Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2020-14192

Publication date:

02/02/2021

Affected versions of Atlassian Fisheye and Crucible allow remote attackers to view a product&#39;s SEN via an Information Disclosure vulnerability in the x-asen response header from Atlassian Analytics. The affected versions are before version 4.8.4.

Severity CVSS v4.0: Pending analysis

Last modification:

04/02/2021

CVE-2021-3378

Publication date:

01/02/2021

FortiLogger 4.4.2.2 is affected by Arbitrary File Upload by sending a "Content-Type: image/png" header to Config/SaveUploadedHotspotLogoFile and then visiting Assets/temp/hotspot/img/logohotspot.asp.

Severity CVSS v4.0: Pending analysis

Last modification:

31/03/2021

CVE-2021-3340

Publication date:

01/02/2021

A cross-site scripting (XSS) vulnerability in many forms of Wikindx before 5.7.0 and 6.x through 6.4.0 allows remote attackers to inject arbitrary web script or HTML via the message parameter to index.php?action=initLogon or modules/admin/DELETEIMAGES.php.

Severity CVSS v4.0: Pending analysis

Last modification:

04/02/2021

CVE-2019-20473

Publication date:

01/02/2021

An issue was discovered on TK-Star Q90 Junior GPS horloge 3.1042.9.8656 devices. Any SIM card used with the device cannot have a PIN configured. If a PIN is configured, the device simply produces a "Remove PIN and restart!" message, and cannot be used. This makes it easier for an attacker to use the SIM card by stealing the device.

Severity CVSS v4.0: Pending analysis

Last modification:

01/08/2024

CVE-2019-20468

Publication date:

01/02/2021

An issue was discovered in SeTracker2 for TK-Star Q90 Junior GPS horloge 3.1042.9.8656 devices. It has unnecessary permissions such as READ_EXTERNAL_STORAGE, WRITE_EXTERNAL_STORAGE, and READ_CONTACTS.

Severity CVSS v4.0: Pending analysis

Last modification:

30/07/2024

CVE-2019-20471

Publication date:

01/02/2021

An issue was discovered on TK-Star Q90 Junior GPS horloge 3.1042.9.8656 devices. When using the device at initial setup, a default password is used (123456) for administrative purposes. There is no prompt to change this password. Note that this password can be used in combination with CVE-2019-20470.

Severity CVSS v4.0: Pending analysis

Last modification:

08/08/2024

CVE-2019-20470

Publication date:

01/02/2021

An issue was discovered on TK-Star Q90 Junior GPS horloge 3.1042.9.8656 devices. It performs actions based on certain SMS commands. This can be used to set up a voice communication channel from the watch to any telephone number, initiated by sending a specific SMS and using the default password, e.g., pw,,call, triggers an outbound call from the watch. The password is sometimes available because of CVE-2019-20471.

Severity CVSS v4.0: Pending analysis

Last modification:

01/08/2024

CVE-2020-28493

Publication date:

01/02/2021

This affects the package jinja2 from 0.0.0 and before 2.11.3. The ReDoS vulnerability is mainly due to the `_punctuation_re regex` operator and its use of multiple wildcards. The last wildcard is the most exploitable as it searches for trailing punctuation. This issue can be mitigated by Markdown to format user content instead of the urlize filter, or by implementing request timeouts and limiting process memory.

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2020-21176

Publication date:

01/02/2021

SQL injection vulnerability in the model.increment and model.decrement function in ThinkJS 3.2.10 allows remote attackers to execute arbitrary SQL commands via the step parameter.

Severity CVSS v4.0: Pending analysis

Last modification:

03/02/2021

CVE-2020-20290

Publication date:

01/02/2021

Directory traversal vulnerability in the yccms 3.3 project. The delete, deletesite, and deleteAll functions&#39; improper judgment of the request parameters, triggers a directory traversal vulnerability.

Severity CVSS v4.0: Pending analysis

Last modification:

04/02/2021

CVE-2020-21179

Publication date:

01/02/2021

Sql injection vulnerability in koa2-blog 1.0.0 allows remote attackers to Injecting a malicious SQL statement via the name parameter to the signin page.

Severity CVSS v4.0: Pending analysis

Last modification:

02/02/2021

CVE-2020-21180

Publication date:

01/02/2021

Sql injection vulnerability in koa2-blog 1.0.0 allows remote attackers to Injecting a malicious SQL statement via the name parameter to the signup page.

Severity CVSS v4.0: Pending analysis

Last modification:

02/02/2021

Subscribe to Vulnerabilities