Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2022-27357

Publication date:

08/04/2022

Ecommerce-Website v1 was discovered to contain an arbitrary file upload vulnerability via /customer_register.php. This vulnerability allows attackers to execute arbitrary code via a crafted PHP file.

Severity CVSS v4.0: Pending analysis

Last modification:

14/04/2022

CVE-2022-27352

Publication date:

08/04/2022

Simple House Rental System v1 was discovered to contain an arbitrary file upload vulnerability via /app/register.php. This vulnerability allows attackers to execute arbitrary code via a crafted PHP file.

Severity CVSS v4.0: Pending analysis

Last modification:

14/04/2022

CVE-2022-1219

Publication date:

08/04/2022

SQL injection in RecyclebinController.php in GitHub repository pimcore/pimcore prior to 10.3.5. This vulnerability is capable of steal the data

Severity CVSS v4.0: Pending analysis

Last modification:

13/04/2022

CVE-2022-28805

Publication date:

08/04/2022

singlevar in lparser.c in Lua from (including) 5.4.0 up to (excluding) 5.4.4 lacks a certain luaK_exp2anyregup call, leading to a heap-based buffer over-read that might affect a system that compiles untrusted Lua code.

Severity CVSS v4.0: Pending analysis

Last modification:

20/06/2024

CVE-2022-28796

Publication date:

08/04/2022

jbd2_journal_wait_updates in fs/jbd2/transaction.c in the Linux kernel before 5.17.1 has a use-after-free caused by a transaction_t race condition.

Severity CVSS v4.0: Pending analysis

Last modification:

29/08/2023

CVE-2021-43474

Publication date:

07/04/2022

An Access Control vulnerability exists in D-Link DIR-823G REVA1 1.02B05 (Lastest) via any parameter in the HNAP1 function

Severity CVSS v4.0: Pending analysis

Last modification:

14/04/2022

CVE-2022-24681

Publication date:

07/04/2022

Zoho ManageEngine ADSelfService Plus before 6121 allows XSS via the welcome name attribute to the Reset Password, Unlock Account, or User Must Change Password screen.

Severity CVSS v4.0: Pending analysis

Last modification:

06/10/2022

CVE-2021-43453

Publication date:

07/04/2022

A Heap-based Buffer Overflow vulnerability exists in JerryScript 2.4.0 and prior versions via an out-of-bounds read in parser_parse_for_statement_start in the js-parser-statm.c file. This issue is similar to CVE-2020-29657.

Severity CVSS v4.0: Pending analysis

Last modification:

08/08/2023

CVE-2021-36202

Publication date:

07/04/2022

Server-Side Request Forgery (SSRF) vulnerability in Johnson Controls Metasys could allow an authenticated attacker to inject malicious code into the MUI PDF export feature. This issue affects: Johnson Controls Metasys All 10 versions versions prior to 10.1.5; All 11 versions versions prior to 11.0.2.

Severity CVSS v4.0: Pending analysis

Last modification:

14/04/2022

CVE-2022-26676

Publication date:

07/04/2022

aEnrich a+HRD has inadequate privilege restrictions, an unauthenticated remote attacker can use the API function to upload and execute malicious scripts to control the system or disrupt service.

Severity CVSS v4.0: Pending analysis

Last modification:

14/04/2022

CVE-2022-26675

Publication date:

07/04/2022

aEnrich a+HRD has inadequate filtering for special characters in URLs. An unauthenticated remote attacker can bypass authentication and perform path traversal attacks to access arbitrary files under website root directory.

Severity CVSS v4.0: Pending analysis

Last modification:

14/04/2022

CVE-2022-26671

Publication date:

07/04/2022

Taiwan Secom Dr.ID Access Control system’s login page has a hard-coded credential in the source code. An unauthenticated remote attacker can use the hard-coded credential to acquire partial system information and modify system setting to cause partial disrupt of service.

Severity CVSS v4.0: Pending analysis

Last modification:

14/04/2022

Subscribe to Vulnerabilities