Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2022-38538

Publication date:

13/09/2022

Archery v1.7.0 to v1.8.5 was discovered to contain a SQL injection vulnerability via the checksum parameter in the report module.

Severity CVSS v4.0: Pending analysis

Last modification:

21/11/2022

CVE-2022-38540

Publication date:

13/09/2022

Archery v1.4.0 to v1.8.5 was discovered to contain a SQL injection vulnerability via the ThreadIDs parameter in the create_kill_session interface.

Severity CVSS v4.0: Pending analysis

Last modification:

17/10/2022

CVE-2022-3190

Publication date:

13/09/2022

Infinite loop in the F5 Ethernet Trailer protocol dissector in Wireshark 3.6.0 to 3.6.7 and 3.4.0 to 3.4.15 allows denial of service via packet injection or crafted capture file

Severity CVSS v4.0: Pending analysis

Last modification:

03/11/2025

CVE-2022-36779

Publication date:

13/09/2022

PROSCEND - PROSCEND / ADVICE .Ltd - G/5G Industrial Cellular Router (with GPS)4 Unauthenticated OS Command Injection Proscend M330-w / M33-W5 / M350-5G / M350-W5G / M350-6 / M350-W6 / M301-G / M301-GW ADVICE ICR 111WG / https://www.proscend.com/en/category/industrial-Cellular-Router/industrial-Cellular-Router.html https://cdn.shopify.com/s/files/1/0036/9413/3297/files/ADVICE_Industrial_4G_LTE_Cellular_Router_ICR111WG.pdf?v=1620814301

Severity CVSS v4.0: Pending analysis

Last modification:

16/09/2022

CVE-2022-38453

Publication date:

13/09/2022

Multiple binary application files on the CMS8000 device are compiled with &#39;not stripped&#39; and &#39;debug_info&#39; compilation settings. These compiler settings greatly decrease the level of effort for a threat actor to reverse engineer sensitive code and identify additional vulnerabilities.

Severity CVSS v4.0: Pending analysis

Last modification:

14/09/2022

CVE-2022-38069

Publication date:

13/09/2022

Multiple globally default credentials exist across all CMS8000 devices, that once exposed, allow a threat actor with momentary physical access to gain privileged access to any device. Privileged credential access enables the extraction of sensitive patient information or modification of device parameters

Severity CVSS v4.0: Pending analysis

Last modification:

14/09/2022

CVE-2022-36782

Publication date:

13/09/2022

Pal Electronics Systems - Pal Gate Authorization Errors. The vulnerability is an authorization problem in PalGate device management android client app. Gates of bulidings and parking lots with a simple button in any smartphone. The API was found after a decompiling and static research using Jadx, and a dynamic analasys using Frida. The attacker can iterate over all the IOT devices to see every entry and exit, on every gate and device all over the world, he can also scrape the server and create a user&#39;s DB with full names and phone number of over 2.8 million users, and to see all of the users&#39; movement in and out of gates, even in real time.

Severity CVSS v4.0: Pending analysis

Last modification:

15/09/2022

CVE-2022-36778

Publication date:

13/09/2022

insert HTML / js code inside input how to get to the vulnerable input : Workers &gt; worker nickname &gt; inject in this input the code.

Severity CVSS v4.0: Pending analysis

Last modification:

15/09/2022

CVE-2022-1602

Publication date:

13/09/2022

A potential security vulnerability has been identified in HP ThinPro 7.2 Service Pack 8 (SP8). The security vulnerability in SP8 is not remedied after upgrading from SP8 to Service Pack 9 (SP9). HP has released Service Pack 10 (SP10) to remediate the potential vulnerability introduced in SP8.

Severity CVSS v4.0: Pending analysis

Last modification:

15/09/2022

CVE-2022-36385

Publication date:

13/09/2022

A threat actor with momentary access to the device can plug in a USB drive and perform a malicious firmware update, resulting in permanent changes to device functionality. No authentication or controls are in place to prevent a threat actor from maliciously modifying firmware and performing a drive-by attack to load the firmware on any CMS8000 device.

Severity CVSS v4.0: Pending analysis

Last modification:

15/09/2022

CVE-2022-38537

Publication date:

13/09/2022

Archery v1.4.5 to v1.8.5 was discovered to contain multiple SQL injection vulnerabilities via the start_file, end_file, start_time, and stop_time parameters in the binlog2sql interface.

Severity CVSS v4.0: Pending analysis

Last modification:

08/11/2022

CVE-2022-36780

Publication date:

13/09/2022

Avdor CIS - crystal quality Credentials Management Errors. The product is phone call recorder, you can hear all the recorded calls without authenticate to the system. Attacker sends crafted URL to the system: ip:port//V=2;ChannellD=number;Ext=number;Command=startLM;Client=number;Request=number;R=number number - id of the recorded number.

Severity CVSS v4.0: Pending analysis

Last modification:

08/08/2023

Subscribe to Vulnerabilities