Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2022-42299

Publication date:

03/10/2022

An issue was discovered in Veritas NetBackup through 10.0.0.1 and related Veritas products. The NetBackup Primary server is vulnerable to a denial of service attack through the DiscoveryService service.

Severity CVSS v4.0: Pending analysis

Last modification:

04/10/2022

CVE-2022-42300

Publication date:

03/10/2022

An issue was discovered in Veritas NetBackup through 10.0.0.1 and related Veritas products. The NetBackup Primary server nbars process can be crashed resulting in a denial of service. (Note: the watchdog service will automatically restart the process.)

Severity CVSS v4.0: Pending analysis

Last modification:

04/10/2022

CVE-2022-42301

Publication date:

03/10/2022

An issue was discovered in Veritas NetBackup through 10.0.0.1 and related Veritas products. The NetBackup Primary server is vulnerable to an XML External Entity (XXE) injection attack through the nbars process.

Severity CVSS v4.0: Pending analysis

Last modification:

04/10/2022

CVE-2022-41301

Publication date:

03/10/2022

A maliciously crafted PKT file when consumed through SubassemblyComposer.exe application could lead to memory corruption vulnerability by read access violation. This vulnerability in conjunction with other vulnerabilities could lead to code execution in the context of the current process.

Severity CVSS v4.0: Pending analysis

Last modification:

09/12/2022

CVE-2022-40721

Publication date:

03/10/2022

Arbitrary file upload vulnerability in php uploader

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2022-40764

Publication date:

03/10/2022

Snyk CLI before 1.996.0 allows arbitrary command execution, affecting Snyk IDE plugins and the snyk npm package. Exploitation could follow from the common practice of viewing untrusted files in the Visual Studio Code editor, for example. The original demonstration was with shell metacharacters in the vendor.json ignore field, affecting snyk-go-plugin before 1.19.1. This affects, for example, the Snyk TeamCity plugin (which does not update automatically) before 20220930.142957.

Severity CVSS v4.0: Pending analysis

Last modification:

08/08/2023

CVE-2022-33887

Publication date:

03/10/2022

A maliciously crafted PDF file when parsed through Autodesk AutoCAD 2023 causes an unhandled exception. An attacker can leverage this vulnerability to cause a crash or read sensitive data or execute arbitrary code in the context of the current process.

Severity CVSS v4.0: Pending analysis

Last modification:

05/10/2022

CVE-2022-33888

Publication date:

03/10/2022

A malicious crafted Dwg2Spd file when processed through Autodesk DWG application could lead to memory corruption vulnerability by write access violation. This vulnerability in conjunction with other vulnerabilities could lead to code execution in the context of the current process.

Severity CVSS v4.0: Pending analysis

Last modification:

20/05/2025

CVE-2022-33889

Publication date:

03/10/2022

A maliciously crafted GIF or JPEG files when parsed through Autodesk Design Review 2018, and AutoCAD 2023 and 2022 could be used to write beyond the allocated heap buffer. This vulnerability could lead to arbitrary code execution.

Severity CVSS v4.0: Pending analysis

Last modification:

05/10/2022

CVE-2022-33890

Publication date:

03/10/2022

A maliciously crafted PCT or DWF file when consumed through DesignReview.exe application could lead to memory corruption vulnerability by read access violation. This vulnerability in conjunction with other vulnerabilities could lead to code execution in the context of the current process.

Severity CVSS v4.0: Pending analysis

Last modification:

03/12/2022

CVE-2022-33886

Publication date:

03/10/2022

A maliciously crafted MODEL and SLDPRT file can be used to write beyond the allocated buffer while parsing through Autodesk AutoCAD 2023, 2022, 2021, 2020, and Maya 2023 and 2022. The vulnerability exists because the application fails to handle crafted MODEL and SLDPRT files, which causes an unhandled exception. A malicious actor could leverage this vulnerability to execute arbitrary code.

Severity CVSS v4.0: Pending analysis

Last modification:

17/04/2023

CVE-2022-33885

Publication date:

03/10/2022

A maliciously crafted X_B, CATIA, and PDF file when parsed through Autodesk AutoCAD 2023 and 2022 can be used to write beyond the allocated buffer. This vulnerability can lead to arbitrary code execution.

Severity CVSS v4.0: Pending analysis

Last modification:

05/10/2022

Subscribe to Vulnerabilities