Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2021-45096

Publication date:

16/12/2021

KNIME Analytics Platform before 4.5.0 is vulnerable to XXE (external XML entity injection) via a crafted workflow file (.knwf), aka AP-17730.

Severity CVSS v4.0: Pending analysis

Last modification:

28/09/2023

CVE-2021-45097

Publication date:

16/12/2021

KNIME Server before 4.12.6 and 4.13.x before 4.13.4 (when installed in unattended mode) keeps the administrator&#39;s password in a file without appropriate file access controls, allowing all local users to read its content.

Severity CVSS v4.0: Pending analysis

Last modification:

28/09/2023

CVE-2021-45101

Publication date:

16/12/2021

An issue was discovered in HTCondor before 8.8.15, 9.0.x before 9.0.4, and 9.1.x before 9.1.2. Using standard command-line tools, a user with only READ access to an HTCondor SchedD or Collector daemon can discover secrets that could allow them to control other users&#39; jobs and/or read their data.

Severity CVSS v4.0: Pending analysis

Last modification:

08/08/2023

CVE-2021-45098

Publication date:

16/12/2021

An issue was discovered in Suricata before 6.0.4. It is possible to bypass/evade any HTTP-based signature by faking an RST TCP packet with random TCP options of the md5header from the client side. After the three-way handshake, it&#39;s possible to inject an RST ACK with a random TCP md5header option. Then, the client can send an HTTP GET request with a forbidden URL. The server will ignore the RST ACK and send the response HTTP packet for the client&#39;s request. These packets will not trigger a Suricata reject action.

Severity CVSS v4.0: Pending analysis

Last modification:

03/11/2025

CVE-2021-45095

Publication date:

16/12/2021

pep_sock_accept in net/phonet/pep.c in the Linux kernel through 5.15.8 has a refcount leak.

Severity CVSS v4.0: Pending analysis

Last modification:

06/04/2022

CVE-2021-45092

Publication date:

16/12/2021

Thinfinity VirtualUI before 3.0 has functionality in /lab.html reachable by default that could allow IFRAME injection via the vpath parameter.

Severity CVSS v4.0: Pending analysis

Last modification:

12/07/2022

CVE-2021-45086

Publication date:

16/12/2021

XSS can occur in GNOME Web (aka Epiphany) before 40.4 and 41.x before 41.1 because a server&#39;s suggested_filename is used as the pdf_name value in PDF.js.

Severity CVSS v4.0: Pending analysis

Last modification:

21/01/2022

CVE-2021-44023

Publication date:

16/12/2021

A link following denial-of-service (DoS) vulnerability in the Trend Micro Security (Consumer) 2021 familiy of products could allow an attacker to abuse the PC Health Checkup feature of the product to create symlinks that would allow modification of files which could lead to a denial-of-service.

Severity CVSS v4.0: Pending analysis

Last modification:

20/12/2021

CVE-2021-45088

Publication date:

16/12/2021

XSS can occur in GNOME Web (aka Epiphany) before 40.4 and 41.x before 41.1 via an error page.

Severity CVSS v4.0: Pending analysis

Last modification:

19/08/2022

CVE-2021-45087

Publication date:

16/12/2021

XSS can occur in GNOME Web (aka Epiphany) before 40.4 and 41.x before 41.1 when View Source mode or Reader mode is used, as demonstrated by a a page title.

Severity CVSS v4.0: Pending analysis

Last modification:

19/08/2022

CVE-2021-45085

Publication date:

16/12/2021

XSS can occur in GNOME Web (aka Epiphany) before 40.4 and 41.x before 41.1 via an about: page, as demonstrated by ephy-about:overview when a user visits an XSS payload page often enough to place that page on the Most Visited list.

Severity CVSS v4.0: Pending analysis

Last modification:

19/08/2022

CVE-2021-43833

Publication date:

16/12/2021

eLabFTW is an electronic lab notebook manager for research teams. In versions prior to 4.2.0 there is a vulnerability which allows any authenticated user to gain access to arbitrary accounts by setting a specially crafted email address. This vulnerability impacts all instances that have not set an explicit email domain name allowlist. Note that whereas neither administrators nor targeted users are notified of a change, an attacker will need to control an account. The default settings require administrators to validate newly created accounts. The problem has been patched. Users should upgrade to at least version 4.2.0. For users unable to upgrade enabling an email domain allow list (from Sysconfig panel, Security tab) will completely resolve the issue.

Severity CVSS v4.0: Pending analysis

Last modification:

21/12/2021

Subscribe to Vulnerabilities