Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2020-12857

Publication date:

18/05/2020

Caching of GATT characteristic values (TempID) in COVIDSafe v1.0.15 and v1.0.16 allows a remote attacker to long-term re-identify an Android device running COVIDSafe.

Severity CVSS v4.0: Pending analysis

Last modification:

21/07/2021

CVE-2020-12858

Publication date:

18/05/2020

Non-reinitialisation of random data in the advertising payload in COVIDSafe v1.0.15 and v1.0.16 allows a remote attacker to re-identify Android devices running COVIDSafe by scanning for their advertising beacons.

Severity CVSS v4.0: Pending analysis

Last modification:

21/07/2021

CVE-2020-12860

Publication date:

18/05/2020

COVIDSafe through v1.0.17 allows a remote attacker to access phone name and model information because a BLE device can have four roles and COVIDSafe uses all of them. This allows for re-identification of a device, and potentially identification of the owner&#39;s name.

Severity CVSS v4.0: Pending analysis

Last modification:

21/07/2021

CVE-2020-12856

Publication date:

18/05/2020

OpenTrace, as used in COVIDSafe through v1.0.17, TraceTogether, ABTraceTogether, and other applications on iOS and Android, allows remote attackers to conduct long-term re-identification attacks and possibly have unspecified other impact, because of how Bluetooth is used.

Severity CVSS v4.0: Pending analysis

Last modification:

20/05/2020

CVE-2020-13128

Publication date:

18/05/2020

An issue was discovered in Manolo GWTUpload 1.0.3. server/UploadServlet.java (the servlet for handling file upload) accepts a delay parameter that causes a thread to sleep. It can be abused to cause all of a server&#39;s threads to sleep, leading to denial of service.

Severity CVSS v4.0: Pending analysis

Last modification:

19/05/2020

CVE-2019-20802

Publication date:

18/05/2020

An issue was discovered in the Readdle Documents app before 6.9.7 for iOS. The application&#39;s file-transfer web server improperly displays directory names, leading to Stored XSS, which may be used to steal a user&#39;s data. This requires user interaction because there is no known direct way for an attacker to create a crafted directory name on a victim&#39;s device. However, a crafted directory name can occur if a victim extracts a ZIP archive that was provided by an attacker.

Severity CVSS v4.0: Pending analysis

Last modification:

19/05/2020

CVE-2019-20797

Publication date:

18/05/2020

An issue was discovered in e6y prboom-plus 2.5.1.5. There is a buffer overflow in client and server code responsible for handling received UDP packets, as demonstrated by I_SendPacket or I_SendPacketTo in i_network.c.

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2019-20798

Publication date:

18/05/2020

An XSS issue was discovered in handler_server_info.c in Cherokee through 1.2.104. The requested URL is improperly displayed on the About page in the default configuration of the web server and its administrator panel. The XSS in the administrator panel can be used to reconfigure the server and execute arbitrary commands.

Severity CVSS v4.0: Pending analysis

Last modification:

21/11/2022

CVE-2019-20799

Publication date:

18/05/2020

In Cherokee through 1.2.104, multiple memory corruption errors may be used by a remote attacker to destabilize the work of a server.

Severity CVSS v4.0: Pending analysis

Last modification:

28/04/2022

CVE-2019-20800

Publication date:

18/05/2020

In Cherokee through 1.2.104, remote attackers can trigger an out-of-bounds write in cherokee_handler_cgi_add_env_pair in handler_cgi.c by sending many request headers, as demonstrated by a GET request with many "Host: 127.0.0.1" headers.

Severity CVSS v4.0: Pending analysis

Last modification:

21/11/2022

CVE-2019-20801

Publication date:

18/05/2020

An issue was discovered in the Readdle Documents app before 6.9.7 for iOS. The application&#39;s file-transfer web server allows for cross-origin requests from any domain, and the WebSocket server lacks authorization control. Any web site can execute JavaScript code (that accesses a user&#39;s data) via cross-origin requests.

Severity CVSS v4.0: Pending analysis

Last modification:

21/07/2021

CVE-2020-4345

Publication date:

17/05/2020

IBM i 7.2, 7.3, and 7.4 users running complex SQL statements under a specific set of circumstances may allow a local user to obtain sensitive information that they should not have access to. IBM X-Force ID: 178318.

Severity CVSS v4.0: Pending analysis

Last modification:

18/05/2020

Subscribe to Vulnerabilities