Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2020-5008

Publication date:

07/06/2021

IBM DataPower Gateway 10.0.0.0 through 10.0.1.0 and 2018.4.1.0 through 2018.4.1.14 stores sensitive information in GET request parameters. This may lead to information disclosure if unauthorized parties have access to the URLs via server logs, referrer header or browser history. IBM X-Force ID: 193033.

Severity CVSS v4.0: Pending analysis

Last modification:

10/06/2021

CVE-2021-22222

Publication date:

07/06/2021

Infinite loop in DVB-S2-BB dissector in Wireshark 3.4.0 to 3.4.5 allows denial of service via packet injection or crafted capture file

Severity CVSS v4.0: Pending analysis

Last modification:

01/04/2022

CVE-2021-33904

Publication date:

07/06/2021

In Accela Civic Platform through 21.1, the security/hostSignon.do parameter servProvCode is vulnerable to XSS. NOTE: The vendor states "there are configurable security flags and we are unable to reproduce them with the available information.

Severity CVSS v4.0: Pending analysis

Last modification:

04/08/2024

CVE-2021-29099

Publication date:

07/06/2021

A SQL injection vulnerability exists in some configurations of ArcGIS Server versions 10.8.1 and earlier. Specially crafted web requests can expose information that is not intended to be disclosed (not customer datasets). Web Services that use file based data sources (file Geodatabase or Shape Files or tile cached services) are unaffected by this issue.

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2020-36385

Publication date:

07/06/2021

An issue was discovered in the Linux kernel before 5.10. drivers/infiniband/core/ucma.c has a use-after-free because the ctx is reached via the ctx_list in some ucma_migrate_id situations where ucma_close is called, aka CID-f5449e74802c.

Severity CVSS v4.0: Pending analysis

Last modification:

25/10/2022

CVE-2021-24343

Publication date:

07/06/2021

The iFlyChat WordPress plugin before 4.7.0 does not sanitise its APP ID setting before outputting it back in the page, leading to an authenticated Stored Cross-Site Scripting issue

Severity CVSS v4.0: Pending analysis

Last modification:

24/03/2022

CVE-2021-24337

Publication date:

07/06/2021

The id GET parameter of one of the Video Embed WordPress plugin through 1.0&#39;s page (available via forced browsing) is not sanitised, validated or escaped before being used in a SQL statement, allowing low privilege users, such as subscribers, to perform SQL injection.

Severity CVSS v4.0: Pending analysis

Last modification:

15/07/2021

CVE-2021-24342

Publication date:

07/06/2021

The JNews WordPress theme before 8.0.6 did not sanitise the cat_id parameter in the POST request /?ajax-request=jnews (with action=jnews_build_mega_category_*), leading to a Reflected Cross-Site Scripting (XSS) issue.

Severity CVSS v4.0: Pending analysis

Last modification:

10/06/2021

CVE-2021-24336

Publication date:

07/06/2021

The FlightLog WordPress plugin through 3.0.2 does not sanitise, validate or escape various POST parameters before using them a SQL statement, leading to SQL injections exploitable by editor and administrator users

Severity CVSS v4.0: Pending analysis

Last modification:

14/06/2021

CVE-2021-24344

Publication date:

07/06/2021

The Easy Preloader WordPress plugin through 1.0.0 does not sanitise its setting fields, leading to authenticated (admin+) Stored Cross-Site scripting issues

Severity CVSS v4.0: Pending analysis

Last modification:

14/06/2021

CVE-2021-24340

Publication date:

07/06/2021

The WP Statistics WordPress plugin before 13.0.8 relied on using the WordPress esc_sql() function on a field not delimited by quotes and did not first prepare the query. Additionally, the page, which should have been accessible to administrator only, was also available to any visitor, including unauthenticated ones.

Severity CVSS v4.0: Pending analysis

Last modification:

14/06/2021