Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

Go to Calendar     Go to Press Room     Go to Newsletters subscription

Search

Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2022-3716
Publication date:
27/10/2022
A vulnerability classified as problematic was found in SourceCodester Online Medicine Ordering System 1.0. Affected by this vulnerability is an unknown functionality of the file /omos/admin/?page=user/list. The manipulation of the argument First Name/Middle Name/Last Name leads to cross site scripting. The attack can be launched remotely. The associated identifier of this vulnerability is VDB-212347.
Severity CVSS v4.0: Pending analysis
Last modification:
28/12/2023

CVE-2021-45475
Publication date:
27/10/2022
Yordam Library Information Document Automation product before version 19.02 has an unauthenticated Information disclosure vulnerability.
Severity CVSS v4.0: Pending analysis
Last modification:
17/09/2024

CVE-2021-45476
Publication date:
27/10/2022
Yordam Library Information Document Automation product before version 19.02 has an unauthenticated reflected XSS vulnerability.
Severity CVSS v4.0: Pending analysis
Last modification:
17/09/2024

CVE-2022-3714
Publication date:
27/10/2022
A vulnerability classified as critical has been found in SourceCodester Online Medicine Ordering System 1.0. Affected is an unknown function of the file admin/?page=orders/view_order. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. VDB-212346 is the identifier assigned to this vulnerability.
Severity CVSS v4.0: Pending analysis
Last modification:
28/12/2023

CVE-2022-2508
Publication date:
27/10/2022
In affected versions of Octopus Server it is possible to reveal the existence of resources in a space that the user does not have access to due to verbose error messaging.
Severity CVSS v4.0: Pending analysis
Last modification:
07/05/2025

CVE-2022-2782
Publication date:
27/10/2022
In affected versions of Octopus Server it is possible for a session token to be valid indefinitely due to improper validation of the session token parameters.
Severity CVSS v4.0: Pending analysis
Last modification:
07/05/2025

CVE-2022-25918
Publication date:
27/10/2022
The package shescape from 1.5.10 and before 1.6.1 are vulnerable to Regular Expression Denial of Service (ReDoS) via the escape function in index.js, due to the usage of insecure regex in the escapeArgBash function.
Severity CVSS v4.0: Pending analysis
Last modification:
05/05/2025

CVE-2022-3363
Publication date:
26/10/2022
Business Logic Errors in GitHub repository ikus060/rdiffweb prior to 2.5.0a7.
Severity CVSS v4.0: Pending analysis
Last modification:
07/05/2025

CVE-2022-40703
Publication date:
26/10/2022
CWE-302 Authentication Bypass by Assumed-Immutable Data in AliveCor Kardia App version 5.17.1-754993421 and prior<br /> <br /> on Android allows an unauthenticated attacker with physical access to the Android device containing the app to bypass application authentication and alter information in the app.
Severity CVSS v4.0: Pending analysis
Last modification:
07/11/2023

CVE-2022-3704
Publication date:
26/10/2022
A vulnerability classified as problematic has been found in Ruby on Rails. This affects an unknown part of the file actionpack/lib/action_dispatch/middleware/templates/routes/_table.html.erb. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The real existence of this vulnerability is still doubted at the moment. The name of the patch is be177e4566747b73ff63fd5f529fab564e475ed4. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-212319. NOTE: Maintainer declares that there isn’t a valid attack vector. The issue was wrongly reported as a security vulnerability by a non-member of the Rails team.
Severity CVSS v4.0: Pending analysis
Last modification:
03/08/2024

CVE-2022-3705
Publication date:
26/10/2022
A vulnerability was found in vim and classified as problematic. Affected by this issue is the function qf_update_buffer of the file quickfix.c of the component autocmd Handler. The manipulation leads to use after free. The attack may be launched remotely. Upgrading to version 9.0.0805 is able to address this issue. The name of the patch is d0fab10ed2a86698937e3c3fed2f10bd9bb5e731. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-212324.
Severity CVSS v4.0: Pending analysis
Last modification:
07/11/2023

CVE-2022-39355
Publication date:
26/10/2022
Discourse Patreon enables syncronization between Discourse Groups and Patreon rewards. On sites with Patreon login enabled, an improper authentication vulnerability could be used to take control of a victim&amp;#39;s forum account. This vulnerability is patched in commit number 846d012151514b35ce42a1636c7d70f6dcee879e of the discourse-patreon plugin. Out of an abundance of caution, any Discourse accounts which have logged in with an unverified-email Patreon account will be logged out and asked to verify their email address on their next login. As a workaround, disable the patreon integration and log out all users with associated Patreon accounts.
Severity CVSS v4.0: Pending analysis
Last modification:
28/10/2022
Subscribe to Vulnerabilities