Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2019-16160

Publication date:

07/10/2020

An integer underflow in the SMB server of MikroTik RouterOS before 6.45.5 allows remote unauthenticated attackers to crash the service.

Severity CVSS v4.0: Pending analysis

Last modification:

21/07/2021

CVE-2020-14355

Publication date:

07/10/2020

Multiple buffer overflow vulnerabilities were found in the QUIC image decoding process of the SPICE remote display system, before spice-0.14.2-1. Both the SPICE client (spice-gtk) and server are affected by these flaws. These flaws allow a malicious client or server to send specially crafted messages that, when processed by the QUIC image compression algorithm, result in a process crash or potential code execution.

Severity CVSS v4.0: Pending analysis

Last modification:

09/11/2023

CVE-2020-24722

Publication date:

07/10/2020

An issue was discovered in the GAEN (aka Google/Apple Exposure Notifications) protocol through 2020-10-05, as used in COVID-19 applications on Android and iOS. The encrypted metadata block with a TX value lacks a checksum, allowing bitflipping to amplify a contamination attack. This can cause metadata deanonymization and risk-score inflation. NOTE: the vendor&#39;s position is "We do not believe that TX power authentication would be a useful defense against relay attacks.

Severity CVSS v4.0: Pending analysis

Last modification:

04/08/2024

CVE-2020-13335

Publication date:

07/10/2020

Improper group membership validation when deleting a user account in GitLab >=7.12 allows a user to delete own account without deleting/transferring their group.

Severity CVSS v4.0: Pending analysis

Last modification:

21/07/2021

CVE-2020-13346

Publication date:

07/10/2020

Membership changes are not reflected in ToDo subscriptions in GitLab versions prior to 13.2.10, 13.3.7 and 13.4.2, allowing guest users to access confidential issues through API.

Severity CVSS v4.0: Pending analysis

Last modification:

21/07/2021

CVE-2020-13347

Publication date:

07/10/2020

A command injection vulnerability was discovered in Gitlab runner versions prior to 13.2.4, 13.3.2 and 13.4.1. When the runner is configured on a Windows system with a docker executor, which allows the attacker to run arbitrary commands on Windows host, via DOCKER_AUTH_CONFIG build variable.

Severity CVSS v4.0: Pending analysis

Last modification:

21/07/2021

CVE-2020-25343

Publication date:

07/10/2020

Cross-site scripting (XSS) vulnerabilities in Symphony CMS 3.0.0 allow remote attackers to inject arbitrary web script or HTML to fields[&#39;body&#39;] param via events\event.publish_article.php

Severity CVSS v4.0: Pending analysis

Last modification:

14/10/2020

CVE-2020-13334

Publication date:

07/10/2020

In GitLab versions prior to 13.2.10, 13.3.7 and 13.4.2, improper authorization checks allow a non-member of a project/group to change the confidentiality attribute of issue via mutation GraphQL query

Severity CVSS v4.0: Pending analysis

Last modification:

15/10/2020

CVE-2020-13332

Publication date:

07/10/2020

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2020-25985

Publication date:

07/10/2020

MonoCMS Blog 1.0 is affected by: Arbitrary File Deletion. Any authenticated user can delete files on and off the webserver (php files can be unlinked and not deleted).

Severity CVSS v4.0: Pending analysis

Last modification:

07/10/2020

CVE-2020-7742

Publication date:

07/10/2020

This affects the package simpl-schema before 1.10.2.

Severity CVSS v4.0: Pending analysis

Last modification:

07/10/2020

CVE-2020-14183

Publication date:

06/10/2020

Affected versions of Jira Server & Data Center allow a remote attacker with limited (non-admin) privileges to view a Jira instance&#39;s Support Entitlement Number (SEN) via an Information Disclosure vulnerability in the HTTP Response headers. The affected versions are before version 7.13.18, from version 8.0.0 before 8.5.9, and from version 8.6.0 before 8.12.1.

Severity CVSS v4.0: Pending analysis

Last modification:

19/10/2020

Subscribe to Vulnerabilities