Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2022-23457

Publication date:

25/04/2022

ESAPI (The OWASP Enterprise Security API) is a free, open source, web application security control library. Prior to version 2.3.0.0, the default implementation of `Validator.getValidDirectoryPath(String, String, File, boolean)` may incorrectly treat the tested input string as a child of the specified parent directory. This potentially could allow control-flow bypass checks to be defeated if an attack can specify the entire string representing the &#39;input&#39; path. This vulnerability is patched in release 2.3.0.0 of ESAPI. As a workaround, it is possible to write one&#39;s own implementation of the Validator interface. However, maintainers do not recommend this.

Severity CVSS v4.0: Pending analysis

Last modification:

03/11/2025

CVE-2022-29418

Publication date:

25/04/2022

Authenticated (admin user role) Persistent Cross-Site Scripting (XSS) in Mark Daniels Night Mode plugin

Severity CVSS v4.0: Pending analysis

Last modification:

05/05/2022

CVE-2022-29419

Publication date:

25/04/2022

SQL Injection (SQLi) vulnerability in Don Crowther&#39;s 3xSocializer plugin

Severity CVSS v4.0: Pending analysis

Last modification:

05/05/2022

CVE-2022-29417

Publication date:

25/04/2022

Plugin Settings Update vulnerability in ShortPixel&#39;s ShortPixel Adaptive Images plugin

Severity CVSS v4.0: Pending analysis

Last modification:

20/07/2023

CVE-2022-0477

Publication date:

25/04/2022

An issue has been discovered in GitLab affecting all versions starting from 11.9 before 14.5.4, all versions starting from 14.6.0 before 14.6.4, all versions starting from 14.7.0 before 14.7.1. GitLab was not correctly handling bulk requests to delete existing packages from the package registries which could result in a Denial of Service under specific conditions.

Severity CVSS v4.0: Pending analysis

Last modification:

05/05/2022

CVE-2022-28290

Publication date:

25/04/2022

Reflective Cross-Site Scripting vulnerability in WordPress Country Selector Plugin Version 1.6.5. The XSS payload executes whenever the user tries to access the country selector page with the specified payload as a part of the HTTP request

Severity CVSS v4.0: Pending analysis

Last modification:

05/05/2022

CVE-2022-25866

Publication date:

25/04/2022

The package czproject/git-php before 4.0.3 are vulnerable to Command Injection via git argument injection. When calling the isRemoteUrlReadable($url, array $refs = NULL) function, both the url and refs parameters are passed to the git ls-remote subcommand in a way that additional flags can be set. The additional flags can be used to perform a command injection.

Severity CVSS v4.0: Pending analysis

Last modification:

08/08/2023

CVE-2022-1441

Publication date:

25/04/2022

MP4Box is a component of GPAC-2.0.0, which is a widely-used third-party package on RPM Fusion. When MP4Box tries to parse a MP4 file, it calls the function `diST_box_read()` to read from video. In this function, it allocates a buffer `str` with fixed length. However, content read from `bs` is controllable by user, so is the length, which causes a buffer overflow.

Severity CVSS v4.0: Pending analysis

Last modification:

27/06/2023

CVE-2022-26596

Publication date:

25/04/2022

Cross-site scripting (XSS) vulnerability in Journal module&#39;s web content display configuration page in Liferay Portal 7.1.0 through 7.3.3, and Liferay DXP 7.0 before fix pack 94, 7.1 before fix pack 19, and 7.2 before fix pack 8, allows remote attackers to inject arbitrary web script or HTML via web content template names.

Severity CVSS v4.0: Pending analysis

Last modification:

06/05/2022

CVE-2022-26597

Publication date:

25/04/2022

Cross-site scripting (XSS) vulnerability in the Layout module&#39;s Open Graph integration in Liferay Portal 7.3.0 through 7.4.0, and Liferay DXP 7.3 before service pack 3 allows remote attackers to inject arbitrary web script or HTML via the site name.

Severity CVSS v4.0: Pending analysis

Last modification:

06/05/2022