Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2020-27714

Publication date:
24/12/2020
On the BIG-IP AFM version 15.1.0-15.1.0.5, 14.1.0-14.1.3, and 13.1.0-13.1.3.5, when a Protocol Inspection Profile is attached to a FastL4 virtual server with the protocol field configured to either Other or All Protocols, the TMM may experience a restart if the profile processes non-TCP traffic.
Severity CVSS v4.0: Pending analysis
Last modification:
28/12/2020

CVE-2020-27715

Publication date:
24/12/2020
On BIG-IP 15.1.0-15.1.0.5 and 14.1.0-14.1.3, crafted TLS request to the BIG-IP management interface via port 443 can cause high (~100%) CPU utilization by the httpd daemon.
Severity CVSS v4.0: Pending analysis
Last modification:
28/12/2020

CVE-2020-28189

Publication date:
24/12/2020
Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2020-29189. Reason: This candidate is a reservation duplicate of CVE-2020-29189. Notes: All CVE users should reference CVE-2020-29189 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage
Severity CVSS v4.0: Pending analysis
Last modification:
07/11/2023

CVE-2020-28184

Publication date:
24/12/2020
Cross-site scripting (XSS) vulnerability in TerraMaster TOS
Severity CVSS v4.0: Pending analysis
Last modification:
28/12/2020

CVE-2020-28185

Publication date:
24/12/2020
User Enumeration vulnerability in TerraMaster TOS
Severity CVSS v4.0: Pending analysis
Last modification:
28/12/2020

CVE-2020-28187

Publication date:
24/12/2020
Multiple directory traversal vulnerabilities in TerraMaster TOS
Severity CVSS v4.0: Pending analysis
Last modification:
28/12/2020

CVE-2020-28190

Publication date:
24/12/2020
TerraMaster TOS
Severity CVSS v4.0: Pending analysis
Last modification:
28/12/2020

CVE-2020-28186

Publication date:
24/12/2020
Email Injection in TerraMaster TOS
Severity CVSS v4.0: Pending analysis
Last modification:
28/12/2020

CVE-2020-29189

Publication date:
24/12/2020
Incorrect Access Control vulnerability in TerraMaster TOS
Severity CVSS v4.0: Pending analysis
Last modification:
21/07/2021

CVE-2020-28188

Publication date:
24/12/2020
Remote Command Execution (RCE) vulnerability in TerraMaster TOS
Severity CVSS v4.0: Pending analysis
Last modification:
12/06/2023

CVE-2020-27721

Publication date:
24/12/2020
In versions 16.0.0-16.0.0.1, 15.1.0-15.1.1, 14.1.0-14.1.3, 13.1.0-13.1.3.5, 12.1.0-12.1.5.2, and 11.6.1-11.6.5.2, in a BIG-IP DNS / BIG-IP LTM GSLB deployment, under certain circumstances, the BIG-IP DNS system may stop using a BIG-IP LTM virtual server for DNS response.
Severity CVSS v4.0: Pending analysis
Last modification:
28/12/2020

CVE-2020-27724

Publication date:
24/12/2020
In BIG-IP APM versions 16.0.0-16.0.0.1, 15.1.0-15.1.0.4, 15.0.0-15.0.1.3, 14.1.0-14.1.3, 13.1.0-13.1.3.4, 12.1.0-12.1.5.2, and 11.6.1-11.6.5.2, on systems running more than one TMM instance, authenticated VPN users may consume excessive resources by sending specially-crafted malicious traffic over the tunnel.
Severity CVSS v4.0: Pending analysis
Last modification:
28/12/2020