Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2021-21638

Publication date:

30/03/2021

A cross-site request forgery (CSRF) vulnerability in Jenkins Team Foundation Server Plugin 5.157.1 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

Severity CVSS v4.0: Pending analysis

Last modification:

30/11/2023

CVE-2021-21635

Publication date:

30/03/2021

Jenkins REST List Parameter Plugin 1.3.0 and earlier does not escape a parameter name reference in embedded JavaScript, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission.

Severity CVSS v4.0: Pending analysis

Last modification:

03/11/2023

CVE-2021-21636

Publication date:

30/03/2021

A missing permission check in Jenkins Team Foundation Server Plugin 5.157.1 and earlier allows attackers with Overall/Read permission to enumerate credentials ID of credentials stored in Jenkins.

Severity CVSS v4.0: Pending analysis

Last modification:

25/10/2023

CVE-2021-21637

Publication date:

30/03/2021

A missing permission check in Jenkins Team Foundation Server Plugin 5.157.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

Severity CVSS v4.0: Pending analysis

Last modification:

25/10/2023

CVE-2021-26919

Publication date:

30/03/2021

Apache Druid allows users to read data from other database systems using JDBC. This functionality is to allow trusted users with the proper permissions to set up lookups or submit ingestion tasks. The MySQL JDBC driver supports certain properties, which, if left unmitigated, can allow an attacker to execute arbitrary code from a hacker-controlled malicious MySQL server within Druid server processes. This issue was addressed in Apache Druid 0.20.2

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2021-29418

Publication date:

30/03/2021

The netmask package before 2.0.1 for Node.js mishandles certain unexpected characters in an IP address string, such as an octal digit of 9. This (in some situations) allows attackers to bypass access control that is based on IP addresses. NOTE: this issue exists because of an incomplete fix for CVE-2021-28918.

Severity CVSS v4.0: Pending analysis

Last modification:

08/06/2021

CVE-2021-29376

Publication date:

30/03/2021

ircII before 20210314 allows remote attackers to cause a denial of service (segmentation fault and client crash, disconnecting the victim from an IRC server) via a crafted CTCP UTC message.

Severity CVSS v4.0: Pending analysis

Last modification:

21/09/2021

CVE-2020-20545

Publication date:

30/03/2021

Cross-Site Scripting (XSS) vulnerability in Zhiyuan G6 Government Collaboration System V6.1SP1, via the &#39;method&#39; parameter to &#39;seeyon/hrSalary.do&#39;.

Severity CVSS v4.0: Pending analysis

Last modification:

01/04/2021

CVE-2020-19643

Publication date:

30/03/2021

Cross Site Scripting (XSS) vulnerability in INSMA Wifi Mini Spy 1080P HD Security IP Camera 1.9.7 B via all fields in the FTP settings page to the "goform/formSetFtpCfg" settings page.

Severity CVSS v4.0: Pending analysis

Last modification:

01/04/2021

CVE-2020-19642

Publication date:

30/03/2021

An issue was discovered in INSMA Wifi Mini Spy 1080P HD Security IP Camera 1.9.7 B. A local attacker can execute arbitrary code via editing the &#39;recdata.db&#39; file to call a specially crafted GoAhead ASP-file on the SD card.

Severity CVSS v4.0: Pending analysis

Last modification:

01/04/2021

CVE-2020-19639

Publication date:

30/03/2021

Cross Site Request Forgery (CSRF) vulnerability in INSMA Wifi Mini Spy 1080P HD Security IP Camera 1.9.7 B, via all fields to WebUI.

Severity CVSS v4.0: Pending analysis

Last modification:

01/04/2021

CVE-2020-19640

Publication date:

30/03/2021

An issue was discovered in INSMA Wifi Mini Spy 1080P HD Security IP Camera 1.9.7 B. An unauthenticated attacker can reboot the device causing a Denial of Service, via a hidden reboot command to &#39;/media/?action=cmd&#39;.

Severity CVSS v4.0: Pending analysis

Last modification:

01/04/2021

Subscribe to Vulnerabilities