Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2020-9093

Publication date:

29/12/2020

There is a use after free vulnerability in Taurus-AL00A versions 10.0.0.1(C00E1R1P1). A module does not deal with specific message properly, which makes a function refer to memory after it has been freed. Attackers can exploit this vulnerability by running a crafted application with common privilege. This would compromise normal service.

Severity CVSS v4.0: Pending analysis

Last modification:

30/12/2020

CVE-2020-9223

Publication date:

29/12/2020

There is a denial of service vulnerability in some Huawei smartphones. Due to the improper processing of received abnormal messages, remote attackers may exploit this vulnerability to cause a denial of service (DoS) on the specific module.

Severity CVSS v4.0: Pending analysis

Last modification:

30/12/2020

CVE-2020-9207

Publication date:

29/12/2020

There is an improper authentication vulnerability in some verisons of Huawei CloudEngine product. A module does not verify the input file properly. Attackers can exploit this vulnerability by crafting malicious files to bypass current verification mechanism. This can compromise normal service.

Severity CVSS v4.0: Pending analysis

Last modification:

31/12/2020

CVE-2020-9125

Publication date:

29/12/2020

There is an out-of-bound read vulnerability in huawei smartphone Mate 30 versions earlier than 10.1.0.156 (C00E155R7P2). An attacker with specific permission can exploit this vulnerability by sending crafted packet with specific parameter to the target device. Due to insufficient validation of the parameter, successful exploit can cause the device to behave abnormally.

Severity CVSS v4.0: Pending analysis

Last modification:

31/12/2020

CVE-2020-9094

Publication date:

29/12/2020

There is an out of bound read vulnerability in some verisons of Huawei CloudEngine product. A module does not deal with specific message properly. Attackers can exploit this vulnerability by sending malicious packet. This can lead to denial of service.

Severity CVSS v4.0: Pending analysis

Last modification:

31/12/2020

CVE-2020-35774

Publication date:

29/12/2020

server/handler/HistogramQueryHandler.scala in Twitter TwitterServer (aka twitter-server) before 20.12.0, in some configurations, allows XSS via the /histograms endpoint.

Severity CVSS v4.0: Pending analysis

Last modification:

19/07/2022

CVE-2020-9124

Publication date:

29/12/2020

There is a memory leak vulnerability in some versions of Huawei CloudEngine product. An unauthenticated, remote attacker may exploit this vulnerability by sending specific message to the affected product. Due to not release the allocated memory properly, successful exploit may cause memory leak.

Severity CVSS v4.0: Pending analysis

Last modification:

21/07/2021

CVE-2020-9208

Publication date:

29/12/2020

There is an information leak vulnerability in iManager NetEco 6000 versions V600R021C00. A module is lack of authentication. Attackers without access to the module can exploit this vulnerability to obtain extra information, leading to information leak.

Severity CVSS v4.0: Pending analysis

Last modification:

21/07/2021

CVE-2020-28278

Publication date:

29/12/2020

Prototype pollution vulnerability in &#39;shvl&#39; versions 1.0.0 through 2.0.1 allows an attacker to cause a denial of service and may lead to remote code execution.

Severity CVSS v4.0: Pending analysis

Last modification:

30/12/2020

CVE-2020-28279

Publication date:

29/12/2020

Prototype pollution vulnerability in &#39;flattenizer&#39; versions 0.0.5 through 1.0.5 allows an attacker to cause a denial of service and may lead to remote code execution.

Severity CVSS v4.0: Pending analysis

Last modification:

30/12/2020

CVE-2020-28280

Publication date:

29/12/2020

Prototype pollution vulnerability in &#39;predefine&#39; versions 0.0.0 through 0.1.2 allows an attacker to cause a denial of service and may lead to remote code execution.

Severity CVSS v4.0: Pending analysis

Last modification:

30/12/2020

CVE-2020-28281

Publication date:

29/12/2020

Prototype pollution vulnerability in &#39;set-object-value&#39; versions 0.0.0 through 0.0.5 allows an attacker to cause a denial of service and may lead to remote code execution.

Severity CVSS v4.0: Pending analysis

Last modification:

30/12/2020

Subscribe to Vulnerabilities