Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2021-24371

Publication date:

02/08/2021

The Import feature of the RSVPMaker WordPress plugin before 8.7.3 (/wp-admin/tools.php?page=rsvpmaker_export_screen) takes an URL input and calls curl on it, without first validating it to ensure it&#39;s a remote one. As a result, a high privilege user could use that feature to scan the internal network via a SSRF attack.

Severity CVSS v4.0: Pending analysis

Last modification:

30/09/2023

CVE-2021-24443

Publication date:

02/08/2021

The About Me widget of the Youzify – BuddyPress Community, User Profile, Social Network & Membership WordPress plugin before 1.0.7 does not properly sanitise its Biography field, allowing any authenticated user to set Cross-Site Scripting payloads in it, which will be executed when viewing the affected user profile. This could allow a low privilege user to gain unauthorised access to the admin side of the blog by targeting an admin, inducing them to view their profile with a malicious payload adding a rogue account for example.

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2021-3351

Publication date:

02/08/2021

OpenPLC runtime V3 through 2016-03-14 allows stored XSS via the Device Name to the web server&#39;s Add New Device page.

Severity CVSS v4.0: Pending analysis

Last modification:

09/08/2021

CVE-2021-34556

Publication date:

02/08/2021

In the Linux kernel through 5.13.7, an unprivileged BPF program can obtain sensitive information from kernel memory via a Speculative Store Bypass side-channel attack because the protection mechanism neglects the possibility of uninitialized memory locations on the BPF stack.

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2021-35477

Publication date:

02/08/2021

In the Linux kernel through 5.13.7, an unprivileged BPF program can obtain sensitive information from kernel memory via a Speculative Store Bypass side-channel attack because a certain preempting store operation does not necessarily occur before a store operation that has an attacker-controlled value.

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2017-18113

Publication date:

02/08/2021

The DefaultOSWorkflowConfigurator class in Jira Server and Jira Data Center before version 8.18.1 allows remote attackers who can trick a system administrator to import their malicious workflow to execute arbitrary code via a Remote Code Execution (RCE) vulnerability. The vulnerability allowed for various problematic OSWorkflow classes to be used as part of workflows. The fix for this issue blocks usage of unsafe conditions, validators, functions and registers that are build-in into OSWorkflow library and other Jira dependencies. Atlassian-made functions or functions provided by 3rd party plugins are not affected by this fix.

Severity CVSS v4.0: Pending analysis

Last modification:

17/10/2024

CVE-2021-32066

Publication date:

01/08/2021

An issue was discovered in Ruby through 2.6.7, 2.7.x through 2.7.3, and 3.x through 3.0.1. Net::IMAP does not raise an exception when StartTLS fails with an an unknown response, which might allow man-in-the-middle attackers to bypass the TLS protections by leveraging a network position between the client and the registry to block the StartTLS command, aka a "StartTLS stripping attack."

Severity CVSS v4.0: Pending analysis

Last modification:

24/01/2024

CVE-2021-37759

Publication date:

31/07/2021

A Session ID leak in the DEBUG log file in Graylog before 4.1.2 allows attackers to escalate privileges (to the access level of the leaked session ID).

Severity CVSS v4.0: Pending analysis

Last modification:

10/08/2021

CVE-2021-37760

Publication date:

31/07/2021

A Session ID leak in the audit log in Graylog before 4.1.2 allows attackers to escalate privileges (to the access level of the leaked session ID).

Severity CVSS v4.0: Pending analysis

Last modification:

10/08/2021

CVE-2020-26806

Publication date:

31/07/2021

admin/file.do in ObjectPlanet Opinio before 7.15 allows Unrestricted File Upload of executable JSP files, resulting in remote code execution, because filePath can have directory traversal and fileContent can be valid JSP code.

Severity CVSS v4.0: Pending analysis

Last modification:

28/06/2022

CVE-2020-26564

Publication date:

31/07/2021

ObjectPlanet Opinio before 7.15 allows XXE attacks via three steps: modify a .css file to have

Severity CVSS v4.0: Pending analysis

Last modification:

09/08/2021

CVE-2020-26565

Publication date:

31/07/2021

ObjectPlanet Opinio before 7.14 allows Expression Language Injection via the admin/permissionList.do from parameter. This can be used to retrieve possibly sensitive serverInfo data.

Severity CVSS v4.0: Pending analysis

Last modification:

10/08/2021

Subscribe to Vulnerabilities