Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

Go to Calendar     Go to Press Room     Go to Newsletters subscription

Search

Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2020-12273
Publication date:
27/04/2020
In TestLink 1.9.20, a crafted login.php viewer parameter exposes cleartext credentials.
Severity CVSS v4.0: Pending analysis
Last modification:
21/07/2021

CVE-2020-12274
Publication date:
27/04/2020
In TestLink 1.9.20, the lib/cfields/cfieldsExport.php goback_url parameter causes a security risk because it depends on client input and is not constrained to lib/cfields/cfieldsView.php at the web site associated with the session.
Severity CVSS v4.0: Pending analysis
Last modification:
21/07/2021

CVE-2020-12270
Publication date:
27/04/2020
React Native Bluetooth Scan in Bluezone 1.0.0 uses six-character alphanumeric IDs, which might make it easier for remote attackers to interfere with COVID-19 contact tracing by using many IDs. NOTE: the vendor disputes the relevance of this report because the recipient of an F1 alert will know it was a false alert if contact-history comparison fails (i.e., an F0 is not actually part of the contact history obtained from the device of this recipient, or this recipient is not actually part of the contact history obtained from the device of an F0)
Severity CVSS v4.0: Pending analysis
Last modification:
04/08/2024

CVE-2020-12271
Publication date:
27/04/2020
A SQL injection issue was found in SFOS 17.0, 17.1, 17.5, and 18.0 before 2020-04-25 on Sophos XG Firewall devices, as exploited in the wild in April 2020. This affected devices configured with either the administration (HTTPS) service or the User Portal exposed on the WAN zone. A successful attack may have caused remote code execution that exfiltrated usernames and hashed passwords for the local device admin(s), portal admins, and user accounts used for remote access (but not external Active Directory or LDAP passwords)
Severity CVSS v4.0: Pending analysis
Last modification:
03/04/2025

CVE-2020-12267
Publication date:
27/04/2020
setMarkdown in Qt before 5.14.2 has a use-after-free related to QTextMarkdownImporter::insertBlock.
Severity CVSS v4.0: Pending analysis
Last modification:
27/01/2023

CVE-2020-12268
Publication date:
27/04/2020
jbig2_image_compose in jbig2_image.c in Artifex jbig2dec before 0.18 has a heap-based buffer overflow.
Severity CVSS v4.0: Pending analysis
Last modification:
02/11/2021

CVE-2019-20789
Publication date:
26/04/2020
Croogo before 3.0.7 allows XSS via the title to admin/menus/menus or admin/taxonomy/vocabularies.
Severity CVSS v4.0: Pending analysis
Last modification:
27/04/2020

CVE-2020-12265
Publication date:
26/04/2020
The decompress package before 4.2.1 for Node.js is vulnerable to Arbitrary File Write via ../ in an archive member, when a symlink is used, because of Directory Traversal.
Severity CVSS v4.0: Pending analysis
Last modification:
21/07/2021

CVE-2020-12254
Publication date:
26/04/2020
Avira Antivirus before 5.0.2003.1821 on Windows allows privilege escalation or a denial of service via abuse of a symlink.
Severity CVSS v4.0: Pending analysis
Last modification:
06/10/2020

CVE-2020-6212
Publication date:
24/04/2020
Egypt localized withholding tax reports Clearing of Liabilities and Remittance Statement and Summary in SAP ERP (versions 618, 730, EAPPLGLO 607) and S/4 HANA (versions 100, 101, 102, 103, 104) do not perform necessary authorization checks for an authenticated user, allowing reading or modification of some tax reports, due to Missing Authorization Check.
Severity CVSS v4.0: Pending analysis
Last modification:
08/05/2020

CVE-2020-6213
Publication date:
24/04/2020
SAP NetWeaver AS ABAP Business Server Pages Test Application SBSPEXT_PHTMLB, versions 700, 701, 702, 730, 731, 740, 750, 751, 752, 753, 754, is vulnerable to reflected Cross-Site Scripting (XSS) via different URL parameters as it does not sufficiently encode user controlled inputs.
Severity CVSS v4.0: Pending analysis
Last modification:
05/05/2020

CVE-2020-12070
Publication date:
24/04/2020
The Advanced Woo Search plugin version through 1.99 for Wordpress suffers from a sensitive information disclosure vulnerability in every ajax search request via the sql field to includes/class-aws-search.php.
Severity CVSS v4.0: Pending analysis
Last modification:
01/05/2020
Subscribe to Vulnerabilities