Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

Go to Calendar     Go to Press Room     Go to Newsletters subscription

Search

Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2021-36706
Publication date:
06/08/2021
In ProLink PRC2402M V1.0.18 and older, the set_sys_cmd function in the adm.cgi binary, accessible with a page parameter value of sysCMD contains a trivial command injection where the value of the command parameter is passed directly to system.
Severity CVSS v4.0: Pending analysis
Last modification:
28/06/2022

CVE-2020-22330
Publication date:
06/08/2021
Cross-Site Scripting (XSS) vulnerability in Subrion 4.2.1 via the title when adding a page.
Severity CVSS v4.0: Pending analysis
Last modification:
12/08/2021

CVE-2021-36209
Publication date:
06/08/2021
In JetBrains Hub before 2021.1.13389, account takeover was possible during password reset.
Severity CVSS v4.0: Pending analysis
Last modification:
12/08/2021

CVE-2021-37541
Publication date:
06/08/2021
In JetBrains Hub before 2021.1.13402, HTML injection in the password reset email was possible.
Severity CVSS v4.0: Pending analysis
Last modification:
12/08/2021

CVE-2021-36351
Publication date:
06/08/2021
SQL Injection Vulnerability in Care2x Open Source Hospital Information Management 2.7 Alpha via the (1) pday, (2) pmonth, and (3) pyear parameters in GET requests sent to /modules/nursing/nursing-station.php.
Severity CVSS v4.0: Pending analysis
Last modification:
12/08/2021

CVE-2021-36708
Publication date:
06/08/2021
In ProLink PRC2402M V1.0.18 and older, the set_sys_init function in the login.cgi binary allows an attacker to reset the password to the administrative interface of the router.
Severity CVSS v4.0: Pending analysis
Last modification:
12/08/2021

CVE-2021-36707
Publication date:
06/08/2021
In ProLink PRC2402M V1.0.18 and older, the set_ledonoff function in the adm.cgi binary, accessible with a page parameter value of ledonoff contains a trivial command injection where the value of the led_cmd parameter is passed directly to do_system.
Severity CVSS v4.0: Pending analysis
Last modification:
12/08/2021

CVE-2021-37540
Publication date:
06/08/2021
In JetBrains Hub before 2021.1.13262, a potentially insufficient CSP for the Widget deployment feature was used.
Severity CVSS v4.0: Pending analysis
Last modification:
08/08/2023

CVE-2021-22295
Publication date:
06/08/2021
A component of the HarmonyOS has a permission bypass vulnerability. Local attackers may exploit this vulnerability to cause the device to hang due to the page error OsVmPageFaultHandler.
Severity CVSS v4.0: Pending analysis
Last modification:
13/08/2021

CVE-2021-37381
Publication date:
06/08/2021
Southsoft GMIS 5.0 is vulnerable to CSRF attacks. Attackers can access other users' private information such as photos through CSRF. For example: any student's photo information can be accessed through /gmis/(S([1]))/student/grgl/PotoImageShow/?bh=[2]. Among them, the code in [1] is a random string generated according to the user's login related information. It can protect the user's identity, but it can not effectively prevent unauthorized access. The code in [2] is the student number of any student. The attacker can carry out CSRF attack on the system by modifying [2] without modifying [1].
Severity CVSS v4.0: Pending analysis
Last modification:
13/08/2021

CVE-2021-38151
Publication date:
06/08/2021
index.php/appointment/todos in Chikitsa Patient Management System 2.0.0 allows XSS.
Severity CVSS v4.0: Pending analysis
Last modification:
12/08/2021

CVE-2021-37388
Publication date:
06/08/2021
A buffer overflow in D-Link DIR-615 C2 3.03WW. The ping_ipaddr parameter in ping_response.cgi POST request allows an attacker to crash the webserver and might even gain remote code execution.
Severity CVSS v4.0: Pending analysis
Last modification:
13/08/2021
Subscribe to Vulnerabilities