Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2022-34577

Publication date:
25/07/2022
A vulnerability in adm.cgi of WAVLINK WN535 G3 M35G3R.V5030.180927 allows attackers to execute arbitrary code via a crafted POST request.
Severity CVSS v4.0: Pending analysis
Last modification:
03/08/2022

CVE-2022-34576

Publication date:
25/07/2022
A vulnerability in /cgi-bin/ExportAllSettings.sh of WAVLINK WN535 G3 M35G3R.V5030.180927 allows attackers to execute arbitrary code via a crafted POST request.
Severity CVSS v4.0: Pending analysis
Last modification:
03/08/2022

CVE-2022-34575

Publication date:
25/07/2022
An access control issue in Wavlink WiFi-Repeater RPTA2-77W.M4300.01.GD.2017Sep19 allows attackers to obtain the key information of the device via accessing fctest.shtml.
Severity CVSS v4.0: Pending analysis
Last modification:
03/08/2022

CVE-2022-34570

Publication date:
25/07/2022
WAVLINK WN579 X3 M79X3.V5030.191012/M79X3.V5030.191012 contains an information leak which allows attackers to obtain the key information via accessing the messages.txt page.
Severity CVSS v4.0: Pending analysis
Last modification:
08/08/2023

CVE-2022-34571

Publication date:
25/07/2022
An access control issue in Wavlink WiFi-Repeater RPTA2-77W.M4300.01.GD.2017Sep19 allows attackers to obtain the system key information and execute arbitrary commands via accessing the page syslog.shtml.
Severity CVSS v4.0: Pending analysis
Last modification:
08/08/2023

CVE-2022-34572

Publication date:
25/07/2022
An access control issue in Wavlink WiFi-Repeater RPTA2-77W.M4300.01.GD.2017Sep19 allows attackers to obtain the telnet password via accessing the page tftp.txt.
Severity CVSS v4.0: Pending analysis
Last modification:
08/08/2023

CVE-2022-34573

Publication date:
25/07/2022
An access control issue in Wavlink WiFi-Repeater RPTA2-77W.M4300.01.GD.2017Sep19 allows attackers to arbitrarily configure device settings via accessing the page mb_wifibasic.shtml.
Severity CVSS v4.0: Pending analysis
Last modification:
08/08/2023

CVE-2022-34574

Publication date:
25/07/2022
An access control issue in Wavlink WiFi-Repeater RPTA2-77W.M4300.01.GD.2017Sep19 allows attackers to obtain the key information of the device via accessing Tftpd32.ini.
Severity CVSS v4.0: Pending analysis
Last modification:
08/08/2023

CVE-2022-34906

Publication date:
25/07/2022
A hard-coded cryptographic key is used in FileWave before 14.6.3 and 14.7.x before 14.7.2. Exploitation could allow an unauthenticated actor to decrypt sensitive information saved in FileWave, and even send crafted requests.
Severity CVSS v4.0: Pending analysis
Last modification:
02/08/2022

CVE-2022-34907

Publication date:
25/07/2022
An authentication bypass vulnerability exists in FileWave before 14.6.3 and 14.7.x before 14.7.2. Exploitation could allow an unauthenticated actor to gain access to the system with the highest authority possible and gain full control over the FileWave platform.
Severity CVSS v4.0: Pending analysis
Last modification:
08/08/2023

CVE-2022-35131

Publication date:
25/07/2022
Joplin v2.8.8 allows attackers to execute arbitrary commands via a crafted payload injected into the Node titles.
Severity CVSS v4.0: Pending analysis
Last modification:
01/08/2022

CVE-2022-36375

Publication date:
25/07/2022
Authenticated (high role user) WordPress Options Change vulnerability in Biplob Adhikari's Tabs plugin
Severity CVSS v4.0: Pending analysis
Last modification:
27/06/2023