Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

Go to Calendar     Go to Press Room     Go to Newsletters subscription

Search

Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2020-27739
Publication date:
28/10/2020
A Weak Session Management vulnerability in Citadel WebCit through 926 allows unauthenticated remote attackers to hijack recently logged-in users' sessions. NOTE: this was reported to the vendor in a publicly archived "Multiple Security Vulnerabilities in WebCit 926" thread.
Severity CVSS v4.0: Pending analysis
Last modification:
04/11/2020

CVE-2020-24990
Publication date:
28/10/2020
An issue was discovered in QSC Q-SYS Core Manager 8.2.1. By utilizing the TFTP service running on UDP port 69, a remote attacker can perform a directory traversal and obtain operating system files via a TFTP GET request, as demonstrated by reading /etc/passwd or /proc/version.
Severity CVSS v4.0: Pending analysis
Last modification:
17/11/2020

CVE-2020-16263
Publication date:
28/10/2020
Winston 1.5.4 devices have a CORS configuration that trusts arbitrary origins. This allows requests to be made and viewed by arbitrary origins.
Severity CVSS v4.0: Pending analysis
Last modification:
03/11/2020

CVE-2020-16260
Publication date:
28/10/2020
Winston 1.5.4 devices do not enforce authorization. This is exploitable from the intranet, and can be combined with other vulnerabilities for remote exploitation.
Severity CVSS v4.0: Pending analysis
Last modification:
04/11/2020

CVE-2020-16259
Publication date:
28/10/2020
Winston 1.5.4 devices have an SSH user account with access from bastion hosts. This is undocumented in device documents and is not announced to the user.
Severity CVSS v4.0: Pending analysis
Last modification:
21/07/2021

CVE-2020-16261
Publication date:
28/10/2020
Winston 1.5.4 devices allow a U-Boot interrupt, resulting in local root access.
Severity CVSS v4.0: Pending analysis
Last modification:
21/07/2021

CVE-2020-16262
Publication date:
28/10/2020
Winston 1.5.4 devices have a local www-data user that is overly permissioned, resulting in root privilege escalation.
Severity CVSS v4.0: Pending analysis
Last modification:
21/07/2021

CVE-2020-25966
Publication date:
28/10/2020
Sectona Spectra before 3.4.0 has a vulnerable SOAP API endpoint that leaks sensitive information about the configured assets without proper authentication. This could be used by unauthorized parties to get configured login credentials of the assets via a modified pAccountID value. NOTE: The vendor has indicated this is not a vulnerability and states "This vulnerability occurred due to wrong configuration of system.
Severity CVSS v4.0: Pending analysis
Last modification:
04/08/2024

CVE-2020-26130
Publication date:
28/10/2020
Issues were discovered in Open TFTP Server multithreaded 1.66 and Open TFTP Server single port 1.66. Due to insufficient access restrictions in the default installation directory, an attacker can elevate privileges by replacing the OpenTFTPServerMT.exe or the OpenTFTPServerSP.exe binary.
Severity CVSS v4.0: Pending analysis
Last modification:
27/02/2023

CVE-2020-26131
Publication date:
28/10/2020
Issues were discovered in Open DHCP Server (Regular) 1.75 and Open DHCP Server (LDAP Based) 0.1Beta. Due to insufficient access restrictions in the default installation directory, an attacker can elevate privileges by replacing the OpenDHCPServer.exe (Regular) or the OpenDHCPLdap.exe (LDAP Based) binary.
Severity CVSS v4.0: Pending analysis
Last modification:
27/02/2023

CVE-2020-26132
Publication date:
28/10/2020
An issue was discovered in Home DNS Server 0.10. Due to insufficient access restrictions in the default installation directory, an attacker can elevate privileges by replacing the HomeDNSServer.exe binary.
Severity CVSS v4.0: Pending analysis
Last modification:
27/02/2023

CVE-2020-26133
Publication date:
28/10/2020
An issue was discovered in Dual DHCP DNS Server 7.40. Due to insufficient access restrictions in the default installation directory, an attacker can elevate privileges by replacing the DualServer.exe binary.
Severity CVSS v4.0: Pending analysis
Last modification:
27/02/2023
Subscribe to Vulnerabilities