Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2021-29338

Publication date:

14/04/2021

Integer Overflow in OpenJPEG v2.4.0 allows remote attackers to crash the application, causing a Denial of Service (DoS). This occurs when the attacker uses the command line option "-ImgDir" on a directory that contains 1048576 files.

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2021-31152

Publication date:

14/04/2021

Multilaser Router AC1200 V02.03.01.45_pt contains a cross-site request forgery (CSRF) vulnerability. An attacker can enable remote access, change passwords, and perform other actions through misconfigured requests, entries, and headers.

Severity CVSS v4.0: Pending analysis

Last modification:

03/03/2024

CVE-2020-21087

Publication date:

14/04/2021

Cross Site Scripting (XSS) in X2Engine X2CRM v6.9 and older allows remote attackers to execute arbitrary code by injecting arbitrary web script or HTML via the "New Name" field of the "Rename a Module" tool.

Severity CVSS v4.0: Pending analysis

Last modification:

16/04/2021

CVE-2020-36120

Publication date:

14/04/2021

Buffer Overflow in the "sixel_encoder_encode_bytes" function of Libsixel v1.8.6 allows attackers to cause a Denial of Service (DoS).

Severity CVSS v4.0: Pending analysis

Last modification:

16/04/2021

CVE-2020-21088

Publication date:

14/04/2021

Cross Site Scripting (XSS) in X2engine X2CRM v7.1 and older allows remote attackers to obtain sensitive information by injecting arbitrary web script or HTML via the "First Name" and "Last Name" fields in "/index.php/contacts/create page"

Severity CVSS v4.0: Pending analysis

Last modification:

21/04/2021

CVE-2021-26827

Publication date:

14/04/2021

Buffer Overflow in TP-Link WR2041 v1 firmware for the TL-WR2041+ router allows remote attackers to cause a Denial-of-Service (DoS) by sending an HTTP request with a very long "ssid" parameter to the "/userRpm/popupSiteSurveyRpm.html" webpage, which crashes the router.

Severity CVSS v4.0: Pending analysis

Last modification:

21/04/2021

CVE-2021-26832

Publication date:

14/04/2021

Cross Site Scripting (XSS) in the "Reset Password" page form of Priority Enterprise Management System v8.00 allows attackers to execute javascript on behalf of the victim by sending a malicious URL or directing the victim to a malicious site.

Severity CVSS v4.0: Pending analysis

Last modification:

19/04/2021

CVE-2021-26805

Publication date:

14/04/2021

Buffer Overflow in tsMuxer 2.6.16 allows attackers to cause a Denial of Service (DoS) by running the application with a malicious WAV file.

Severity CVSS v4.0: Pending analysis

Last modification:

19/04/2021

CVE-2021-27288

Publication date:

14/04/2021

Cross Site Scripting (XSS) in X2Engine X2CRM v7.1 allows remote attackers to obtain sensitive information by injecting arbitrary web script or HTML via the "Comment" field in "/profile/activity" page.

Severity CVSS v4.0: Pending analysis

Last modification:

20/04/2021

CVE-2021-27114

Publication date:

14/04/2021

An issue was discovered in D-Link DIR-816 A2 1.10 B05 devices. Within the handler function of the /goform/addassignment route, a very long text entry for the"&#39;s_ip" and "s_mac" fields could lead to a Stack-Based Buffer Overflow and overwrite the return address.

Severity CVSS v4.0: Pending analysis

Last modification:

20/04/2021

CVE-2021-27113

Publication date:

14/04/2021

An issue was discovered in D-Link DIR-816 A2 1.10 B05 devices. An HTTP request parameter is used in command string construction within the handler function of the /goform/addRouting route. This could lead to Command Injection via Shell Metacharacters.

Severity CVSS v4.0: Pending analysis

Last modification:

20/04/2021

CVE-2021-27990

Publication date:

14/04/2021

Appspace 6.2.4 is vulnerable to a broken authentication mechanism where pages such as /medianet/mail.aspx can be called directly and the framework is exposed with layouts, menus and functionalities.

Severity CVSS v4.0: Pending analysis

Last modification:

21/04/2021

Subscribe to Vulnerabilities