Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2021-34082

Publication date:

02/06/2022

OS Command Injection vulnerability in allenhwkim proctree through 0.1.1 and commit 0ac10ae575459457838f14e21d5996f2fa5c7593 for Node.js, allows attackers to execute arbitrary commands via the fix function.

Severity CVSS v4.0: Pending analysis

Last modification:

09/06/2022

CVE-2021-34081

Publication date:

02/06/2022

OS Command Injection vulnerability in bbultman gitsome through 0.2.3 allows attackers to execute arbitrary commands via a crafted tag name of the target git repository.

Severity CVSS v4.0: Pending analysis

Last modification:

09/06/2022

CVE-2021-34080

Publication date:

02/06/2022

OS Command Injection vulnerability in es128 ssl-utils 1.0.0 for Node.js allows attackers to execute arbitrary commands via unsanitized shell metacharacters provided to the createCertRequest() and the createCert() functions.

Severity CVSS v4.0: Pending analysis

Last modification:

09/06/2022

CVE-2021-34079

Publication date:

02/06/2022

OS Command injection vulnerability in Mintzo Docker-Tester through 1.2.1 allows attackers to execute arbitrary commands via shell metacharacters in the &#39;ports&#39; entry of a crafted docker-compose.yml file.

Severity CVSS v4.0: Pending analysis

Last modification:

09/06/2022

CVE-2021-34083

Publication date:

02/06/2022

Google-it is a Node.js package which allows its users to send search queries to Google and receive the results in a JSON format. When using the &#39;Open in browser&#39; option in versions up to 1.6.2, google-it will unsafely concat the result&#39;s link retrieved from google to a shell command, potentially exposing the server to RCE.

Severity CVSS v4.0: Pending analysis

Last modification:

09/06/2022

CVE-2021-26634

Publication date:

02/06/2022

SQL injection and file upload attacks are possible due to insufficient validation of input values in some parameters and variables of files compromising Maxboard, which may lead to arbitrary code execution or privilege escalation. Attackers can use these vulnerabilities to perform attacks such as stealing server management rights using a web shell.

Severity CVSS v4.0: Pending analysis

Last modification:

26/06/2023

CVE-2021-26635

Publication date:

02/06/2022

In the code that verifies the file size in the ark library, it is possible to manipulate the offset read from the target file due to the wrong use of the data type. An attacker could use this vulnerability to cause a stack buffer overflow and as a result, perform an attack such as remote code execution.

Severity CVSS v4.0: Pending analysis

Last modification:

26/06/2023