Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2020-28490

Publication date:

18/02/2021

The package async-git before 1.13.2 are vulnerable to Command Injection via shell meta-characters (back-ticks). For example: git.reset(&#39;atouch HACKEDb&#39;)

Severity CVSS v4.0: Pending analysis

Last modification:

21/07/2021

CVE-2019-18255

Publication date:

18/02/2021

HMI/SCADA iFIX (Versions 6.1 and prior) allows a local authenticated user to modify system-wide iFIX configurations through section objects. This may allow privilege escalation.

Severity CVSS v4.0: Pending analysis

Last modification:

24/02/2021

CVE-2020-35577

Publication date:

18/02/2021

In Endalia Selection Portal before 4.205.0, an Insecure Direct Object Reference (IDOR) allows any authenticated user to download every file uploaded to the platform by changing the value of the file identifier (aka CommonDownload identification number).

Severity CVSS v4.0: Pending analysis

Last modification:

26/02/2021

CVE-2020-29664

Publication date:

18/02/2021

A command injection issue in dji_sys in DJI Mavic 2 Remote Controller before firmware version 01.00.0510 allows for code execution via a malicious firmware upgrade packet.

Severity CVSS v4.0: Pending analysis

Last modification:

21/07/2021

CVE-2021-27124

Publication date:

18/02/2021

SQL injection in the expertise parameter in search_result.php in Doctor Appointment System v1.0 allows an authenticated patient user to dump the database credentials via a SQL injection attack.

Severity CVSS v4.0: Pending analysis

Last modification:

24/02/2021

CVE-2021-27377

Publication date:

18/02/2021

An issue was discovered in the yottadb crate before 1.2.0 for Rust. For some memory-allocation patterns, ydb_subscript_next_st and ydb_subscript_prev_st have a use-after-free.

Severity CVSS v4.0: Pending analysis

Last modification:

25/02/2021

CVE-2021-27376

Publication date:

18/02/2021

An issue was discovered in the nb-connect crate before 1.0.3 for Rust. It may have invalid memory access for certain versions of the standard library because it relies on a direct cast of std::net::SocketAddrV4 and std::net::SocketAddrV6 data structures.

Severity CVSS v4.0: Pending analysis

Last modification:

25/02/2021

CVE-2021-27378

Publication date:

18/02/2021

An issue was discovered in the rand_core crate before 0.6.2 for Rust. Because read_u32_into and read_u64_into mishandle certain buffer-length checks, a random number generator may be seeded with too little data.

Severity CVSS v4.0: Pending analysis

Last modification:

12/07/2022

CVE-2021-27375

Publication date:

18/02/2021

Traefik before 2.4.5 allows the loading of IFRAME elements from other domains.

Severity CVSS v4.0: Pending analysis

Last modification:

12/07/2022

CVE-2020-12878

Publication date:

18/02/2021

Digi ConnectPort X2e before 3.2.30.6 allows an attacker to escalate privileges from the python user to root via a symlink attack that uses chown, related to /etc/init.d/S50dropbear.sh and the /WEB/python/.ssh directory.

Severity CVSS v4.0: Pending analysis

Last modification:

26/02/2021

CVE-2020-9306

Publication date:

18/02/2021

Tesla SolarCity Solar Monitoring Gateway through 5.46.43 has a "Use of Hard-coded Credentials" issue because Digi ConnectPort X2e uses a .pyc file to store the cleartext password for the python user account.

Severity CVSS v4.0: Pending analysis

Last modification:

21/07/2021