Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2021-29109

Publication date:

01/10/2021

A reflected XSS vulnerability in Esri Portal for ArcGIS version 10.9 and below may allow a remote attacker able to convince a user to click on a crafted link which could potentially execute arbitrary JavaScript code in the user’s browser.

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2021-3825

Publication date:

01/10/2021

On 2.1.15 version and below of Lider module in LiderAhenk software is leaking it&#39;s configurations via an unsecured API. An attacker with an access to the configurations API could get valid LDAP credentials.

Severity CVSS v4.0: Pending analysis

Last modification:

16/09/2024

CVE-2021-41647

Publication date:

01/10/2021

An un-authenticated error-based and time-based blind SQL injection vulnerability exists in Kaushik Jadhav Online Food Ordering Web App 1.0. An attacker can exploit the vulnerable "username" parameter in login.php and retrieve sensitive database information, as well as add an administrative user.

Severity CVSS v4.0: Pending analysis

Last modification:

08/10/2021

CVE-2021-29108

Publication date:

01/10/2021

There is an privilege escalation vulnerability in organization-specific logins in Esri Portal for ArcGIS versions 10.9 and below that may allow a remote, authenticated attacker who is able to intercept and modify a SAML assertion to impersonate another account (XML Signature Wrapping Attack). In addition patching, Esri also strongly recommends as best practice for SAML assertions to be signed and encrypted.

Severity CVSS v4.0: Pending analysis

Last modification:

14/09/2023

CVE-2021-40960

Publication date:

01/10/2021

Galera WebTemplate 1.0 is affected by a directory traversal vulnerability that could reveal information from /etc/passwd and /etc/shadow.

Severity CVSS v4.0: Pending analysis

Last modification:

07/10/2021

CVE-2021-41648

Publication date:

01/10/2021

An un-authenticated SQL Injection exists in PuneethReddyHC online-shopping-system-advanced through the /action.php prId parameter. Using a post request does not sanitize the user input.

Severity CVSS v4.0: Pending analysis

Last modification:

26/11/2021

CVE-2021-41649

Publication date:

01/10/2021

An un-authenticated SQL Injection exists in PuneethReddyHC online-shopping-system-advanced through the /homeaction.php cat_id parameter. Using a post request does not sanitize the user input.

Severity CVSS v4.0: Pending analysis

Last modification:

05/11/2021

CVE-2021-35297

Publication date:

01/10/2021

Scalabium dBase Viewer version 2.6 (Build 5.751) is vulnerable to remote code execution via a crafted DBF file that triggers a buffer overflow. An attacker can use the Structured Exception Handler (SEH) records and redirect execution to attacker-controlled code.

Severity CVSS v4.0: Pending analysis

Last modification:

08/10/2021

CVE-2021-41110

Publication date:

01/10/2021

cwlviewer is a web application to view and share Common Workflow Language workflows. Versions prior to 1.3.1 contain a Deserialization of Untrusted Data vulnerability. Commit number f6066f09edb70033a2ce80200e9fa9e70a5c29de (dated 2021-09-30) contains a patch. There are no available workarounds aside from installing the patch. The SnakeYaml constructor, by default, allows any data to be parsed. To fix the issue the object needs to be created with a `SafeConstructor` object, as seen in the patch.

Severity CVSS v4.0: Pending analysis

Last modification:

08/10/2021

CVE-2021-41456

Publication date:

01/10/2021

There is a stack buffer overflow in MP4Box v1.0.1 at src/filters/dmx_nhml.c:1004 in the nhmldmx_send_sample() function szXmlTo parameter which leads to a denial of service vulnerability.

Severity CVSS v4.0: Pending analysis

Last modification:

27/05/2023

CVE-2021-41457

Publication date:

01/10/2021

There is a stack buffer overflow in MP4Box 1.1.0 at src/filters/dmx_nhml.c in nhmldmx_init_parsing which leads to a denial of service vulnerability.

Severity CVSS v4.0: Pending analysis

Last modification:

27/05/2023

CVE-2021-41459

Publication date:

01/10/2021

There is a stack buffer overflow in MP4Box v1.0.1 at src/filters/dmx_nhml.c:1008 in the nhmldmx_send_sample() function szXmlFrom parameter which leads to a denial of service vulnerability.

Severity CVSS v4.0: Pending analysis

Last modification:

27/05/2023

Subscribe to Vulnerabilities