Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2020-1926

Publication date:

16/03/2021

Apache Hive cookie signature verification used a non constant time comparison which is known to be vulnerable to timing attacks. This could allow recovery of another users cookie signature. The issue was addressed in Apache Hive 2.3.8

Severity CVSS v4.0: Pending analysis

Last modification:

05/08/2022

CVE-2021-27230

Publication date:

15/03/2021

ExpressionEngine before 5.4.2 and 6.x before 6.0.3 allows PHP Code Injection by certain authenticated users who can leverage Translate::save() to write to an _lang.php file under the system/user/language directory.

Severity CVSS v4.0: Pending analysis

Last modification:

12/07/2022

CVE-2020-27282

Publication date:

15/03/2021

In Hamilton Medical AG,T1-Ventillator versions 2.2.3 and prior, an XML validation vulnerability in the ventilator allows privileged attackers with physical access to render the device persistently unusable by uploading specially crafted configuration files.

Severity CVSS v4.0: Pending analysis

Last modification:

22/03/2021

CVE-2020-27290

Publication date:

15/03/2021

In Hamilton Medical AG,T1-Ventillator versions 2.2.3 and prior, an information disclosure vulnerability in the ventilator allows attackers with physical access to the configuration interface&#39;s logs to get valid checksums for tampered configuration files.

Severity CVSS v4.0: Pending analysis

Last modification:

22/03/2021

CVE-2021-3418

Publication date:

15/03/2021

If certificates that signed grub are installed into db, grub can be booted directly. It will then boot any kernel without signature validation. The booted kernel will think it was booted in secureboot mode and will implement lockdown, yet it could have been tampered. This flaw is a reintroduction of CVE-2020-15705 and only affects grub2 versions prior to 2.06 and upstream and distributions using the shim_lock mechanism.

Severity CVSS v4.0: Pending analysis

Last modification:

22/03/2021

CVE-2021-24029

Publication date:

15/03/2021

A packet of death scenario is possible in mvfst via a specially crafted message during a QUIC session, which causes a crash via a failed assertion. Per QUIC specification, this particular message should be treated as a connection error. This issue affects mvfst versions prior to commit a67083ff4b8dcbb7ee2839da6338032030d712b0 and proxygen versions prior to v2021.03.15.00.

Severity CVSS v4.0: Pending analysis

Last modification:

23/03/2021

CVE-2021-20279

Publication date:

15/03/2021

The ID number user profile field required additional sanitizing to prevent a stored XSS risk in moodle before 3.10.2, 3.9.5, 3.8.8, 3.5.17.

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2021-20282

Publication date:

15/03/2021

When creating a user account, it was possible to verify the account without having access to the verification email link/secret in moodle before 3.10.2, 3.9.5, 3.8.8, 3.5.17.

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2021-20283

Publication date:

15/03/2021

The web service responsible for fetching other users&#39; enrolled courses did not validate that the requesting user had permission to view that information in each course in moodle before 3.10.2, 3.9.5, 3.8.8, 3.5.17.

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2021-20281

Publication date:

15/03/2021

It was possible for some users without permission to view other users&#39; full names to do so via the online users block in moodle before 3.10.2, 3.9.5, 3.8.8, 3.5.17.

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2021-26987

Publication date:

15/03/2021

Element Plug-in for vCenter Server incorporates SpringBoot Framework. SpringBoot Framework versions prior to 1.3.2 are susceptible to a vulnerability which when successfully exploited could lead to Remote Code Execution. All versions of Element Plug-in for vCenter Server, Management Services versions prior to 2.17.56 and Management Node versions through 12.2 contain vulnerable versions of SpringBoot Framework.

Severity CVSS v4.0: Pending analysis

Last modification:

07/04/2022