Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2021-35228

Publication date:

21/10/2021

This vulnerability occurred due to missing input sanitization for one of the output fields that is extracted from headers on specific section of page causing a reflective cross site scripting attack. An attacker would need to perform a Man in the Middle attack in order to change header for a remote victim.

Severity CVSS v4.0: Pending analysis

Last modification:

26/10/2021

CVE-2021-35227

Publication date:

21/10/2021

The HTTP interface was enabled for RabbitMQ Plugin in ARM 2020.2.6 and the ability to configure HTTPS was not available.

Severity CVSS v4.0: Pending analysis

Last modification:

28/10/2021

CVE-2021-41146

Publication date:

21/10/2021

qutebrowser is an open source keyboard-focused browser with a minimal GUI. Starting with qutebrowser v1.7.0, the Windows installer for qutebrowser registers a `qutebrowserurl:` URL handler. With certain applications, opening a specially crafted `qutebrowserurl:...` URL can lead to execution of qutebrowser commands, which in turn allows arbitrary code execution via commands such as `:spawn` or `:debug-pyeval`. Only Windows installs where qutebrowser is registered as URL handler are affected. The issue has been fixed in qutebrowser v2.4.0. The fix also adds additional hardening for potential similar issues on Linux (by adding the new --untrusted-args flag to the .desktop file), though no such vulnerabilities are known.

Severity CVSS v4.0: Pending analysis

Last modification:

24/10/2022

CVE-2021-35225

Publication date:

21/10/2021

Each authenticated Orion Platform user in a MSP (Managed Service Provider) environment can view and browse all NetPath Services from all that MSP&#39;s customers. This can lead to any user having a limited insight into other customer&#39;s infrastructure and potential data cross-contamination.

Severity CVSS v4.0: Pending analysis

Last modification:

12/07/2022

CVE-2021-20120

Publication date:

21/10/2021

The administration web interface for the Arris Surfboard SB8200 lacks any protections against cross-site request forgery attacks. This means that an attacker could make configuration changes (such as changing the administrative password) without the consent of the user.

Severity CVSS v4.0: Pending analysis

Last modification:

27/10/2021

CVE-2020-14263

Publication date:

21/10/2021

"HCL Traveler Companion is vulnerable to an iOS weak cryptographic process vulnerability via the included MobileIron AppConnect SDK"

Severity CVSS v4.0: Pending analysis

Last modification:

12/07/2022

CVE-2021-29873

Publication date:

21/10/2021

IBM Flash System 900 could allow an authenticated attacker to obtain sensitive information and cause a denial of service due to a restricted shell escape vulnerability. IBM X-Force ID: 206229.

Severity CVSS v4.0: Pending analysis

Last modification:

12/07/2022

CVE-2021-29883

Publication date:

21/10/2021

IBM Standards Processing Engine (IBM Transformation Extender Advanced 9.0 and 10.0) does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic. IBM X-Force ID: 207090.

Severity CVSS v4.0: Pending analysis

Last modification:

12/07/2022

CVE-2021-28496

Publication date:

21/10/2021

On systems running Arista EOS and CloudEOS with the affected release version, when using shared secret profiles the password configured for use by BiDirectional Forwarding Detection (BFD) will be leaked when displaying output over eAPI or other JSON outputs to other authenticated users on the device. The affected EOS Versions are: all releases in 4.22.x train, 4.23.9 and below releases in the 4.23.x train, 4.24.7 and below releases in the 4.24.x train, 4.25.4 and below releases in the 4.25.x train, 4.26.1 and below releases in the 4.26.x train

Severity CVSS v4.0: Pending analysis

Last modification:

30/07/2022

CVE-2021-42327

Publication date:

21/10/2021

dp_link_settings_write in drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c in the Linux kernel through 5.14.14 allows a heap-based buffer overflow by an attacker who can write a string to the AMD GPU display drivers debug filesystem. There are no checks on size within parse_write_buffer_into_params when it uses the size of copy_from_user to copy a userspace buffer into a 40-byte heap buffer.

Severity CVSS v4.0: Pending analysis

Last modification:

25/03/2024

CVE-2021-28975

Publication date:

21/10/2021

WP Mailster 1.6.18.0 allows XSS when a victim opens a mail server&#39;s details in the mst_servers page, for a crafted server_host, server_name, or connection_parameter parameter.

Severity CVSS v4.0: Pending analysis

Last modification:

26/10/2021

CVE-2020-27304

Publication date:

21/10/2021

The CivetWeb web library does not validate uploaded filepaths when running on an OS other than Windows, when using the built-in HTTP form-based file upload mechanism, via the mg_handle_form_request API. Web applications that use the file upload form handler, and use parts of the user-controlled filename in the output path, are susceptible to directory traversal

Severity CVSS v4.0: Pending analysis

Last modification:

14/06/2022

Subscribe to Vulnerabilities