Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2022-29532

Publication date:

20/04/2022

An issue was discovered in MISP before 2.4.158. There is XSS in the cerebrate view if one administrator puts a javascript: URL in the URL field, and another administrator clicks on it.

Severity CVSS v4.0: Pending analysis

Last modification:

01/02/2024

CVE-2022-29531

Publication date:

20/04/2022

An issue was discovered in MISP before 2.4.158. There is stored XSS in the event graph via a tag name.

Severity CVSS v4.0: Pending analysis

Last modification:

21/12/2023

CVE-2022-29530

Publication date:

20/04/2022

An issue was discovered in MISP before 2.4.158. There is stored XSS in the galaxy clusters.

Severity CVSS v4.0: Pending analysis

Last modification:

21/12/2023

CVE-2022-29529

Publication date:

20/04/2022

An issue was discovered in MISP before 2.4.158. There is stored XSS via the LinOTP login field.

Severity CVSS v4.0: Pending analysis

Last modification:

03/11/2023

CVE-2022-29536

Publication date:

20/04/2022

In GNOME Epiphany before 41.4 and 42.x before 42.2, an HTML document can trigger a client buffer overflow (in ephy_string_shorten in the UI process) via a long page title. The issue occurs because the number of bytes for a UTF-8 ellipsis character is not properly considered.

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2022-29537

Publication date:

20/04/2022

gp_rtp_builder_do_hevc in ietf/rtp_pck_mpeg4.c in GPAC 2.0.0 has a heap-based buffer over-read, as demonstrated by MP4Box.

Severity CVSS v4.0: Pending analysis

Last modification:

27/05/2023

CVE-2022-24874

Publication date:

20/04/2022

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2022-28820. Reason: This candidate is a reservation duplicate of CVE-2022-28820. Notes: All CVE users should reference CVE-2022-28820 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2022-24865

Publication date:

20/04/2022

HumHub is an Open Source Enterprise Social Network. In affected versions users who are forced to change their password by an administrator may retrieve other users&#39; data. This issue has been resolved by commit `eb83de20`. It is recommended that the HumHub is upgraded to 1.11.0, 1.10.4 or 1.9.4. There are no known workarounds for this issue.

Severity CVSS v4.0: Pending analysis

Last modification:

02/05/2022

CVE-2022-24872

Publication date:

20/04/2022

Shopware is an open commerce platform based on Symfony Framework and Vue. Permissions set to sales channel context by admin-api are still usable within normal user session. Users are advised to update to the current version 6.4.10.1. For older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugin. There are no known workarounds for this issue.

Severity CVSS v4.0: Pending analysis

Last modification:

03/05/2022

CVE-2021-43481

Publication date:

20/04/2022

An SQL Injection vulnerability exists in Webtareas 2.4p3 and earlier via the $uq HTTP POST parameter in editapprovalstage.php.

Severity CVSS v4.0: Pending analysis

Last modification:

09/09/2022

CVE-2021-37740

Publication date:

20/04/2022

A denial of service vulnerability exists in MDT&#39;s firmware for the KNXnet/IP Secure router SCN-IP100.03 and KNX IP interface SCN-IP000.03 before v3.0.4, that allows a remote attacker to turn the device unresponsive to all requests on the KNXnet/IP Secure layer, until the device is rebooted, via a SESSION_REQUEST frame with a modified total length field.

Severity CVSS v4.0: Pending analysis

Last modification:

03/05/2022

CVE-2022-24864

Publication date:

20/04/2022

Origin Protocol is a blockchain based project. The Origin Protocol project website allows for malicious users to inject malicious Javascript via a POST request to `/presale/join`. User-controlled data is passed with no sanitization to SendGrid and injected into an email that is delivered to the founders@originprotocol.com. If the email recipient is using an email program that is susceptible to XSS, then that email recipient will receive an email that may contain malicious XSS. Regardless if the email recipient’s mail program has vulnerabilities or not, the hacker can at the very least inject malicious HTML that modifies the body content of the email. There are currently no known workarounds.

Severity CVSS v4.0: Pending analysis

Last modification:

28/04/2022

Subscribe to Vulnerabilities