Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

Go to Calendar     Go to Press Room     Go to Newsletters subscription

Search

Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2020-13126
Publication date:
17/05/2020
An issue was discovered in the Elementor Pro plugin before 2.9.4 for WordPress, as exploited in the wild in May 2020 in conjunction with CVE-2020-13125. An attacker with the Subscriber role can upload arbitrary executable files to achieve remote code execution. NOTE: the free Elementor plugin is unaffected.
Severity CVSS v4.0: Pending analysis
Last modification:
25/08/2020

CVE-2020-13125
Publication date:
17/05/2020
An issue was discovered in the "Ultimate Addons for Elementor" plugin before 1.24.2 for WordPress, as exploited in the wild in May 2020 in conjunction with CVE-2020-13126. Unauthenticated attackers can create users with the Subscriber role even if registration is disabled.
Severity CVSS v4.0: Pending analysis
Last modification:
21/07/2021

CVE-2020-13121
Publication date:
16/05/2020
Submitty through 20.04.01 has an open redirect via authentication/login?old= during an invalid login attempt.
Severity CVSS v4.0: Pending analysis
Last modification:
18/05/2020

CVE-2020-13118
Publication date:
16/05/2020
An issue was discovered in Mikrotik-Router-Monitoring-System through 2018-10-22. SQL Injection exists in check_community.php via the parameter community.
Severity CVSS v4.0: Pending analysis
Last modification:
19/05/2020

CVE-2020-13111
Publication date:
16/05/2020
NaviServer 4.99.4 to 4.99.19 allows denial of service due to the nsd/driver.c ChunkedDecode function not properly validating the length of a chunk. A remote attacker can craft a chunked-transfer request that will result in a negative value being passed to memmove via the size parameter, causing the process to crash.
Severity CVSS v4.0: Pending analysis
Last modification:
21/07/2021

CVE-2020-13110
Publication date:
16/05/2020
The kerberos package before 1.0.0 for Node.js allows arbitrary code execution and privilege escalation via injection of malicious DLLs through use of the kerberos_sspi LoadLibrary() method, because of a DLL path search.
Severity CVSS v4.0: Pending analysis
Last modification:
07/11/2023

CVE-2020-13109
Publication date:
16/05/2020
Morita Shogi 64 through 2020-05-02 for Nintendo 64 devices allows remote attackers to execute arbitrary code via crafted packet data to the built-in modem because 0x800b3e94 (aka the IF subcommand to top-level command 7) has a stack-based buffer overflow.
Severity CVSS v4.0: Pending analysis
Last modification:
20/05/2020

CVE-2020-13093
Publication date:
15/05/2020
iSpyConnect.com Agent DVR before 2.7.1.0 allows directory traversal.
Severity CVSS v4.0: Pending analysis
Last modification:
15/05/2020

CVE-2020-1758
Publication date:
15/05/2020
A flaw was found in Keycloak in versions before 10.0.0, where it does not perform the TLS hostname verification while sending emails using the SMTP server. This flaw allows an attacker to perform a man-in-the-middle (MITM) attack.
Severity CVSS v4.0: Pending analysis
Last modification:
07/11/2023

CVE-2020-8149
Publication date:
15/05/2020
Lack of output sanitization allowed an attack to execute arbitrary shell commands via the logkitty npm package before version 0.7.1.
Severity CVSS v4.0: Pending analysis
Last modification:
19/05/2020

CVE-2020-13092
Publication date:
15/05/2020
scikit-learn (aka sklearn) through 0.23.0 can unserialize and execute commands from an untrusted file that is passed to the joblib.load() function, if __reduce__ makes an os.system call. NOTE: third parties dispute this issue because the joblib.load() function is documented as unsafe and it is the user's responsibility to use the function in a secure manner
Severity CVSS v4.0: Pending analysis
Last modification:
04/08/2024

CVE-2020-13091
Publication date:
15/05/2020
pandas through 1.0.3 can unserialize and execute commands from an untrusted file that is passed to the read_pickle() function, if __reduce__ makes an os.system call. NOTE: third parties dispute this issue because the read_pickle() function is documented as unsafe and it is the user's responsibility to use the function in a secure manner
Severity CVSS v4.0: Pending analysis
Last modification:
04/08/2024
Subscribe to Vulnerabilities