Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2022-23158

Publication date:

01/04/2022

Wyse Device Agent version 14.6.1.4 and below contain a sensitive data exposure vulnerability. A local authenticated user with standard privilege could potentially exploit this vulnerability and provide incorrect port information and get connected to valid WMS server

Severity CVSS v4.0: Pending analysis

Last modification:

08/04/2022

CVE-2022-24426

Publication date:

01/04/2022

Dell Command | Update, Dell Update, and Alienware Update version 4.4.0 contains a Local Privilege Escalation Vulnerability in the Advanced Driver Restore component. A local malicious user could potentially exploit this vulnerability, leading to privilege escalation.

Severity CVSS v4.0: Pending analysis

Last modification:

23/05/2022

CVE-2022-26562

Publication date:

01/04/2022

An issue in provider/libserver/ECKrbAuth.cpp of Kopano Core = 6.30 (introduced between 6.30.0 RC1e and 6.30.8 final).

Severity CVSS v4.0: Pending analysis

Last modification:

11/05/2023

CVE-2022-24066

Publication date:

01/04/2022

The package simple-git before 3.5.0 are vulnerable to Command Injection due to an incomplete fix of [CVE-2022-24433](https://security.snyk.io/vuln/SNYK-JS-SIMPLEGIT-2421199) which only patches against the git fetch attack vector. A similar use of the --upload-pack feature of git is also supported for git clone, which the prior fix didn&#39;t cover.

Severity CVSS v4.0: Pending analysis

Last modification:

08/08/2023

CVE-2022-23157

Publication date:

01/04/2022

Wyse Device Agent version 14.6.1.4 and below contain a sensitive data exposure vulnerability. A authenticated malicious user could potentially exploit this vulnerability in order to view sensitive information from the WMS Server.

Severity CVSS v4.0: Pending analysis

Last modification:

08/04/2022

CVE-2022-23156

Publication date:

01/04/2022

Wyse Device Agent version 14.6.1.4 and below contain an Improper Authentication vulnerability. A malicious user could potentially exploit this vulnerability by providing invalid input in order to obtain a connection to WMS server.

Severity CVSS v4.0: Pending analysis

Last modification:

08/04/2022

CVE-2022-23155

Publication date:

01/04/2022

Dell Wyse Management Suite versions 2.0 through 3.5.2 contain an unrestricted file upload vulnerability. A malicious user with admin privileges can exploit this vulnerability in order to execute arbitrary code on the system.

Severity CVSS v4.0: Pending analysis

Last modification:

09/04/2022

CVE-2022-1207

Publication date:

01/04/2022

Out-of-bounds read in GitHub repository radareorg/radare2 prior to 5.6.8. This vulnerability allows attackers to read sensitive information from outside the allocated buffer boundary.

Severity CVSS v4.0: Pending analysis

Last modification:

08/04/2022

CVE-2022-21223

Publication date:

01/04/2022

The package cocoapods-downloader before 1.6.2 are vulnerable to Command Injection via hg argument injection. When calling the download function (when using hg), the url (and/or revision, tag, branch) is passed to the hg clone command in a way that additional flags can be set. The additional flags can be used to perform a command injection.

Severity CVSS v4.0: Pending analysis

Last modification:

08/04/2022

CVE-2022-24440

Publication date:

01/04/2022

The package cocoapods-downloader before 1.6.0, from 1.6.2 and before 1.6.3 are vulnerable to Command Injection via git argument injection. When calling the Pod::Downloader.preprocess_options function and using git, both the git and branch parameters are passed to the git ls-remote subcommand in a way that additional flags can be set. The additional flags can be used to perform a command injection.

Severity CVSS v4.0: Pending analysis

Last modification:

08/04/2022

CVE-2022-22327

Publication date:

01/04/2022

IBM UrbanCode Deploy (UCD) 7.0.5, 7.1.0, 7.1.1, and 7.1.2 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 218859.

Severity CVSS v4.0: Pending analysis

Last modification:

12/04/2022

CVE-2022-22332

Publication date:

01/04/2022

IBM Sterling Partner Engagement Manager 6.2.0 could allow an attacker to impersonate another user due to missing revocation mechanism for the JWT token. IBM X-Force ID: 219131.

Severity CVSS v4.0: Pending analysis

Last modification:

12/04/2022

Subscribe to Vulnerabilities