Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2021-32924

Publication date:

01/06/2021

Invision Community (aka IPS Community Suite) before 4.6.0 allows eval-based PHP code injection by a moderator because the IPS\cms\modules\front\pages\_builder::previewBlock method interacts unsafely with the IPS\_Theme::runProcessFunction method.

Severity CVSS v4.0: Pending analysis

Last modification:

16/06/2021

CVE-2020-26670

Publication date:

01/06/2021

A vulnerability has been discovered in BigTree CMS 4.4.10 and earlier which allows an authenticated attacker to execute arbitrary commands through a crafted request sent to the server via the &#39;Create a New Setting&#39; function.

Severity CVSS v4.0: Pending analysis

Last modification:

03/05/2022

CVE-2020-17541

Publication date:

01/06/2021

Libjpeg-turbo all version have a stack-based buffer overflow in the "transform" component. A remote attacker can send a malformed jpeg file to the service and cause arbitrary code execution or denial of service of the target service.

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2022

CVE-2021-31642

Publication date:

01/06/2021

A denial of service condition exists after an integer overflow in several IoT devices from CHIYU Technology, including BIOSENSE, Webpass, and BF-630, BF-631, and SEMAC. The vulnerability can be explored by sending an unexpected integer (> 32 bits) on the page parameter that will crash the web portal and making it unavailable until a reboot of the device.

Severity CVSS v4.0: Pending analysis

Last modification:

08/06/2021

CVE-2021-31641

Publication date:

01/06/2021

An unauthenticated XSS vulnerability exists in several IoT devices from CHIYU Technology, including BF-630, BF-450M, BF-430, BF-431, BF631-W, BF830-W, Webpass, BF-MINI-W, and SEMAC due to a lack of sanitization when the HTTP 404 message is generated.

Severity CVSS v4.0: Pending analysis

Last modification:

08/06/2021

CVE-2021-31643

Publication date:

01/06/2021

An XSS vulnerability exists in several IoT devices from CHIYU Technology, including SEMAC, Biosense, BF-630, BF-631, and Webpass due to a lack of sanitization on the component if.cgi - username parameter.

Severity CVSS v4.0: Pending analysis

Last modification:

08/06/2021

CVE-2020-26693

Publication date:

01/06/2021

A stored cross-site scripting (XSS) vulnerability was discovered in pfSense 2.4.5-p1 which allows an authenticated attacker to execute arbitrary web scripts via exploitation of the load_balancer_monitor.php function.

Severity CVSS v4.0: Pending analysis

Last modification:

09/06/2021

CVE-2020-27377

Publication date:

01/06/2021

A cross-site scripting (XSS) vulnerability was discovered in the Administrator panel on the &#39;Setting News&#39; module on CMS Made Simple 2.2.14 which allows an attacker to execute arbitrary web scripts.

Severity CVSS v4.0: Pending analysis

Last modification:

09/06/2021

CVE-2020-26669

Publication date:

01/06/2021

A stored cross-site scripting (XSS) vulnerability was discovered in BigTree CMS 4.4.10 and earlier which allows an authenticated attacker to execute arbitrary web scripts or HTML via the page content to site/index.php/admin/pages/update.

Severity CVSS v4.0: Pending analysis

Last modification:

09/06/2021

CVE-2020-26668

Publication date:

01/06/2021

A SQL injection vulnerability was discovered in /core/feeds/custom.php in BigTree CMS 4.4.10 and earlier which allows an authenticated attacker to inject a malicious SQL query to the applications via the &#39;Create New Feed&#39; function.

Severity CVSS v4.0: Pending analysis

Last modification:

09/06/2021

CVE-2021-3516

Publication date:

01/06/2021

There&#39;s a flaw in libxml2&#39;s xmllint in versions before 2.9.11. An attacker who is able to submit a crafted file to be processed by xmllint could trigger a use-after-free. The greatest impact of this flaw is to confidentiality, integrity, and availability.

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2021-32647

Publication date:

01/06/2021

Emissary is a P2P based data-driven workflow engine. Affected versions of Emissary are vulnerable to post-authentication Remote Code Execution (RCE). The [`CreatePlace`](https://github.com/NationalSecurityAgency/emissary/blob/30c54ef16c6eb6ed09604a929939fb9f66868382/src/main/java/emissary/server/mvc/internal/CreatePlaceAction.java#L36) REST endpoint accepts an `sppClassName` parameter which is used to load an arbitrary class. This class is later instantiated using a constructor with the following signature: `(String, String, String)`. An attacker may find a gadget (class) in the application classpath that could be used to achieve Remote Code Execution (RCE) or disrupt the application. Even though the chances to find a gadget (class) that allow arbitrary code execution are low, an attacker can still find gadgets that could potentially crash the application or leak sensitive data. As a work around disable network access to Emissary from untrusted sources.

Severity CVSS v4.0: Pending analysis

Last modification:

02/07/2022

Subscribe to Vulnerabilities