Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2022-31677

Publication date:

29/08/2022

An Insufficient Session Expiration issue was discovered in the Pinniped Supervisor (before v0.19.0). A user authenticating to Kubernetes clusters via the Pinniped Supervisor could potentially use their access token to continue their session beyond what proper use of their refresh token might allow.

Severity CVSS v4.0: Pending analysis

Last modification:

07/09/2022

CVE-2022-35962

Publication date:

29/08/2022

Zulip is an open source team chat and Zulip Mobile is an app for iOS and Andriod users. In Zulip Mobile through version 27.189, a crafted link in a message sent by an authenticated user could lead to credential disclosure if a user follows the link. A patch was released in version 27.190.

Severity CVSS v4.0: Pending analysis

Last modification:

07/09/2022

CVE-2022-2961

Publication date:

29/08/2022

A use-after-free flaw was found in the Linux kernel’s PLP Rose functionality in the way a user triggers a race condition by calling bind while simultaneously triggering the rose_bind() function. This flaw allows a local user to crash or potentially escalate their privileges on the system.

Severity CVSS v4.0: Pending analysis

Last modification:

28/06/2023

CVE-2022-1016

Publication date:

29/08/2022

A flaw was found in the Linux kernel in net/netfilter/nf_tables_core.c:nft_do_chain, which can cause a use-after-free. This issue needs to handle &#39;return&#39; with proper preconditions, as it can lead to a kernel information leak problem caused by a local, unprivileged attacker.

Severity CVSS v4.0: Pending analysis

Last modification:

27/06/2023

CVE-2022-1024

Publication date:

29/08/2022

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2022-0934

Publication date:

29/08/2022

A single-byte, non-arbitrary write/use-after-free flaw was found in dnsmasq. This flaw allows an attacker who sends a crafted packet processed by dnsmasq, potentially causing a denial of service.

Severity CVSS v4.0: Pending analysis

Last modification:

03/11/2025

CVE-2022-1204

Publication date:

29/08/2022

A use-after-free flaw was found in the Linux kernel’s Amateur Radio AX.25 protocol functionality in the way a user connects with the protocol. This flaw allows a local user to crash the system.

Severity CVSS v4.0: Pending analysis

Last modification:

02/09/2022

CVE-2022-0851

Publication date:

29/08/2022

There is a flaw in convert2rhel. When the --activationkey option is used with convert2rhel, the activation key is subsequently passed to subscription-manager via the command line, which could allow unauthorized users locally on the machine to view the activation key via the process command line via e.g. htop or ps. The specific impact varies upon the subscription, but generally this would allow an attacker to register systems purchased by the victim until discovered; a form of fraud. This could occur regardless of how the activation key is supplied to convert2rhel because it involves how convert2rhel provides it to subscription-manager.

Severity CVSS v4.0: Pending analysis

Last modification:

12/02/2023

CVE-2022-0284

Publication date:

29/08/2022

A heap-based-buffer-over-read flaw was found in ImageMagick&#39;s GetPixelAlpha() function of &#39;pixel-accessor.h&#39;. This vulnerability is triggered when an attacker passes a specially crafted Tagged Image File Format (TIFF) image to convert it into a PICON file format. This issue can potentially lead to a denial of service and information disclosure.

Severity CVSS v4.0: Pending analysis

Last modification:

01/09/2022

CVE-2022-0400

Publication date:

29/08/2022

An out-of-bounds read vulnerability was discovered in linux kernel in the smc protocol stack, causing remote dos.

Severity CVSS v4.0: Pending analysis

Last modification:

01/09/2022

CVE-2022-0496

Publication date:

29/08/2022

A vulnerbiility was found in Openscad, where a DXF-format drawing with particular (not necessarily malformed!) properties may cause an out-of-bounds memory access when imported using import().

Severity CVSS v4.0: Pending analysis

Last modification:

01/09/2022