Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2021-43360

Publication date:

01/12/2021

Sunnet eHRD e-mail delivery task schedule’s serialization function has inadequate input object validation and restriction, which allows a post-authenticated remote attacker with database access privilege, to execute arbitrary code and control the system or interrupt services.

Severity CVSS v4.0: Pending analysis

Last modification:

02/12/2021

CVE-2021-40809

Publication date:

01/12/2021

An issue was discovered in Jamf Pro before 10.32.0, aka PI-009921. An account can be granted incorrect privileges in response to authentication that uses specific sign-on workflows.

Severity CVSS v4.0: Pending analysis

Last modification:

02/12/2021

CVE-2021-36329

Publication date:

30/11/2021

Dell EMC Streaming Data Platform versions before 1.3 contain an Indirect Object Reference Vulnerability. A remote malicious user may potentially exploit this vulnerability to gain sensitive information.

Severity CVSS v4.0: Pending analysis

Last modification:

02/12/2021

CVE-2021-36330

Publication date:

30/11/2021

Dell EMC Streaming Data Platform versions before 1.3 contain an Insufficient Session Expiration Vulnerability. A remote unauthenticated attacker may potentially exploit this vulnerability to reuse old session artifacts to impersonate a legitimate user.

Severity CVSS v4.0: Pending analysis

Last modification:

02/12/2021

CVE-2021-41256

Publication date:

30/11/2021

nextcloud news-android is an Android client for the Nextcloud news/feed reader app. In affected versions the Nextcloud News for Android app has a security issue by which a malicious application installed on the same device can send it an arbitrary Intent that gets reflected back, unintentionally giving read and write access to non-exported Content Providers in Nextcloud News for Android. Users should upgrade to version 0.9.9.63 or higher as soon as possible.

Severity CVSS v4.0: Pending analysis

Last modification:

02/12/2021

CVE-2021-36328

Publication date:

30/11/2021

Dell EMC Streaming Data Platform versions before 1.3 contain a SQL Injection Vulnerability. A remote malicious user may potentially exploit this vulnerability to execute SQL commands to perform unauthorized actions and retrieve sensitive information from the database.

Severity CVSS v4.0: Pending analysis

Last modification:

01/12/2021

CVE-2021-36326

Publication date:

30/11/2021

Dell EMC Streaming Data Platform, versions prior to 1.3 contain an SSL Strip Vulnerability in the User Interface (UI). A remote unauthenticated attacker could potentially exploit this vulnerability, leading to a downgrade in the communications between the client and server into an unencrypted format.

Severity CVSS v4.0: Pending analysis

Last modification:

01/12/2021

CVE-2021-36327

Publication date:

30/11/2021

Dell EMC Streaming Data Platform versions before 1.3 contain a Server Side Request Forgery Vulnerability. A remote unauthenticated attacker may potentially exploit this vulnerability to perform port scanning of internal networks and make HTTP requests to an arbitrary domain of the attacker&#39;s choice.

Severity CVSS v4.0: Pending analysis

Last modification:

01/12/2021

CVE-2021-43320

Publication date:

30/11/2021

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2021-41244. Reason: This candidate is a reservation duplicate of CVE-2021-41244. Notes: All CVE users should reference CVE-2021-41244 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2021-31787

Publication date:

30/11/2021

The Bluetooth Classic implementation on Actions ATS2815 chipsets does not properly handle the reception of continuous unsolicited LMP responses, allowing attackers in radio range to trigger a denial of service and shutdown of a device by flooding the target device with LMP_features_res packets.

Severity CVSS v4.0: Pending analysis

Last modification:

03/12/2021

CVE-2021-42564

Publication date:

30/11/2021

An open redirect through HTML injection in confidential messages in Cryptshare before 5.1.0 allows remote attackers (with permission to provide confidential messages via Cryptshare) to redirect targeted victims to any URL via the &#39;

Severity CVSS v4.0: Pending analysis

Last modification:

01/12/2021

CVE-2021-40101

Publication date:

30/11/2021

An issue was discovered in Concrete CMS before 8.5.7. The Dashboard allows a user&#39;s password to be changed without a prompt for the current password.

Severity CVSS v4.0: Pending analysis

Last modification:

01/12/2021

Subscribe to Vulnerabilities