Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2022-24755

Publication date:

15/03/2022

Bareos is open source software for backup, archiving, and recovery of data for operating systems. When Bareos Director >= 18.2 >= 18.2 but prior to 21.1.0, 20.0.6, and 19.2.12 is built and configured for PAM authentication, it will skip authorization checks completely. Expired accounts and accounts with expired passwords can still login. This problem will affect users that have PAM enabled. Currently there is no authorization (e.g. check for expired or disabled accounts), but only plain authentication (i.e. check if username and password match). Bareos Director versions 21.1.0, 20.0.6 and 19.2.12 implement the authorization check that was previously missing. The only workaround is to make sure that authentication fails if the user is not authorized.

Severity CVSS v4.0: Pending analysis

Last modification:

24/03/2022

CVE-2022-24752

Publication date:

15/03/2022

SyliusGridBundle is a package of generic data grids for Symfony applications. Prior to versions 1.10.1 and 1.11-rc2, values added at the end of query sorting were passed directly to the database. The maintainers do not know if this could lead to direct SQL injections but took steps to remediate the vulnerability. The issue is fixed in versions 1.10.1 and 1.11-rc2. As a workaround, overwrite the`Sylius\Component\Grid\Sorting\Sorter.php` class and register it in the container. More information about this workaround is available in the GitHub Security Advisory.

Severity CVSS v4.0: Pending analysis

Last modification:

25/03/2022

CVE-2022-0430

Publication date:

15/03/2022

Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository httpie/httpie prior to 3.1.0.

Severity CVSS v4.0: Pending analysis

Last modification:

23/03/2022

CVE-2022-0961

Publication date:

15/03/2022

The microweber application allows large characters to insert in the input field "post title" which can allow attackers to cause a Denial of Service (DoS) via a crafted HTTP request. in GitHub repository microweber/microweber prior to 1.2.12.

Severity CVSS v4.0: Pending analysis

Last modification:

22/03/2022

CVE-2022-24721

Publication date:

15/03/2022

CometD is a scalable comet implementation for web messaging. In any version prior to 5.0.11, 6.0.6, and 7.0.6, internal usage of Oort and Seti channels is improperly authorized, so any remote user could subscribe and publish to those channels. By subscribing to those channels, a remote user may be able to watch cluster-internal traffic that contains other users&#39; (possibly sensitive) data. By publishing to those channels, a remote user may be able to create/modify/delete other user&#39;s data and modify the cluster structure. A fix is available in versions 5.0.11, 6.0.6, and 7.0.6. As a workaround, install a custom `SecurityPolicy` that forbids subscription and publishing to remote, non-Oort, sessions on Oort and Seti channels.

Severity CVSS v4.0: Pending analysis

Last modification:

25/03/2022

CVE-2022-0942

Publication date:

15/03/2022

Stored XSS due to Unrestricted File Upload in GitHub repository star7th/showdoc prior to 2.10.4.

Severity CVSS v4.0: Pending analysis

Last modification:

22/03/2022

CVE-2022-0957

Publication date:

15/03/2022

Stored XSS via File Upload in GitHub repository star7th/showdoc prior to 2.10.4.

Severity CVSS v4.0: Pending analysis

Last modification:

22/03/2022

CVE-2022-0956

Publication date:

15/03/2022

Stored XSS via File Upload in GitHub repository star7th/showdoc prior to v.2.10.4.

Severity CVSS v4.0: Pending analysis

Last modification:

22/03/2022

CVE-2022-0954

Publication date:

15/03/2022

Multiple Stored Cross-site Scripting (XSS) Vulnerabilities in Shop&#39;s Other Settings, Shop&#39;s Autorespond E-mail Settings and Shops&#39; Payments Methods in GitHub repository microweber/microweber prior to 1.2.11.

Severity CVSS v4.0: Pending analysis

Last modification:

21/03/2022

CVE-2021-45010

Publication date:

15/03/2022

A path traversal vulnerability in the file upload functionality in tinyfilemanager.php in Tiny File Manager before 2.4.7 allows remote attackers (with valid user accounts) to upload malicious PHP files to the webroot, leading to code execution.

Severity CVSS v4.0: Pending analysis

Last modification:

31/12/2025