Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2021-44683

Publication date:

25/03/2022

The DuckDuckGo browser 7.64.4 on iOS allows Address Bar Spoofing due to mishandling of the JavaScript window.open function (used to open a secondary browser window). This could be exploited by tricking users into supplying sensitive information such as credentials, because the address bar would display a legitimate URL, but content would be hosted on the attacker&#39;s web site.

Severity CVSS v4.0: Pending analysis

Last modification:

31/03/2022

CVE-2022-24783

Publication date:

25/03/2022

Deno is a runtime for JavaScript and TypeScript. The versions of Deno between release 1.18.0 and 1.20.2 (inclusive) are vulnerable to an attack where a malicious actor controlling the code executed in a Deno runtime could bypass all permission checks and execute arbitrary shell code. This vulnerability does not affect users of Deno Deploy. The vulnerability has been patched in Deno 1.20.3. There is no workaround. All users are recommended to upgrade to 1.20.3 immediately.

Severity CVSS v4.0: Pending analysis

Last modification:

30/06/2023

CVE-2022-24784

Publication date:

25/03/2022

Statamic is a Laravel and Git powered CMS. Before versions 3.2.39 and 3.3.2, it is possible to confirm a single character of a user&#39;s password hash using a specially crafted regular expression filter in the users endpoint of the REST API. Multiple such requests can eventually uncover the entire hash. The hash is not present in the response, however the presence or absence of a result confirms if the character is in the right position. The API has throttling enabled by default, making this a time intensive task. Both the REST API and the users endpoint need to be enabled, as they are disabled by default. The issue has been fixed in versions 3.2.39 and above, and 3.3.2 and above.

Severity CVSS v4.0: Pending analysis

Last modification:

30/06/2023

CVE-2022-25523

Publication date:

25/03/2022

TypesetterCMS v5.1 was discovered to contain a Cross-Site Request Forgery (CSRF) which is exploited via a crafted POST request.

Severity CVSS v4.0: Pending analysis

Last modification:

29/03/2022

CVE-2022-26197

Publication date:

25/03/2022

Joget DX 7 was discovered to contain a cross-site scripting (XSS) vulnerability via the Datalist table.

Severity CVSS v4.0: Pending analysis

Last modification:

29/03/2022

CVE-2022-26659

Publication date:

25/03/2022

Docker Desktop installer on Windows in versions before 4.6.0 allows an attacker to overwrite any administrator writable files by creating a symlink in place of where the installer writes its log file. Starting from version 4.6.0, the Docker Desktop installer, when run elevated, will write its log files to a location not writable by non-administrator users.

Severity CVSS v4.0: Pending analysis

Last modification:

01/02/2023

CVE-2022-24643

Publication date:

25/03/2022

A stored cross-site scripting (XSS) issue was discovered in the OpenEMR Hospital Information Management System version 6.0.0.

Severity CVSS v4.0: Pending analysis

Last modification:

29/03/2022

CVE-2021-44905

Publication date:

25/03/2022

Incorrect permissions in the Bluetooth Services in the Fortessa FTBTLD Smart Lock as of 12-13-2022 allows a remote attacker to disable the lock via an unauthenticated edit to the lock name.

Severity CVSS v4.0: Pending analysis

Last modification:

04/04/2022

CVE-2022-27920

Publication date:

25/03/2022

libkiwix 10.0.0 and 10.0.1 allows XSS in the built-in webserver functionality via the search suggestions URL parameter. This is fixed in 10.1.0.

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2022-27906

Publication date:

25/03/2022

Mendelson OFTP2 before 1.1 b43 is affected by directory traversal. To access the vulnerable code path, the attacker has to know one of the configured Odette IDs of the OFTP2 server. An attacker can upload files to the server outside of the intended upload directory.

Severity CVSS v4.0: Pending analysis

Last modification:

01/04/2022

CVE-2022-27919

Publication date:

25/03/2022

Gradle Enterprise before 2022.1 allows remote code execution if the installation process did not specify an initial configuration file. The configuration allows certain anonymous access to administration and an API.

Severity CVSS v4.0: Pending analysis

Last modification:

08/08/2023