Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2020-6149

Publication date:

13/11/2020

A heap overflow vulnerability exists in Pixar OpenUSD 20.05 when the software parses compressed sections in binary USD files. To trigger this vulnerability, the victim needs to open an attacker-provided malformed file in an instance in USDC file format PATHS section.

Severity CVSS v4.0: Pending analysis

Last modification:

13/05/2022

CVE-2020-6150

Publication date:

13/11/2020

A heap overflow vulnerability exists in Pixar OpenUSD 20.05 when the software USDC file format SPECS section decompression heap overflow.

Severity CVSS v4.0: Pending analysis

Last modification:

13/05/2022

CVE-2020-7032

Publication date:

13/11/2020

An XML external entity (XXE) vulnerability in Avaya WebLM admin interface allows authenticated users to read arbitrary files or conduct server-side request forgery (SSRF) attacks via a crafted DTD in an XML request. Affected versions of Avaya WebLM include: 7.0 through 7.1.3.6 and 8.0 through 8.1.2.

Severity CVSS v4.0: Pending analysis

Last modification:

19/10/2022

CVE-2020-7033

Publication date:

13/11/2020

A Cross Site Scripting (XSS) Vulnerability on the Unified Portal Client (web client) used in Avaya Equinox Conferencing can allow an authenticated user to perform XSS attacks. The affected versions of Equinox Conferencing includes all 9.x versions before 9.1.10.

Severity CVSS v4.0: Pending analysis

Last modification:

29/11/2020

CVE-2020-27193

Publication date:

12/11/2020

A cross-site scripting (XSS) vulnerability in the Color Dialog plugin for CKEditor 4.15.0 allows remote attackers to run arbitrary web script after persuading a user to copy and paste crafted HTML code into one of editor inputs.

Severity CVSS v4.0: Pending analysis

Last modification:

02/12/2021

CVE-2020-13877

Publication date:

12/11/2020

SQL Injection issues in various ASPX pages of ResourceXpress Meeting Monitor 4.9 could lead to remote code execution and information disclosure.

Severity CVSS v4.0: Pending analysis

Last modification:

24/11/2020

CVE-2020-24719

Publication date:

12/11/2020

Exposed Erlang Cookie could lead to Remote Command Execution (RCE) attack. Communication between Erlang nodes is done by exchanging a shared secret (aka "magic cookie"). There are cases where the magic cookie is included in the content of the logs. An attacker can use the cookie to attach to an Erlang node and run OS level commands on the system running the Erlang node. Affects version: 6.5.1. Fix version: 6.6.0.

Severity CVSS v4.0: Pending analysis

Last modification:

30/11/2020

CVE-2020-17494

Publication date:

12/11/2020

Untangle Firewall NG before 16.0 uses MD5 for passwords.

Severity CVSS v4.0: Pending analysis

Last modification:

21/07/2021

CVE-2020-28414

Publication date:

12/11/2020

A reflected cross-site scripting (XSS) vulnerability exists in the TranzWare Payment Gateway 3.1.12.3.2. A remote unauthenticated attacker is able to execute arbitrary HTML code via crafted url (different vector than CVE-2020-28415).

Severity CVSS v4.0: Pending analysis

Last modification:

17/11/2020

CVE-2020-28415

Publication date:

12/11/2020

Severity CVSS v4.0: Pending analysis

Last modification:

17/11/2020

CVE-2020-13774

Publication date:

12/11/2020

An unrestricted file-upload issue in EditLaunchPadDialog.aspx in Ivanti Endpoint Manager 2019.1 and 2020.1 allows an authenticated attacker to gain remote code execution by uploading a malicious aspx file. The issue is caused by insufficient file extension validation and insecure file operations on the uploaded image, which upon failure will leave the temporarily created files in an accessible location on the server.

Severity CVSS v4.0: Pending analysis

Last modification:

02/12/2020

CVE-2020-15783

Publication date:

12/11/2020

A vulnerability has been identified in SIMATIC S7-300 CPU family (incl. related ET200 CPUs and SIPLUS variants) (All versions), SIMATIC TDC CPU555 (All versions), SINUMERIK 840D sl (All versions). Sending multiple specially crafted packets to the affected devices could cause a Denial-of-Service on port 102. A cold restart is required to recover the service.

Severity CVSS v4.0: Pending analysis

Last modification:

06/12/2022

Subscribe to Vulnerabilities