Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

Go to Calendar     Go to Press Room     Go to Newsletters subscription

Search

Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2021-34079
Publication date:
02/06/2022
OS Command injection vulnerability in Mintzo Docker-Tester through 1.2.1 allows attackers to execute arbitrary commands via shell metacharacters in the 'ports' entry of a crafted docker-compose.yml file.
Severity CVSS v4.0: Pending analysis
Last modification:
09/06/2022

CVE-2021-34083
Publication date:
02/06/2022
Google-it is a Node.js package which allows its users to send search queries to Google and receive the results in a JSON format. When using the 'Open in browser' option in versions up to 1.6.2, google-it will unsafely concat the result's link retrieved from google to a shell command, potentially exposing the server to RCE.
Severity CVSS v4.0: Pending analysis
Last modification:
09/06/2022

CVE-2021-26634
Publication date:
02/06/2022
SQL injection and file upload attacks are possible due to insufficient validation of input values in some parameters and variables of files compromising Maxboard, which may lead to arbitrary code execution or privilege escalation. Attackers can use these vulnerabilities to perform attacks such as stealing server management rights using a web shell.
Severity CVSS v4.0: Pending analysis
Last modification:
26/06/2023

CVE-2021-26635
Publication date:
02/06/2022
In the code that verifies the file size in the ark library, it is possible to manipulate the offset read from the target file due to the wrong use of the data type. An attacker could use this vulnerability to cause a stack buffer overflow and as a result, perform an attack such as remote code execution.
Severity CVSS v4.0: Pending analysis
Last modification:
26/06/2023

CVE-2021-33504
Publication date:
02/06/2022
Couchbase Server before 7.1.0 has Incorrect Access Control.
Severity CVSS v4.0: Pending analysis
Last modification:
08/08/2023

CVE-2020-20971
Publication date:
02/06/2022
Cross Site Request Forgery (CSRF) vulnerability in PbootCMS v2.0.3 via /admin.php?p=/User/index.
Severity CVSS v4.0: Pending analysis
Last modification:
10/06/2022

CVE-2019-12349
Publication date:
02/06/2022
An issue was discovered in zzcms 2019. SQL Injection exists in /admin/dl_sendsms.php via the id parameter.
Severity CVSS v4.0: Pending analysis
Last modification:
09/06/2022

CVE-2019-12350
Publication date:
02/06/2022
An issue was discovered in zzcms 2019. SQL Injection exists in dl/dl_download.php via an id parameter value with a trailing comma.
Severity CVSS v4.0: Pending analysis
Last modification:
09/06/2022

CVE-2019-12351
Publication date:
02/06/2022
An issue was discovered in zzcms 2019. SQL Injection exists in dl/dl_print.php via an id parameter value with a trailing comma.
Severity CVSS v4.0: Pending analysis
Last modification:
09/06/2022

CVE-2020-28246
Publication date:
02/06/2022
A Server-Side Template Injection (SSTI) was discovered in Form.io 2.0.0. This leads to Remote Code Execution during deletion of the default Email template URL. NOTE: the email templating service was removed after 2020. Additionally, the vendor disputes this issue indicating this is sandboxed and only executable by admins.
Severity CVSS v4.0: Pending analysis
Last modification:
04/08/2024

CVE-2022-29233
Publication date:
02/06/2022
BigBlueButton is an open source web conferencing system. In BigBlueButton starting with 2.2 but before 2.3.18 and 2.4-rc-1, an attacker can circumvent access controls to gain access to all breakout rooms of the meeting they are in. The permission checks rely on knowledge of internal ids rather than on verification of the role of the user. Versions 2.3.18 and 2.4-rc-1 contain a patch for this issue. There are currently no known workarounds.
Severity CVSS v4.0: Pending analysis
Last modification:
09/06/2022

CVE-2022-29234
Publication date:
02/06/2022
BigBlueButton is an open source web conferencing system. Starting in version 2.2 and prior to versions 2.3.18 and 2.4.1, an attacker could send messages to a locked chat within a grace period of 5s any lock setting in the meeting was changed. The attacker needs to be a participant in the meeting. Versions 2.3.18 and 2.4.1 contain a patch for this issue. There are currently no known workarounds.
Severity CVSS v4.0: Pending analysis
Last modification:
08/03/2024
Subscribe to Vulnerabilities