Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2022-25523

Publication date:

25/03/2022

TypesetterCMS v5.1 was discovered to contain a Cross-Site Request Forgery (CSRF) which is exploited via a crafted POST request.

Severity CVSS v4.0: Pending analysis

Last modification:

29/03/2022

CVE-2022-26197

Publication date:

25/03/2022

Joget DX 7 was discovered to contain a cross-site scripting (XSS) vulnerability via the Datalist table.

Severity CVSS v4.0: Pending analysis

Last modification:

29/03/2022

CVE-2022-26659

Publication date:

25/03/2022

Docker Desktop installer on Windows in versions before 4.6.0 allows an attacker to overwrite any administrator writable files by creating a symlink in place of where the installer writes its log file. Starting from version 4.6.0, the Docker Desktop installer, when run elevated, will write its log files to a location not writable by non-administrator users.

Severity CVSS v4.0: Pending analysis

Last modification:

01/02/2023

CVE-2022-24643

Publication date:

25/03/2022

A stored cross-site scripting (XSS) issue was discovered in the OpenEMR Hospital Information Management System version 6.0.0.

Severity CVSS v4.0: Pending analysis

Last modification:

29/03/2022

CVE-2021-44905

Publication date:

25/03/2022

Incorrect permissions in the Bluetooth Services in the Fortessa FTBTLD Smart Lock as of 12-13-2022 allows a remote attacker to disable the lock via an unauthenticated edit to the lock name.

Severity CVSS v4.0: Pending analysis

Last modification:

04/04/2022

CVE-2022-27920

Publication date:

25/03/2022

libkiwix 10.0.0 and 10.0.1 allows XSS in the built-in webserver functionality via the search suggestions URL parameter. This is fixed in 10.1.0.

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2022-27906

Publication date:

25/03/2022

Mendelson OFTP2 before 1.1 b43 is affected by directory traversal. To access the vulnerable code path, the attacker has to know one of the configured Odette IDs of the OFTP2 server. An attacker can upload files to the server outside of the intended upload directory.

Severity CVSS v4.0: Pending analysis

Last modification:

01/04/2022

CVE-2022-27919

Publication date:

25/03/2022

Gradle Enterprise before 2022.1 allows remote code execution if the installation process did not specify an initial configuration file. The configuration allows certain anonymous access to administration and an API.

Severity CVSS v4.0: Pending analysis

Last modification:

08/08/2023

CVE-2022-27887

Publication date:

25/03/2022

Maccms v10 was discovered to contain a reflected cross-site scripting (XSS) vulnerability in /admin.php/admin/vod/data.html via the repeat parameter.

Severity CVSS v4.0: Pending analysis

Last modification:

30/03/2022

CVE-2022-27886

Publication date:

25/03/2022

Maccms v10 was discovered to contain a reflected cross-site scripting (XSS) vulnerability in /admin.php/admin/ulog/index.html via the wd parameter.

Severity CVSS v4.0: Pending analysis

Last modification:

30/03/2022

CVE-2022-27885

Publication date:

25/03/2022

Maccms v10 was discovered to contain multiple reflected cross-site scripting (XSS) vulnerabilities in /admin.php/admin/website/data.html via the select and input parameters.

Severity CVSS v4.0: Pending analysis

Last modification:

30/03/2022