Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

Go to Calendar     Go to Press Room     Go to Newsletters subscription

Search

Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2022-34092
Publication date:
14/07/2022
Portal do Software Publico Brasileiro i3geo v7.0.5 was discovered to contain a cross-site scripting (XSS) vulnerability via svg2img.php.
Severity CVSS v4.0: Pending analysis
Last modification:
18/10/2023

CVE-2022-32409
Publication date:
14/07/2022
A local file inclusion (LFI) vulnerability in the component codemirror.php of Portal do Software Publico Brasileiro i3geo v7.0.5 allows attackers to execute arbitrary PHP code via a crafted HTTP request.
Severity CVSS v4.0: Pending analysis
Last modification:
08/08/2023

CVE-2022-32406
Publication date:
14/07/2022
GtkRadiant v1.6.6 was discovered to contain a buffer overflow via the component q3map2. This vulnerability can cause a Denial of Service (DoS) via a crafted MAP file.
Severity CVSS v4.0: Pending analysis
Last modification:
18/07/2022

CVE-2022-32389
Publication date:
14/07/2022
Isode SWIFT v4.0.2 was discovered to contain hard-coded credentials in the Registry Editor. This allows attackers to access sensitive information such as user credentials and certificates.
Severity CVSS v4.0: Pending analysis
Last modification:
20/07/2022

CVE-2022-32323
Publication date:
14/07/2022
AutoTrace v0.40.0 was discovered to contain a heap overflow via the ReadImage function at input-bmp.c:660.
Severity CVSS v4.0: Pending analysis
Last modification:
07/11/2023

CVE-2022-23825
Publication date:
14/07/2022
Aliases in the branch predictor may cause some AMD processors to predict the wrong branch type potentially leading to information disclosure.
Severity CVSS v4.0: Pending analysis
Last modification:
04/02/2024

CVE-2022-32318
Publication date:
14/07/2022
Fast Food Ordering System v1.0 was discovered to contain a persistent cross-site scripting (XSS) vulnerability via the component /ffos/classes/Master.php?f=save_category.
Severity CVSS v4.0: Pending analysis
Last modification:
18/07/2022

CVE-2022-32297
Publication date:
14/07/2022
Piwigo v12.2.0 was discovered to contain SQL injection vulnerability via the Search function.
Severity CVSS v4.0: Pending analysis
Last modification:
25/07/2022

CVE-2022-32298
Publication date:
14/07/2022
Toybox v0.8.7 was discovered to contain a NULL pointer dereference via the component httpd.c. This vulnerability can lead to a Denial of Service (DoS) via unspecified vectors.
Severity CVSS v4.0: Pending analysis
Last modification:
25/07/2022

CVE-2021-4135
Publication date:
14/07/2022
A memory leak vulnerability was found in the Linux kernel's eBPF for the Simulated networking device driver in the way user uses BPF for the device such that function nsim_map_alloc_elem being called. A local user could use this flaw to get unauthorized access to some data.
Severity CVSS v4.0: Pending analysis
Last modification:
20/07/2022

CVE-2021-26384
Publication date:
14/07/2022
A malformed SMI (System Management Interface) command may allow an attacker to establish a corrupted SMI Trigger Info data structure, potentially leading to out-of-bounds memory reads and writes when triggering an SMI resulting in a potential loss of resources.
Severity CVSS v4.0: Pending analysis
Last modification:
08/08/2023

CVE-2022-32317
Publication date:
14/07/2022
The MPlayer Project v1.5 was discovered to contain a heap use-after-free resulting in a double free in the preinit function at libvo/vo_v4l2.c. This vulnerability can lead to a Denial of Service (DoS) via a crafted file. The device=strdup statement is not executed on every call. Note: This has been disputed by third parties as invalid and not reproduceable.
Severity CVSS v4.0: Pending analysis
Last modification:
03/08/2024
Subscribe to Vulnerabilities