Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2021-29212

Publication date:

01/11/2021

A remote unauthenticated directory traversal security vulnerability has been identified in HPE iLO Amplifier Pack versions 1.80, 1.81, 1.90 and 1.95. The vulnerability could be remotely exploited to allow an unauthenticated user to run arbitrary code leading complete impact to confidentiality, integrity, and availability of the iLO Amplifier Pack appliance.

Severity CVSS v4.0: Pending analysis

Last modification:

03/12/2021

CVE-2020-28702

Publication date:

01/11/2021

A SQL injection vulnerability in TopicMapper.xml of PybbsCMS v5.2.1 allows attackers to access sensitive database information.

Severity CVSS v4.0: Pending analysis

Last modification:

27/10/2022

CVE-2021-22564

Publication date:

01/11/2021

For certain valid JPEG XL images with a size slightly larger than an integer number of groups (256x256 pixels) when processing the groups out of order the decoder can perform an out of bounds copy of image pixels from an image buffer in the heap to another. This copy can occur when processing the right or bottom edges of the image, but only when groups are processed in certain order. Groups can be processed out of order in multi-threaded decoding environments with heavy thread load but also with images that contain the groups in an arbitrary order in the file. It is recommended to upgrade past 0.6.0 or patch with https://github.com/libjxl/libjxl/pull/775

Severity CVSS v4.0: Pending analysis

Last modification:

02/11/2021

CVE-2021-22563

Publication date:

01/11/2021

Invalid JPEG XL images using libjxl can cause an out of bounds access on a std::vector when rendering splines. The OOB read access can either lead to a segfault, or rendering splines based on other process memory. It is recommended to upgrade past 0.6.0 or patch with https://github.com/libjxl/libjxl/pull/757

Severity CVSS v4.0: Pending analysis

Last modification:

03/11/2021

CVE-2021-27004

Publication date:

01/11/2021

System Manager 9.x versions 9.7 and higher prior to 9.7P16, 9.8P7 and 9.9.1P2 are susceptible to a vulnerability which could allow a local attacker to discover plaintext iSCSI CHAP credentials.

Severity CVSS v4.0: Pending analysis

Last modification:

12/07/2022

CVE-2021-25875

Publication date:

01/11/2021

AVideo/YouPHPTube AVideo/YouPHPTube 10.0 and prior has multiple reflected Cross Script Scripting vulnerabilities via the searchPhrase parameter which allows a remote attacker to steal administrators&#39; session cookies or perform actions as an administrator.

Severity CVSS v4.0: Pending analysis

Last modification:

14/02/2024

CVE-2021-25878

Publication date:

01/11/2021

AVideo/YouPHPTube 10.0 and prior is affected by multiple reflected Cross Script Scripting vulnerabilities via the videoName parameter which allows a remote attacker to steal administrators&#39; session cookies or perform actions as an administrator.

Severity CVSS v4.0: Pending analysis

Last modification:

14/02/2024

CVE-2021-25876

Publication date:

01/11/2021

AVideo/YouPHPTube 10.0 and prior has multiple reflected Cross Script Scripting vulnerabilities via the u parameter which allows a remote attacker to steal administrators&#39; session cookies or perform actions as an administrator.

Severity CVSS v4.0: Pending analysis

Last modification:

14/02/2024

CVE-2021-25877

Publication date:

01/11/2021

AVideo/YouPHPTube 10.0 and prior is affected by Insecure file write. An administrator privileged user is able to write files on filesystem using flag and code variables in file save.php.

Severity CVSS v4.0: Pending analysis

Last modification:

14/02/2024

CVE-2021-42557

Publication date:

01/11/2021

In Jeedom through 4.1.19, a bug allows a remote attacker to bypass API access and retrieve users credentials.

Severity CVSS v4.0: Pending analysis

Last modification:

12/07/2022

CVE-2021-25874

Publication date:

01/11/2021

AVideo/YouPHPTube AVideo/YouPHPTube 10.0 and prior is affected by a SQL Injection SQL injection in the catName parameter which allows a remote unauthenticated attacker to retrieve databases information such as application passwords hashes.

Severity CVSS v4.0: Pending analysis

Last modification:

14/02/2024

CVE-2021-27644

Publication date:

01/11/2021

In Apache DolphinScheduler before 1.3.6 versions, authorized users can use SQL injection in the data source center. (Only applicable to MySQL data source with internal login account password)

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

Subscribe to Vulnerabilities