Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2021-22664

Publication date:

27/04/2021

CNCSoft-B Versions 1.0.0.3 and prior is vulnerable to an out-of-bounds write, which may allow an attacker to execute arbitrary code.

Severity CVSS v4.0: Pending analysis

Last modification:

30/04/2021

CVE-2021-22660

Publication date:

27/04/2021

CNCSoft-B Versions 1.0.0.3 and prior is vulnerable to an out-of-bounds read, which may allow an attacker to execute arbitrary code.

Severity CVSS v4.0: Pending analysis

Last modification:

07/05/2021

CVE-2021-28271

Publication date:

27/04/2021

Soyal Technologies SOYAL 701Server 9.0.1 suffers from an elevation of privileges vulnerability which can be used by an authenticated user to change the executable file with a binary choice. The vulnerability is due to improper permissions with the &#39;F&#39; flag (Full) for &#39;Everyone&#39;and &#39;Authenticated Users&#39; group.

Severity CVSS v4.0: Pending analysis

Last modification:

23/09/2021

CVE-2021-27480

Publication date:

27/04/2021

Delta Industrial Automation COMMGR Versions 1.12 and prior are vulnerable to a stack-based buffer overflow, which may allow an attacker to execute remote code.

Severity CVSS v4.0: Pending analysis

Last modification:

07/05/2021

CVE-2020-35542

Publication date:

27/04/2021

Unisys Data Exchange Management Studio through 5.0.34 doesn&#39;t sanitize the input to a HTML document field. This could be used for an XSS attack.

Severity CVSS v4.0: Pending analysis

Last modification:

06/05/2021

CVE-2021-28125

Publication date:

27/04/2021

Apache Superset up to and including 1.0.1 allowed for the creation of an external URL that could be malicious. By not checking user input for open redirects the URL shortener functionality would allow for a malicious user to create a short URL for a dashboard that could convince the user to click the link.

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2020-17517

Publication date:

27/04/2021

The S3 buckets and keys in a secure Apache Ozone Cluster must be inaccessible to anonymous access by default. The current security vulnerability allows access to keys and buckets through a curl command or an unauthenticated HTTP request. This enables unauthorized access to buckets and keys thereby exposing data to anonymous clients or users. This affected Apache Ozone prior to the 1.1.0 release.

Severity CVSS v4.0: Pending analysis

Last modification:

05/08/2022

CVE-2021-20714

Publication date:

27/04/2021

Directory traversal vulnerability in WP Fastest Cache versions prior to 0.9.1.7 allows a remote attacker with administrator privileges to delete arbitrary files on the server via unspecified vectors.

Severity CVSS v4.0: Pending analysis

Last modification:

06/05/2021

CVE-2021-20715

Publication date:

27/04/2021

Improper access control vulnerability in Hot Pepper Gourmet App for Android ver.4.111.0 and earlier, and for iOS ver.4.111.0 and earlier allows a remote attacker to lead a user to access an arbitrary website via the vulnerable App.

Severity CVSS v4.0: Pending analysis

Last modification:

12/07/2022

CVE-2019-25032

Publication date:

27/04/2021

Unbound before 1.9.5 allows an integer overflow in the regional allocator via regional_alloc. NOTE: The vendor disputes that this is a vulnerability. Although the code may be vulnerable, a running Unbound installation cannot be remotely or locally exploited

Severity CVSS v4.0: Pending analysis

Last modification:

05/08/2024

CVE-2019-25039

Publication date:

27/04/2021

Unbound before 1.9.5 allows an integer overflow in a size calculation in respip/respip.c. NOTE: The vendor disputes that this is a vulnerability. Although the code may be vulnerable, a running Unbound installation cannot be remotely or locally exploited

Severity CVSS v4.0: Pending analysis

Last modification:

05/08/2024

CVE-2019-25040

Publication date:

27/04/2021

Unbound before 1.9.5 allows an infinite loop via a compressed name in dname_pkt_copy. NOTE: The vendor disputes that this is a vulnerability. Although the code may be vulnerable, a running Unbound installation cannot be remotely or locally exploited

Severity CVSS v4.0: Pending analysis

Last modification:

05/08/2024

Subscribe to Vulnerabilities