Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

Go to Calendar     Go to Press Room     Go to Newsletters subscription

Search

Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2021-34820
Publication date:
19/07/2021
Web Path Directory Traversal in the Novus HTTP Server. The Novus HTTP Server is affected by the Directory Traversal for Arbitrary File Access vulnerability. A remote, unauthenticated attacker using an HTTP GET request may be able to exploit this issue to access sensitive data. The issue was discovered in the NMS (Novus Management System) software through 1.51.2
Severity CVSS v4.0: Pending analysis
Last modification:
28/07/2021

CVE-2020-20249
Publication date:
19/07/2021
Mikrotik RouterOs before stable 6.47 suffers from a memory corruption vulnerability in the resolver process. By sending a crafted packet, an authenticated remote attacker can cause a Denial of Service.
Severity CVSS v4.0: Pending analysis
Last modification:
28/06/2022

CVE-2021-34821
Publication date:
19/07/2021
Cross Site Scripting (XSS) vulnerability exists in AAT Novus Management System through 1.51.2. The WebUI has wrong HTTP 404 error handling implemented. A remote, unauthenticated attacker may be able to exploit the issue by sending malicious HTTP requests to non-existing URIs. The value of the URL path filename is copied into the HTML document as plain text tags.
Severity CVSS v4.0: Pending analysis
Last modification:
28/07/2021

CVE-2020-20248
Publication date:
19/07/2021
Mikrotik RouterOs before stable 6.47 suffers from an uncontrolled resource consumption in the memtest process. An authenticated remote attacker can cause a Denial of Service due to overloading the systems CPU.
Severity CVSS v4.0: Pending analysis
Last modification:
07/11/2022

CVE-2020-36422
Publication date:
19/07/2021
An issue was discovered in Arm Mbed TLS before 2.23.0. A side channel allows recovery of an ECC private key, related to mbedtls_ecp_check_pub_priv, mbedtls_pk_parse_key, mbedtls_pk_parse_keyfile, mbedtls_ecp_mul, and mbedtls_ecp_mul_restartable.
Severity CVSS v4.0: Pending analysis
Last modification:
11/01/2023

CVE-2020-36423
Publication date:
19/07/2021
An issue was discovered in Arm Mbed TLS before 2.23.0. A remote attacker can recover plaintext because a certain Lucky 13 countermeasure doesn't properly consider the case of a hardware accelerator.
Severity CVSS v4.0: Pending analysis
Last modification:
11/01/2023

CVE-2020-36424
Publication date:
19/07/2021
An issue was discovered in Arm Mbed TLS before 2.24.0. An attacker can recover a private key (for RSA or static Diffie-Hellman) via a side-channel attack against generation of base blinding/unblinding values.
Severity CVSS v4.0: Pending analysis
Last modification:
11/01/2023

CVE-2020-36425
Publication date:
19/07/2021
An issue was discovered in Arm Mbed TLS before 2.24.0. It incorrectly uses a revocationDate check when deciding whether to honor certificate revocation via a CRL. In some situations, an attacker can exploit this by changing the local clock.
Severity CVSS v4.0: Pending analysis
Last modification:
11/01/2023

CVE-2020-36426
Publication date:
19/07/2021
An issue was discovered in Arm Mbed TLS before 2.24.0. mbedtls_x509_crl_parse_der has a buffer over-read (of one byte).
Severity CVSS v4.0: Pending analysis
Last modification:
11/01/2023

CVE-2021-36797
Publication date:
19/07/2021
In Victron Energy Venus OS through 2.72, root access is granted by default to anyone with physical access to the device. NOTE: the vendor disagrees with the reporter's opinion about an alleged "security best practices" violation
Severity CVSS v4.0: Pending analysis
Last modification:
04/08/2024

CVE-2020-36427
Publication date:
19/07/2021
GNOME gThumb before 3.10.1 allows an application crash via a malformed JPEG image.
Severity CVSS v4.0: Pending analysis
Last modification:
28/07/2021

CVE-2020-22650
Publication date:
19/07/2021
A memory leak vulnerability in sim-organizer.c of AlienVault Ossim v5 causes a denial of service (DOS) via a system crash triggered by the occurrence of a large number of alarm events.
Severity CVSS v4.0: Pending analysis
Last modification:
29/07/2021
Subscribe to Vulnerabilities