Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2022-2171

Publication date:

01/08/2022

The Progressive License WordPress plugin through 1.1.0 is lacking any CSRF check when saving its settings, which could allow attackers to make a logged in admin change them. Furthermore, as the plugin allows arbitrary HTML to be inserted in one of the settings, this could lead to Stored XSS issue which will be triggered in the frontend as well.

Severity CVSS v4.0: Pending analysis

Last modification:

05/08/2022

CVE-2022-26308

Publication date:

01/08/2022

Pandora FMS v7.0NG.760 and below allows an improper access control in Configuration (Credential store) where a user with the role of Operator (Write) could create, delete, view existing keys which are outside the intended role.

Severity CVSS v4.0: Pending analysis

Last modification:

05/08/2022

CVE-2022-2181

Publication date:

01/08/2022

The Advanced WordPress Reset WordPress plugin before 1.6 does not escape some generated URLs before outputting them back in href attributes of admin dashboard pages, leading to Reflected Cross-Site Scripting

Severity CVSS v4.0: Pending analysis

Last modification:

05/08/2022

CVE-2022-2215

Publication date:

01/08/2022

The GiveWP WordPress plugin before 2.21.3 does not properly sanitise and escape the currency settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed (for example in multisite setup)

Severity CVSS v4.0: Pending analysis

Last modification:

05/08/2022

CVE-2022-2260

Publication date:

01/08/2022

The GiveWP WordPress plugin before 2.21.3 does not have CSRF in place when exporting data, and does not validate the exporting parameters such as dates, which could allow attackers to make a logged in admin DoS the web server via a CSRF attack as the plugin will try to retrieve data from the database many times which leads to overwhelm the target&#39;s CPU.

Severity CVSS v4.0: Pending analysis

Last modification:

05/08/2022

CVE-2022-2273

Publication date:

01/08/2022

The Simple Membership WordPress plugin before 4.1.3 does not properly validate the membership_level parameter when editing a profile, allowing members to escalate to a higher membership level by using a crafted POST request.

Severity CVSS v4.0: Pending analysis

Last modification:

05/08/2022

CVE-2022-2184

Publication date:

01/08/2022

The CAPTCHA 4WP WordPress plugin before 7.1.0 lets user input reach a sensitive require_once call in one of its admin-side templates. This can be abused by attackers, via a Cross-Site Request Forgery attack to run arbitrary code on the server.

Severity CVSS v4.0: Pending analysis

Last modification:

05/08/2022

CVE-2022-2245

Publication date:

01/08/2022

The Counter Box WordPress plugin before 1.2.1 is lacking CSRF check when activating and deactivating counters, which could allow attackers to make a logged in admin perform such actions via CSRF attacks

Severity CVSS v4.0: Pending analysis

Last modification:

06/08/2022

CVE-2022-1600

Publication date:

01/08/2022

The YOP Poll WordPress plugin before 6.4.3 prioritizes getting a visitor&#39;s IP from certain HTTP headers over PHP&#39;s REMOTE_ADDR, which makes it possible to bypass IP-based limitations to vote in certain situations.

Severity CVSS v4.0: Pending analysis

Last modification:

04/08/2022

CVE-2022-1324

Publication date:

01/08/2022

The Event Timeline WordPress plugin through 1.1.5 does not sanitize and escape Timeline Text, which could allow high-privileged users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed

Severity CVSS v4.0: Pending analysis

Last modification:

04/08/2022

CVE-2022-1585

Publication date:

01/08/2022

The Project Source Code Download WordPress plugin through 1.0.0 does not protect its backup generation and download functionalities, which may allow any visitors on the site to download the entire site, including sensitive files like wp-config.php.

Severity CVSS v4.0: Pending analysis

Last modification:

04/08/2022

CVE-2022-1561

Publication date:

01/08/2022

Lura and KrakenD-CE versions older than v2.0.2 and KrakenD-EE versions older than v2.0.0 do not sanitize URL parameters correctly, allowing a malicious user to alter the backend URL defined for a pipe when remote users send crafty URL requests. The vulnerability does not affect KrakenD itself, but the consumed backend might be vulnerable.

Severity CVSS v4.0: Pending analysis

Last modification:

08/08/2022

Subscribe to Vulnerabilities