Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2021-33667

Publication date:

14/07/2021

Under certain conditions, SAP Business Objects Web Intelligence (BI Launchpad) versions - 420, 430, allows an attacker to access jsp source code, through SDK calls, of Analytical Reporting bundle, a part of the frontend application, which would otherwise be restricted.

Severity CVSS v4.0: Pending analysis

Last modification:

16/07/2021

CVE-2021-33677

Publication date:

14/07/2021

SAP NetWeaver ABAP Server and ABAP Platform, versions - 700, 702, 730, 731, 804, 740, 750, 784, expose functions to external which can lead to information disclosure.

Severity CVSS v4.0: Pending analysis

Last modification:

06/10/2022

CVE-2021-33678

Publication date:

14/07/2021

A function module of SAP NetWeaver AS ABAP (Reconciliation Framework), versions - 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 752, 75A, 75B, 75B, 75C, 75D, 75E, 75F, allows a high privileged attacker to inject code that can be executed by the application. An attacker could thereby delete some critical information and could make the SAP system completely unavailable.

Severity CVSS v4.0: Pending analysis

Last modification:

05/10/2022

CVE-2021-22318

Publication date:

14/07/2021

A component of the HarmonyOS 2.0 has a Null Pointer Dereference Vulnerability. Local attackers may exploit this vulnerability to cause system denial of service.

Severity CVSS v4.0: Pending analysis

Last modification:

15/07/2021

CVE-2021-25953

Publication date:

14/07/2021

Prototype pollution vulnerability in &#39;putil-merge&#39; versions1.0.0 through 3.6.6 allows attacker to cause a denial of service and may lead to remote code execution.

Severity CVSS v4.0: Pending analysis

Last modification:

08/08/2023

CVE-2021-36374

Publication date:

14/07/2021

When reading a specially crafted ZIP archive, or a derived formats, an Apache Ant build can be made to allocate large amounts of memory that leads to an out of memory error, even for small inputs. This can be used to disrupt builds using Apache Ant. Commonly used derived formats from ZIP archives are for instance JAR files and many office files. Apache Ant prior to 1.9.16 and 1.10.11 were affected.

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2021-36373

Publication date:

14/07/2021

When reading a specially crafted TAR archive an Apache Ant build can be made to allocate large amounts of memory that finally leads to an out of memory error, even for small inputs. This can be used to disrupt builds using Apache Ant. Apache Ant prior to 1.9.16 and 1.10.11 were affected.

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2021-20784

Publication date:

14/07/2021

HTTP header injection vulnerability in Everything version 1.0, 1.1, and 1.2 except the Lite version may allow a remote attacker to inject an arbitrary script or alter the website that uses the product.

Severity CVSS v4.0: Pending analysis

Last modification:

03/12/2024

CVE-2021-20747

Publication date:

14/07/2021

Improper authorization in handler for custom URL scheme vulnerability in Retty App for Android versions prior to 4.8.13 and Retty App for iOS versions prior to 4.11.14 allows a remote attacker to lead a user to access an arbitrary website via the vulnerable App.

Severity CVSS v4.0: Pending analysis

Last modification:

15/07/2021

CVE-2021-20782

Publication date:

14/07/2021

Cross-site request forgery (CSRF) vulnerability in Software License Manager versions prior to 4.4.6 allows remote attackers to hijack the authentication of administrators via unspecified vectors.

Severity CVSS v4.0: Pending analysis

Last modification:

15/07/2021

CVE-2021-20781

Publication date:

14/07/2021

Cross-site request forgery (CSRF) vulnerability in WordPress Meta Data Filter & Taxonomies Filter versions prior to v.1.2.8 and versions prior to v.2.2.8 allows remote attackers to hijack the authentication of administrators via unspecified vectors.

Severity CVSS v4.0: Pending analysis

Last modification:

15/07/2021

CVE-2021-20748

Publication date:

14/07/2021

Retty App for Android versions prior to 4.8.13 and Retty App for iOS versions prior to 4.11.14 uses a hard-coded API key for an external service. By exploiting this vulnerability, API key for an external service may be obtained by analyzing data in the app.

Severity CVSS v4.0: Pending analysis

Last modification:

16/07/2021

Subscribe to Vulnerabilities