Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2021-39895

Publication date:

05/11/2021

In all versions of GitLab CE/EE since version 8.0, an attacker can set the pipeline schedules to be active in a project export so when an unsuspecting owner imports that project, pipelines are active by default on that project. Under specialized conditions, this may lead to information disclosure if the project is imported from an untrusted source.

Severity CVSS v4.0: Pending analysis

Last modification:

08/11/2021

CVE-2021-39906

Publication date:

05/11/2021

Improper validation of ipynb files in GitLab CE/EE version 13.5 and above allows an attacker to execute arbitrary JavaScript code on the victim&#39;s behalf.

Severity CVSS v4.0: Pending analysis

Last modification:

08/11/2021

CVE-2021-39905

Publication date:

05/11/2021

An information disclosure vulnerability in the GitLab CE/EE API since version 8.9.6 allows a user to see basic information on private groups that a public project has been shared with

Severity CVSS v4.0: Pending analysis

Last modification:

08/11/2021

CVE-2021-39897

Publication date:

05/11/2021

Improper access control in GitLab CE/EE version 10.5 and above allowed subgroup members with inherited access to a project from a parent group to still have access even after the subgroup is transferred

Severity CVSS v4.0: Pending analysis

Last modification:

08/11/2021

CVE-2021-39898

Publication date:

05/11/2021

In all versions of GitLab CE/EE since version 10.6, a project export leaks the external webhook token value which may allow access to the project which it was exported from.

Severity CVSS v4.0: Pending analysis

Last modification:

12/07/2022

CVE-2021-39904

Publication date:

05/11/2021

An Improper Access Control vulnerability in the GraphQL API in all versions of GitLab CE/EE starting from 13.1 before 14.2.6, all versions starting from 14.3 before 14.3.4, and all versions starting from 14.4 before 14.4.1 allows a Merge Request creator to resolve discussions and apply suggestions after a project owner has locked the Merge Request

Severity CVSS v4.0: Pending analysis

Last modification:

06/10/2022

CVE-2021-22260

Publication date:

05/11/2021

A stored Cross-Site Scripting vulnerability in the DataDog integration in all versions of GitLab CE/EE starting from 13.7 before 14.0.9, all versions starting from 14.1 before 14.1.4, and all versions starting from 14.2 before 14.2.2 allows an attacker to execute arbitrary JavaScript code on the victim&#39;s behalf

Severity CVSS v4.0: Pending analysis

Last modification:

30/09/2022

CVE-2021-39914

Publication date:

04/11/2021

A regular expression denial of service issue in GitLab versions 8.13 to 14.2.5, 14.3.0 to 14.3.3 and 14.4.0 could cause excessive usage of resources when a specially crafted username was used when provisioning a new user

Severity CVSS v4.0: Pending analysis

Last modification:

03/05/2022

CVE-2021-39903

Publication date:

04/11/2021

In all versions of GitLab CE/EE since version 13.0, a privileged user, through an API call, can change the visibility level of a group or a project to a restricted option even after the instance administrator sets that visibility option as restricted in settings.

Severity CVSS v4.0: Pending analysis

Last modification:

12/07/2022

CVE-2021-43400

Publication date:

04/11/2021

An issue was discovered in gatt-database.c in BlueZ 5.61. A use-after-free can occur when a client disconnects during D-Bus processing of a WriteValue call.

Severity CVSS v4.0: Pending analysis

Last modification:

04/11/2025

CVE-2021-39902

Publication date:

04/11/2021

Incorrect Authorization in GitLab CE/EE 13.4 or above allows a user with guest membership in a project to modify the severity of an incident.

Severity CVSS v4.0: Pending analysis

Last modification:

08/11/2021

CVE-2021-43398

Publication date:

04/11/2021

Crypto++ (aka Cryptopp) 8.6.0 and earlier contains a timing leakage in MakePublicKey(). There is a clear correlation between execution time and private key length, which may cause disclosure of the length information of the private key. This might allow attackers to conduct timing attacks. NOTE: this report is disputed by the vendor and multiple third parties. The execution-time differences are intentional. A user may make a choice of a longer key as a tradeoff between strength and performance. In making this choice, the amount of information leaked to an adversary is of infinitesimal value

Severity CVSS v4.0: Pending analysis

Last modification:

04/08/2024

Subscribe to Vulnerabilities