Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2022-2273

Publication date:

01/08/2022

The Simple Membership WordPress plugin before 4.1.3 does not properly validate the membership_level parameter when editing a profile, allowing members to escalate to a higher membership level by using a crafted POST request.

Severity CVSS v4.0: Pending analysis

Last modification:

05/08/2022

CVE-2022-2184

Publication date:

01/08/2022

The CAPTCHA 4WP WordPress plugin before 7.1.0 lets user input reach a sensitive require_once call in one of its admin-side templates. This can be abused by attackers, via a Cross-Site Request Forgery attack to run arbitrary code on the server.

Severity CVSS v4.0: Pending analysis

Last modification:

05/08/2022

CVE-2022-2245

Publication date:

01/08/2022

The Counter Box WordPress plugin before 1.2.1 is lacking CSRF check when activating and deactivating counters, which could allow attackers to make a logged in admin perform such actions via CSRF attacks

Severity CVSS v4.0: Pending analysis

Last modification:

06/08/2022

CVE-2022-1600

Publication date:

01/08/2022

The YOP Poll WordPress plugin before 6.4.3 prioritizes getting a visitor&#39;s IP from certain HTTP headers over PHP&#39;s REMOTE_ADDR, which makes it possible to bypass IP-based limitations to vote in certain situations.

Severity CVSS v4.0: Pending analysis

Last modification:

04/08/2022

CVE-2022-1324

Publication date:

01/08/2022

The Event Timeline WordPress plugin through 1.1.5 does not sanitize and escape Timeline Text, which could allow high-privileged users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed

Severity CVSS v4.0: Pending analysis

Last modification:

04/08/2022

CVE-2022-1585

Publication date:

01/08/2022

The Project Source Code Download WordPress plugin through 1.0.0 does not protect its backup generation and download functionalities, which may allow any visitors on the site to download the entire site, including sensitive files like wp-config.php.

Severity CVSS v4.0: Pending analysis

Last modification:

04/08/2022

CVE-2022-1561

Publication date:

01/08/2022

Lura and KrakenD-CE versions older than v2.0.2 and KrakenD-EE versions older than v2.0.0 do not sanitize URL parameters correctly, allowing a malicious user to alter the backend URL defined for a pipe when remote users send crafty URL requests. The vulnerability does not affect KrakenD itself, but the consumed backend might be vulnerable.

Severity CVSS v4.0: Pending analysis

Last modification:

08/08/2022

CVE-2022-0598

Publication date:

01/08/2022

The Login with phone number WordPress plugin before 1.3.8 does not sanitise and escape plugin settings which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.

Severity CVSS v4.0: Pending analysis

Last modification:

06/10/2023

CVE-2022-1906

Publication date:

01/08/2022

The Copyright Proof WordPress plugin through 4.16 does not sanitise and escape a parameter before outputting it back via an AJAX action available to both unauthenticated and authenticated users, leading to a Reflected Cross-Site Scripting when a specific setting is enabled.

Severity CVSS v4.0: Pending analysis

Last modification:

04/08/2022

CVE-2022-27255

Publication date:

01/08/2022

In Realtek eCos RSDK 1.5.7p1 and MSDK 4.9.4p1, the SIP ALG function that rewrites SDP data has a stack-based buffer overflow. This allows an attacker to remotely execute code without authentication via a crafted SIP packet that contains malicious SDP data.

Severity CVSS v4.0: Pending analysis

Last modification:

30/09/2022

CVE-2022-34338

Publication date:

01/08/2022

IBM Robotic Process Automation 21.0.0, 21.0.1, and 21.0.2 could disclose sensitive information due to improper privilege management for storage provider types. IBM X-Force ID: 229962.

Severity CVSS v4.0: Pending analysis

Last modification:

05/08/2022

CVE-2022-36799

Publication date:

01/08/2022

This issue exists to document that a security improvement in the way that Jira Server and Data Center use templates has been implemented. Affected versions of Atlassian Jira Server and Data Center allowed remote attackers with system administrator permissions to execute arbitrary code via Template Injection leading to Remote Code Execution (RCE) in the Email Templates feature. In this case the security improvement was to protect against using the XStream library to be able to execute arbitrary code in velocity templates. The affected versions are before version 8.13.19, from version 8.14.0 before 8.20.7, and from version 8.21.0 before 8.22.1.

Severity CVSS v4.0: Pending analysis

Last modification:

03/10/2024

Subscribe to Vulnerabilities