Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2022-42924

Publication date:

31/10/2022

Forma LMS on its 3.1.0 version and earlier is vulnerable to a SQL injection vulnerability. The exploitation of this vulnerability could allow an authenticated attacker (with the role of student) to perform a SQL injection on the &#39;dyn_filter&#39; parameter in the &#39;appLms/ajax.adm_server.php?r=widget/userselector/getusertabledata&#39; function in order to dump the entire database.

Severity CVSS v4.0: Pending analysis

Last modification:

01/11/2022

CVE-2022-41679

Publication date:

31/10/2022

Forma LMS version 3.1.0 and earlier are affected by an Cross-Site scripting vulnerability, that could allow a remote attacker to inject javascript code on the “back_url” parameter in appLms/index.php?modname=faq&op=play function. The exploitation of this vulnerability could allow an attacker to steal the user´s cookies in order to log in to the application.

Severity CVSS v4.0: Pending analysis

Last modification:

01/11/2022

CVE-2022-41681

Publication date:

31/10/2022

There is a vulnerability on Forma LMS version 3.1.0 and earlier that could allow an authenticated attacker (with the role of student) to privilege escalate in order to upload a Zip file through the SCORM importer feature. The exploitation of this vulnerability could lead to a remote code injection.

Severity CVSS v4.0: Pending analysis

Last modification:

01/11/2022

CVE-2022-41680

Publication date:

31/10/2022

Forma LMS on its 3.1.0 version and earlier is vulnerable to a SQL injection vulnerability. The exploitation of this vulnerability could allow an authenticated attacker (with the role of student) to perform a SQL injection on the &#39;search[value] parameter in the appLms/ajax.server.php?r=mycertificate/getMyCertificates&#39; function in order to dump the entire database.

Severity CVSS v4.0: Pending analysis

Last modification:

01/11/2022

CVE-2022-42923

Publication date:

31/10/2022

Forma LMS on its 3.1.0 version and earlier is vulnerable to a SQL injection vulnerability. The exploitation of this vulnerability could allow an authenticated attacker (with the role of student) to perform a SQL injection on the &#39;id&#39; parameter in the &#39;appCore/index.php?r=adm/mediagallery/delete&#39; function in order to dump the entire database or delete all contents from the &#39;core_user_file&#39; table.

Severity CVSS v4.0: Pending analysis

Last modification:

01/11/2022

CVE-2022-41779

Publication date:

31/10/2022

Delta Electronics InfraSuite Device Master versions 00.00.01a and prior deserialize network packets without proper verification. If the device connects to an attacker-controlled server, the attacker could send maliciously crafted packets that would be deserialized and executed, leading to remote code execution.

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2022-41776

Publication date:

31/10/2022

Delta Electronics InfraSuite Device Master versions 00.00.01a and prior allow unauthenticated users to trigger the WriteConfiguration method, which could allow an attacker to provide new values for user configuration files such as UserListInfo.xml. This could lead to the changing of administrative passwords.

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2022-41772

Publication date:

31/10/2022

Delta Electronics InfraSuite Device Master Versions 00.00.01a and prior mishandle .ZIP archives containing characters used in path traversal. This path traversal could result in remote code execution.

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2022-41688

Publication date:

31/10/2022

Delta Electronics InfraSuite Device Master versions 00.00.01a and prior lack proper authentication for functions that create and modify user groups. An attacker could provide malicious serialized objects that could run these functions without authentication to create a new user and add them to the administrator group.

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2022-41657

Publication date:

31/10/2022

Delta Electronics InfraSuite Device Master Versions 00.00.01a and prior allow attacker provided data already serialized into memory to be used in file operation application programmable interfaces (APIs). This could create arbitrary files, which could be used in API operations and could ultimately result in remote code execution.

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2022-3499

Publication date:

31/10/2022

An authenticated attacker could utilize the identical agent and cluster node linking keys to potentially allow for a scenario where unauthorized disclosure of agent logs and data is present.

Severity CVSS v4.0: Pending analysis

Last modification:

05/05/2025

CVE-2022-28763

Publication date:

31/10/2022

The Zoom Client for Meetings (for Android, iOS, Linux, macOS, and Windows) before version 5.12.2 is susceptible to a URL parsing vulnerability. If a malicious Zoom meeting URL is opened, the malicious link may direct the user to connect to an arbitrary network address, leading to additional attacks including session takeovers.

Severity CVSS v4.0: Pending analysis

Last modification:

01/11/2022

Subscribe to Vulnerabilities