Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2021-24334

Publication date:

01/06/2021

The Instant Images – One Click Unsplash Uploads WordPress plugin before 4.4.0.1 did not properly validate and sanitise its unsplash_download_w and unsplash_download_h parameter settings (/wp-admin/upload.php?page=instant-images), only validating them client side before saving them, leading to a Stored Cross-Site Scripting issue.

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2021-24331

Publication date:

01/06/2021

The Smooth Scroll Page Up/Down Buttons WordPress plugin before 1.4 did not properly sanitise and validate its settings, such as psb_distance, psb_buttonsize, psb_speed, only validating them client side. This could allow high privilege users (such as admin) to set XSS payloads in them

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2021-24328

Publication date:

01/06/2021

The WP Login Security and History WordPress plugin through 1.0 did not have CSRF check when saving its settings, not any sanitisation or validation on them. This could allow attackers to make logged in administrators change the plugin&#39;s settings to arbitrary values, and set XSS payloads on them as well

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2021-24333

Publication date:

01/06/2021

The Content Copy Protection & Prevent Image Save WordPress plugin through 1.3 does not check for CSRF when saving its settings, not perform any validation and sanitisation on them, allowing attackers to make a logged in administrator set arbitrary XSS payloads in them.

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2021-20575

Publication date:

01/06/2021

IBM Security Verify Access 20.07 allows web pages to be stored locally which can be read by another user on the system. X-Force ID: 199278.

Severity CVSS v4.0: Pending analysis

Last modification:

07/06/2021

CVE-2021-20576

Publication date:

01/06/2021

IBM Security Verify Access 20.07 could allow a remote attacker to send a specially crafted HTTP GET request that could cause the application to crash.

Severity CVSS v4.0: Pending analysis

Last modification:

04/06/2021

CVE-2021-20585

Publication date:

01/06/2021

IBM Security Verify Access 20.07 could disclose sensitive information in HTTP server headers that could be used in further attacks against the system. IBM X-Force ID: 199398.

Severity CVSS v4.0: Pending analysis

Last modification:

04/06/2021

CVE-2020-4520

Publication date:

01/06/2021

IBM Cognos Analytics 11.0 and 11.1 could allow a remote attacker to inject malicious HTML code that when viewed by the authenticated victim would execute the code. IBM X-Force ID: 182395.

Severity CVSS v4.0: Pending analysis

Last modification:

12/07/2022

CVE-2021-20306

Publication date:

01/06/2021

A flaw was found in the BPMN editor in version jBPM 7.51.0.Final. Any authenticated user from any project can see the name of Ruleflow Groups from other projects, despite the user not having access to those projects. The highest threat from this vulnerability is to confidentiality.

Severity CVSS v4.0: Pending analysis

Last modification:

05/08/2022

CVE-2020-1920

Publication date:

01/06/2021

A regular expression denial of service (ReDoS) vulnerability in the validateBaseUrl function can cause the application to use excessive resources, become unresponsive, or crash. This was introduced in react-native version 0.59.0 and fixed in version 0.64.1.

Severity CVSS v4.0: Pending analysis

Last modification:

06/10/2022

CVE-2021-24311

Publication date:

01/06/2021

The wp_ajax_upload-remote-file AJAX action of the External Media WordPress plugin before 1.0.34 was vulnerable to arbitrary file uploads via any authenticated users.

Severity CVSS v4.0: Pending analysis

Last modification:

02/12/2021

CVE-2019-4653

Publication date:

01/06/2021

IBM Cognos Analytics 11.0 and 11.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 170964.

Severity CVSS v4.0: Pending analysis

Last modification:

01/12/2021

Subscribe to Vulnerabilities