Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2021-3006

Publication date:

03/01/2021

The breed function in the smart contract implementation for Farm in Seal Finance (Seal), an Ethereum token, lacks access control and thus allows price manipulation, as exploited in the wild in December 2020 and January 2021.

Severity CVSS v4.0: Pending analysis

Last modification:

12/07/2022

CVE-2020-28841

Publication date:

03/01/2021

MyDrivers64.sys in DriverGenius 9.61.3708.3054 allows attackers to cause a system crash via the ioctl command 0x9c402000 to \\.\MyDrivers0_0_1.

Severity CVSS v4.0: Pending analysis

Last modification:

07/01/2021

CVE-2020-35952

Publication date:

03/01/2021

login.php in PHPFusion (aka PHP-Fusion) Andromeda 9.x before 2020-12-30 generates error messages that distinguish between incorrect username and incorrect password (i.e., not a single "Incorrect username or password" message in both cases), which might allow enumeration.

Severity CVSS v4.0: Pending analysis

Last modification:

11/01/2021

CVE-2021-3005

Publication date:

03/01/2021

MK-AUTH through 19.01 K4.9 allows remote attackers to obtain sensitive information (e.g., a CPF number) via a modified titulo (aka invoice number) value to the central/recibo.php URI.

Severity CVSS v4.0: Pending analysis

Last modification:

07/01/2021

CVE-2021-3004

Publication date:

03/01/2021

The _deposit function in the smart contract implementation for Stable Yield Credit (yCREDIT), an Ethereum token, has certain incorrect calculations. An attacker can obtain more yCREDIT tokens than they should.

Severity CVSS v4.0: Pending analysis

Last modification:

07/01/2021

CVE-2020-28852

Publication date:

02/01/2021

In x/text in Go before v0.3.5, a "slice bounds out of range" panic occurs in language.ParseAcceptLanguage while processing a BCP 47 tag. (x/text/language is supposed to be able to parse an HTTP Accept-Language header.)

Severity CVSS v4.0: Pending analysis

Last modification:

03/06/2022

CVE-2020-28851

Publication date:

02/01/2021

In x/text in Go 1.15.4, an "index out of range" panic occurs in language.ParseAcceptLanguage while parsing the -u- extension. (x/text/language is supposed to be able to parse an HTTP Accept-Language header.)

Severity CVSS v4.0: Pending analysis

Last modification:

22/02/2021

CVE-2021-3002

Publication date:

01/01/2021

Seo Panel 4.8.0 allows reflected XSS via the seo/seopanel/login.php?sec=forgot email parameter.

Severity CVSS v4.0: Pending analysis

Last modification:

05/01/2021

CVE-2020-35717

Publication date:

01/01/2021

zonote through 0.4.0 allows XSS via a crafted note, with resultant Remote Code Execution (because nodeIntegration in webPreferences is true).

Severity CVSS v4.0: Pending analysis

Last modification:

07/01/2021

CVE-2020-35391

Publication date:

01/01/2021

Tenda N300 F3 12.01.01.48 devices allow remote attackers to obtain sensitive information (possibly including an http_passwd line) via a direct request for cgi-bin/DownloadCfg/RouterCfm.cfg, a related issue to CVE-2017-14942. NOTE: the vulnerability report may suggest that either a ? character must be placed after the RouterCfm.cfg filename, or that the HTTP request headers must be unusual, but it is not known why these are relevant to the device&#39;s HTTP response behavior.

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2020-35950

Publication date:

01/01/2021

An issue was discovered in the XCloner Backup and Restore plugin before 4.2.153 for WordPress. It allows CSRF (via almost any endpoint).

Severity CVSS v4.0: Pending analysis

Last modification:

13/01/2021

CVE-2020-35948

Publication date:

01/01/2021

An issue was discovered in the XCloner Backup and Restore plugin before 4.2.13 for WordPress. It gave authenticated attackers the ability to modify arbitrary files, including PHP files. Doing so would allow an attacker to achieve remote code execution. The xcloner_restore.php write_file_action could overwrite wp-config.php, for example. Alternatively, an attacker could create an exploit chain to obtain a database dump.

Severity CVSS v4.0: Pending analysis

Last modification:

22/02/2022

Subscribe to Vulnerabilities