you access to v8&#39;s Isolate interface. Versions of isolated-vm before v4.0.0 have API pitfalls which may make it easy for implementers to expose supposed secure isolates to the permissions of the main nodejs isolate. Reference objects allow access to the underlying reference&#39;s full prototype chain. In an environment where the implementer has exposed a Reference instance to an attacker they would be able to use it to acquire a Reference to the nodejs context&#39;s Function object. Similar application-specific attacks could be possible by modifying the local prototype of other API objects. Access to NativeModule objects could allow an attacker to load and run native code from anywhere on the filesystem. If combined with, for example, a file upload API this would allow for arbitrary code execution. This is addressed in v4.0.0 through a series of related changes.

Severity CVSS v4.0: Pending analysis

Last modification:

07/04/2021

CVE-2020-24995

Publication date:

30/03/2021

Buffer overflow vulnerability in sniff_channel_order function in aacdec_template.c in ffmpeg 3.1.2, allows attackers to execute arbitrary code (local).

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2021-29647

Publication date:

30/03/2021

An issue was discovered in the Linux kernel before 5.11.11. qrtr_recvmsg in net/qrtr/qrtr.c allows attackers to obtain sensitive information from kernel memory because of a partially uninitialized data structure, aka CID-50535249f624.

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2021-29649

Publication date:

30/03/2021

An issue was discovered in the Linux kernel before 5.11.11. The user mode driver (UMD) has a copy_process() memory leak, related to a lack of cleanup steps in kernel/usermode_driver.c and kernel/bpf/preload/bpf_preload_kern.c, aka CID-f60a85cad677.

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2021-29646

Publication date:

30/03/2021

An issue was discovered in the Linux kernel before 5.11.11. tipc_nl_retrieve_key in net/tipc/node.c does not properly validate certain data sizes, aka CID-0217ed2848e8.

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2021-29648

Publication date:

30/03/2021

An issue was discovered in the Linux kernel before 5.11.11. The BPF subsystem does not properly consider that resolved_ids and resolved_sizes are intentionally uninitialized in the vmlinux BPF Type Format (BTF), which can cause a system crash upon an unexpected access attempt (in map_create in kernel/bpf/syscall.c or check_btf_info in kernel/bpf/verifier.c), aka CID-350a5c4dd245.

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2021-29650

Publication date:

30/03/2021

An issue was discovered in the Linux kernel before 5.11.11. The netfilter subsystem allows attackers to cause a denial of service (panic) because net/netfilter/x_tables.c and include/linux/netfilter/x_tables.h lack a full memory barrier upon the assignment of a new table value, aka CID-175e476b8cdf.

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2020-24391

Publication date:

30/03/2021

mongo-express before 1.0.0 offers support for certain advanced syntax but implements this in an unsafe way. NOTE: this may overlap CVE-2019-10769.

Severity CVSS v4.0: Pending analysis

Last modification:

02/04/2021

CVE-2021-29642

Publication date:

30/03/2021

GistPad before 0.2.7 allows a crafted workspace folder to change the URL for the Gist API, which leads to leakage of GitHub access tokens.

Severity CVSS v4.0: Pending analysis

Last modification:

04/06/2021

CVE-2021-3475

Publication date:

30/03/2021

There is a flaw in OpenEXR in versions before 3.0.0-beta. An attacker who can submit a crafted file to be processed by OpenEXR could cause an integer overflow, potentially leading to problems with application availability.

Severity CVSS v4.0: Pending analysis

Last modification:

03/02/2023

CVE-2021-3476

Publication date:

30/03/2021

A flaw was found in OpenEXR&#39;s B44 uncompression functionality in versions before 3.0.0-beta. An attacker who is able to submit a crafted file to OpenEXR could trigger shift overflows, potentially affecting application availability.

Severity CVSS v4.0: Pending analysis

Last modification:

02/02/2023

Subscribe to Vulnerabilities