Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2020-24620

Publication date:

01/10/2020

Unisys Stealth(core) before 4.0.134 stores passwords in a recoverable format. Therefore, a search of Enterprise Manager can potentially reveal credentials.

Severity CVSS v4.0: Pending analysis

Last modification:

12/02/2021

CVE-2020-16844

Publication date:

01/10/2020

In Istio 1.5.0 though 1.5.8 and Istio 1.6.0 through 1.6.7, when users specify an AuthorizationPolicy resource with DENY actions using wildcard suffixes (e.g. *-some-suffix) for source principals or namespace fields, callers will never be denied access, bypassing the intended policy.

Severity CVSS v4.0: Pending analysis

Last modification:

15/10/2020

CVE-2020-25017

Publication date:

01/10/2020

Envoy through 1.15.0 only considers the first value when multiple header values are present for some HTTP headers. Envoy’s setCopy() header map API does not replace all existing occurences of a non-inline header.

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2019-19393

Publication date:

01/10/2020

The Web application on Rittal CMC PU III 7030.000 V3.00 V3.11.00_2 to V3.15.70_4 devices fails to sanitize user input on the system configurations page. This allows an attacker to backdoor the device with HTML and browser-interpreted content (such as JavaScript or other client-side scripts) as the content is always displayed after and before login. Persistent XSS allows an attacker to modify displayed content or to change the victim&#39;s information. Successful exploitation requires access to the web management interface, either with valid credentials or a hijacked session.

Severity CVSS v4.0: Pending analysis

Last modification:

13/10/2020

CVE-2020-4576

Publication date:

01/10/2020

IBM WebSphere Application Server 7.5, 8.0, 8.5, and 9.0 traditional could allow a remote attacker to obtain sensitive information with a specially-crafted sequence of serialized objects. IBM X-Force ID: 184428.

Severity CVSS v4.0: Pending analysis

Last modification:

08/10/2020

CVE-2020-24860

Publication date:

01/10/2020

CMS Made Simple 2.2.14 allows an authenticated user with access to the Content Manager to edit content and put persistent XSS payload in the affected text fields. The user can get cookies from every authenticated user who visits the website.

Severity CVSS v4.0: Pending analysis

Last modification:

08/10/2020

CVE-2020-24861

Publication date:

01/10/2020

GetSimple CMS 3.3.16 allows in parameter &#39;permalink&#39; on the Settings page persistent Cross Site Scripting which is executed when you create and open a new page

Severity CVSS v4.0: Pending analysis

Last modification:

08/10/2020

CVE-2020-25990

Publication date:

01/10/2020

WebsiteBaker 2.12.2 allows SQL Injection via parameter &#39;display_name&#39; in /websitebaker/admin/preferences/save.php. Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Severity CVSS v4.0: Pending analysis

Last modification:

05/10/2020

CVE-2020-8109

Publication date:

01/10/2020

A vulnerability has been discovered in the ace.xmd parser that results from a lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. This can result in denial-of-service. This issue affects: Bitdefender Engines version 7.84892 and prior versions.

Severity CVSS v4.0: Pending analysis

Last modification:

14/10/2020

CVE-2019-20902

Publication date:

01/10/2020

Upgrading Crowd via XML Data Transfer can reactivate a disabled user from OpenLDAP. The affected versions are from before version 3.4.6 and from 3.5.0 before 3.5.1.

Severity CVSS v4.0: Pending analysis

Last modification:

14/10/2020

CVE-2019-20903

Publication date:

01/10/2020

The hyperlinks functionality in atlaskit/editor-core in before version 113.1.5 allows remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (XSS) vulnerability in link targets.

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023