Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2020-10988

Publication date:

13/07/2020

A hard-coded telnet credential in the tenda_login binary of Tenda AC15 AC1900 version 15.03.05.19 allows unauthenticated remote attackers to start a telnetd service on the device.

Severity CVSS v4.0: Pending analysis

Last modification:

15/07/2020

CVE-2020-10987

Publication date:

13/07/2020

The goform/setUsbUnload endpoint of Tenda AC15 AC1900 version 15.03.05.19 allows remote attackers to execute arbitrary system commands via the deviceName POST parameter.

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2025

CVE-2020-10986

Publication date:

13/07/2020

A CSRF issue in the /goform/SysToolReboot endpoint of Tenda AC15 AC1900 version 15.03.05.19 allows remote attackers to reboot the device and cause denial of service via a payload hosted by an attacker-controlled web page.

Severity CVSS v4.0: Pending analysis

Last modification:

15/07/2020

CVE-2019-19338

Publication date:

13/07/2020

A flaw was found in the fix for CVE-2019-11135, in the Linux upstream kernel versions before 5.5 where, the way Intel CPUs handle speculative execution of instructions when a TSX Asynchronous Abort (TAA) error occurs. When a guest is running on a host CPU affected by the TAA flaw (TAA_NO=0), but is not affected by the MDS issue (MDS_NO=1), the guest was to clear the affected buffers by using a VERW instruction mechanism. But when the MDS_NO=1 bit was exported to the guests, the guests did not use the VERW mechanism to clear the affected buffers. This issue affects guests running on Cascade Lake CPUs and requires that host has &#39;TSX&#39; enabled. Confidentiality of data is the highest threat associated with this vulnerability.

Severity CVSS v4.0: Pending analysis

Last modification:

21/07/2020

CVE-2020-11749

Publication date:

13/07/2020

Pandora FMS 7.0 NG

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2020-5766

Publication date:

13/07/2020

Improper Neutralization of Special Elements used in an SQL Command (&#39;SQL Injection&#39;) in SRS Simple Hits Counter Plugin for WordPress 1.0.3 and 1.0.4 allows a remote, unauthenticated attacker to determine the value of database fields.

Severity CVSS v4.0: Pending analysis

Last modification:

20/07/2020

CVE-2020-15689

Publication date:

13/07/2020

Appweb before 7.2.2 and 8.x before 8.1.0, when built with CGI support, mishandles an HTTP request with a Range header that lacks an exact range. This may result in a NULL pointer dereference and cause a denial of service.

Severity CVSS v4.0: Pending analysis

Last modification:

27/01/2023

CVE-2019-4591

Publication date:

13/07/2020

IBM Maximo Asset Management 7.6.0 and 7.6.1 does not invalidate session after logout which could allow a local user to impersonate another user on the system. IBM X-Force ID: 167451.

Severity CVSS v4.0: Pending analysis

Last modification:

14/07/2020

CVE-2019-20907

Publication date:

13/07/2020

In Lib/tarfile.py in Python through 3.8.3, an attacker is able to craft a TAR archive leading to an infinite loop when opened by tarfile.open, because _proc_pax lacks header validation.

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2020-14174

Publication date:

13/07/2020

Affected versions of Atlassian Jira Server and Data Center allow remote attackers to view titles of a private project via an Insecure Direct Object References (IDOR) vulnerability in the Administration Permission Helper. The affected versions are before version 7.13.6, from version 8.0.0 before 8.5.7, from version 8.6.0 before 8.9.2, and from version 8.10.0 before 8.10.1.

Severity CVSS v4.0: Pending analysis

Last modification:

30/03/2022

CVE-2019-20901

Publication date:

13/07/2020

The login.jsp resource in Jira before version 8.5.2, and from version 8.6.0 before version 8.6.1 allows remote attackers to redirect users to a different website which they may use as part of performing a phishing attack via an open redirect in the os_destination parameter.

Severity CVSS v4.0: Pending analysis

Last modification:

25/03/2022

CVE-2019-20898

Publication date:

13/07/2020

Affected versions of Atlassian Jira Server and Data Center allow remote attackers to access sensitive information without being authenticated in the Global permissions screen. The affected versions are before version 8.8.0.

Severity CVSS v4.0: Pending analysis

Last modification:

21/07/2021

Subscribe to Vulnerabilities