Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2022-35172

Publication date:

12/07/2022

SAP NetWeaver Enterprise Portal - versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not sufficiently encode user-controlled inputs, resulting in reflected Cross-Site Scripting (XSS) vulnerability.

Severity CVSS v4.0: Pending analysis

Last modification:

19/07/2022

CVE-2022-2211

Publication date:

12/07/2022

A vulnerability was found in libguestfs. This issue occurs while calculating the greatest possible number of matching keys in the get_keys() function. This flaw leads to a denial of service, either by mistake or malicious actor.

Severity CVSS v4.0: Pending analysis

Last modification:

12/02/2023

CVE-2022-31591

Publication date:

12/07/2022

SAP BusinessObjects BW Publisher Service - versions 420, 430, uses a search path that contains an unquoted element. A local attacker can gain elevated privileges by inserting an executable file in the path of the affected service

Severity CVSS v4.0: Pending analysis

Last modification:

16/07/2022

CVE-2022-31134

Publication date:

12/07/2022

Zulip is an open-source team collaboration tool. Zulip Server versions 2.1.0 above have a user interface tool, accessible only to server owners and server administrators, which provides a way to download a "public data" export. While this export is only accessible to administrators, in many configurations server administrators are not expected to have access to private messages and private streams. However, the "public data" export which administrators could generate contained the attachment contents for all attachments, even those from private messages and streams. Zulip Server version 5.4 contains a patch for this issue.

Severity CVSS v4.0: Pending analysis

Last modification:

22/07/2022

CVE-2022-31012

Publication date:

12/07/2022

Git for Windows is a fork of Git that contains Windows-specific patches. This vulnerability in versions prior to 2.37.1 lets Git for Windows&#39; installer execute a binary into `C:\mingw64\bin\git.exe` by mistake. This only happens upon a fresh install, not when upgrading Git for Windows. A patch is included in version 2.37.1. Two workarounds are available. Create the `C:\mingw64` folder and remove read/write access from this folder, or disallow arbitrary authenticated users to create folders in `C:\`.

Severity CVSS v4.0: Pending analysis

Last modification:

22/07/2022

CVE-2022-1737

Publication date:

12/07/2022

Pyramid Solutions&#39; affected products, the Developer and DLL kits for EtherNet/IP Adapter and EtherNet/IP Scanner, are vulnerable to an out-of-bounds write, which may allow an unauthorized attacker to send a specially crafted packet that may result in a denial-of-service condition.

Severity CVSS v4.0: Pending analysis

Last modification:

22/07/2022

CVE-2022-22998

Publication date:

12/07/2022

Implemented protections on AWS credentials that were not properly protected.

Severity CVSS v4.0: Pending analysis

Last modification:

20/07/2022

CVE-2022-22997

Publication date:

12/07/2022

Addressed a remote code execution vulnerability by resolving a command injection vulnerability and closing an AWS S3 bucket that potentially allowed an attacker to execute unsigned code on My Cloud Home devices.

Severity CVSS v4.0: Pending analysis

Last modification:

20/07/2022

CVE-2011-4916

Publication date:

12/07/2022

Linux kernel through 3.1 allows local users to obtain sensitive keystroke information via access to /dev/pts/ and /dev/tty*.

Severity CVSS v4.0: Pending analysis

Last modification:

21/11/2024

CVE-2022-1025

Publication date:

12/07/2022

All unpatched versions of Argo CD starting with v1.0.0 are vulnerable to an improper access control bug, allowing a malicious user to potentially escalate their privileges to admin-level.

Severity CVSS v4.0: Pending analysis

Last modification:

07/08/2024

CVE-2022-29619

Publication date:

12/07/2022

Under certain conditions SAP BusinessObjects Business Intelligence Platform 4.x - versions 420,430 allows user Administrator to view, edit or modify rights of objects it doesn&#39;t own and which would otherwise be restricted.

Severity CVSS v4.0: Pending analysis

Last modification:

21/07/2023

CVE-2022-28771

Publication date:

12/07/2022

Due to missing authentication check, SAP Business one License service API - version 10.0 allows an unauthenticated attacker to send malicious http requests over the network. On successful exploitation, an attacker can break the whole application making it inaccessible.<br /> <br />

Severity CVSS v4.0: Pending analysis

Last modification:

14/08/2023

Subscribe to Vulnerabilities