Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2022-3710

Publication date:

01/12/2022

A post-auth read-only SQL injection vulnerability allows API clients to read non-sensitive configuration database contents in the API controller of Sophos Firewall releases older than version 19.5 GA.

Severity CVSS v4.0: Pending analysis

Last modification:

23/04/2025

CVE-2022-3711

Publication date:

01/12/2022

A post-auth read-only SQL injection vulnerability allows users to read non-sensitive configuration database contents in the User Portal of Sophos Firewall releases older than version 19.5 GA.

Severity CVSS v4.0: Pending analysis

Last modification:

23/04/2025

CVE-2022-3709

Publication date:

01/12/2022

A stored XSS vulnerability allows admin to super-admin privilege escalation in the Webadmin import group wizard of Sophos Firewall releases older than version 19.5 GA.

Severity CVSS v4.0: Pending analysis

Last modification:

24/04/2025

CVE-2022-3226

Publication date:

01/12/2022

An OS command injection vulnerability allows admins to execute code via SSL VPN configuration uploads in Sophos Firewall releases older than version 19.5 GA.

Severity CVSS v4.0: Pending analysis

Last modification:

24/04/2025

CVE-2022-3696

Publication date:

01/12/2022

A post-auth code injection vulnerability allows admins to execute code in Webadmin of Sophos Firewall releases older than version 19.5 GA.

Severity CVSS v4.0: Pending analysis

Last modification:

24/04/2025

CVE-2022-3713

Publication date:

01/12/2022

A code injection vulnerability allows adjacent attackers to execute code in the Wifi controller of Sophos Firewall releases older than version 19.5 GA.

Severity CVSS v4.0: Pending analysis

Last modification:

24/04/2025

CVE-2022-2969

Publication date:

01/12/2022

Delta Industrial Automation DIALink versions prior to v1.5.0.0 Beta 4 uses an external input to construct a pathname intended to identify a file or directory located underneath a restricted parent directory. However, the software does not properly neutralize special elements within the pathname, which can cause the pathname to resolve to a location outside of the restricted directory.

Severity CVSS v4.0: Pending analysis

Last modification:

07/12/2022

CVE-2022-41297

Publication date:

01/12/2022

IBM Db2U 3.5, 4.0, and 4.5 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 237212.

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2022-29837

Publication date:

01/12/2022

A path traversal vulnerability was addressed in Western Digital My Cloud Home, My Cloud Home Duo and SanDisk ibi which could allow an attacker to initiate installation of custom ZIP packages and overwrite system files. This could potentially lead to a code execution.

Severity CVSS v4.0: Pending analysis

Last modification:

06/12/2022

CVE-2022-4257

Publication date:

01/12/2022

A vulnerability was found in C-DATA Web Management System. It has been rated as critical. This issue affects some unknown processing of the file cgi-bin/jumpto.php of the component GET Parameter Handler. The manipulation of the argument hostname leads to argument injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-214631.

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2022-37016

Publication date:

01/12/2022

Symantec Endpoint Protection (Windows) agent may be susceptible to a Privilege Escalation vulnerability, which is a type of issue whereby an attacker may attempt to compromise the software application to gain elevated access to resources that are normally protected from an application or user.

Severity CVSS v4.0: Pending analysis

Last modification:

24/04/2025

CVE-2022-37017

Publication date:

01/12/2022

Symantec Endpoint Protection (Windows) agent, prior to 14.3 RU6/14.3 RU5 Patch 1, may be susceptible to a Security Control Bypass vulnerability, which is a type of issue that can potentially allow a threat actor to circumvent existing security controls. This CVE applies narrowly to the Client User Interface Password protection and Policy Import/Export Password protection, if it has been enabled.

Severity CVSS v4.0: Pending analysis

Last modification:

24/04/2025

Subscribe to Vulnerabilities