Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2022-43325

Publication date:

02/12/2022

An unauthenticated command injection vulnerability in the product license validation function of Telos Alliance Omnia MPX Node 1.3.* - 1.4.* allows attackers to execute arbitrary commands via a crafted payload injected into the license input.

Severity CVSS v4.0: Pending analysis

Last modification:

24/04/2025

CVE-2022-44928

Publication date:

02/12/2022

D-Link DVG-G5402SP GE_1.03 was discovered to contain a command injection vulnerability via the Maintenance function.

Severity CVSS v4.0: Pending analysis

Last modification:

24/04/2025

CVE-2022-43333

Publication date:

01/12/2022

Telenia Software s.r.l TVox before v22.0.17 was discovered to contain a remote code execution (RCE) vulnerability in the component action_export_control.php.

Severity CVSS v4.0: Pending analysis

Last modification:

24/04/2025

CVE-2022-44212

Publication date:

01/12/2022

In GL.iNet Goodcloud 1.0, insecure design allows remote attacker to access devices&#39; admin panel.

Severity CVSS v4.0: Pending analysis

Last modification:

24/04/2025

CVE-2022-44211

Publication date:

01/12/2022

In GL.iNet Goodcloud 1.1 Incorrect access control allows a remote attacker to access/change devices&#39; settings.

Severity CVSS v4.0: Pending analysis

Last modification:

24/04/2025

CVE-2022-35120

Publication date:

01/12/2022

IXPdata EasyInstall 6.6.14725 contains an access control issue.

Severity CVSS v4.0: Pending analysis

Last modification:

24/04/2025

CVE-2022-23737

Publication date:

01/12/2022

An improper privilege management vulnerability was identified in GitHub Enterprise Server that allowed users with improper privileges to create or delete pages via the API. To exploit this vulnerability, an attacker would need to be added to an organization&#39;s repo with write permissions. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.7 and was fixed in versions 3.2.20, 3.3.15, 3.4.10, 3.5.7, and 3.6.3. This vulnerability was reported via the GitHub Bug Bounty program.

Severity CVSS v4.0: Pending analysis

Last modification:

24/04/2025

CVE-2022-41969

Publication date:

01/12/2022

Nextcloud Server is an open source personal cloud server. Prior to versions 23.0.11, 24.0.7, and 25.0.0, there is no password length limit when creating a user as an administrator. An administrator can cause a limited DoS attack against their own server. Versions 23.0.11, 24.0.7, and 25.0.0 contain a fix for the issue. As a workaround, don&#39;t create user accounts with long passwords.

Severity CVSS v4.0: Pending analysis

Last modification:

05/12/2022

CVE-2022-41971

Publication date:

01/12/2022

Nextcould Talk android is a video and audio conferencing app for Nextcloud. Prior to versions 12.2.8, 13.0.10, 14.0.6, and 15.0.0, guests can continue to receive video streams from a call after being removed from a conversation. An attacker would be able to see videos on a call in a public conversation after being removed from that conversation, provided that they were removed while being in the call. Versions 12.2.8, 13.0.10, 14.0.6, and 15.0.0 contain patches for the issue. No known workarounds are available.

Severity CVSS v4.0: Pending analysis

Last modification:

06/12/2022

CVE-2022-41970

Publication date:

01/12/2022

Nextcloud Server is an open source personal cloud server. Prior to versions 24.0.7 and 25.0.1, disabled download shares still allow download through preview images. Images could be downloaded and previews of documents (first page) can be downloaded without being watermarked. Versions 24.0.7 and 25.0.1 contain a fix for this issue. No known workarounds are available.

Severity CVSS v4.0: Pending analysis

Last modification:

06/12/2022

CVE-2022-42718

Publication date:

01/12/2022

Incorrect default permissions in the installation folder for NI LabVIEW Command Line Interface (CLI) may allow an authenticated user to potentially enable escalation of privilege via local access.

Severity CVSS v4.0: Pending analysis

Last modification:

24/04/2025

CVE-2022-41968

Publication date:

01/12/2022

Nextcloud Server is an open source personal cloud server. Prior to versions 23.0.10 and 24.0.5, calendar name lengths are not validated before writing to a database. As a result, an attacker can send unnecessary amounts of data against the database. Version 23.0.10 and 24.0.5 contain patches for the issue. No known workarounds are available.

Severity CVSS v4.0: Pending analysis

Last modification:

06/07/2023

Subscribe to Vulnerabilities