Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2020-4633

Publication date:

11/12/2020

IBM Resilient SOAR V38.0 could allow a remote attacker to execute arbitrary code on the system, caused by formula injection due to improper input validation.

Severity CVSS v4.0: Pending analysis

Last modification:

21/07/2021

CVE-2020-17515

Publication date:

11/12/2020

The "origin" parameter passed to some of the endpoints like &#39;/trigger&#39; was vulnerable to XSS exploit. This issue affects Apache Airflow versions prior to 1.10.13. This is same as CVE-2020-13944 but the implemented fix in Airflow 1.10.13 did not fix the issue completely.

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2020-7793

Publication date:

11/12/2020

The package ua-parser-js before 0.7.23 are vulnerable to Regular Expression Denial of Service (ReDoS) in multiple regexes (see linked commit for more info).

Severity CVSS v4.0: Pending analysis

Last modification:

13/09/2022

CVE-2020-7790

Publication date:

11/12/2020

This affects the package spatie/browsershot from 0.0.0. By specifying a URL in the file:// protocol an attacker is able to include arbitrary files in the resultant PDF.

Severity CVSS v4.0: Pending analysis

Last modification:

14/12/2020

CVE-2020-7788

Publication date:

11/12/2020

This affects the package ini before 1.3.6. If an attacker submits a malicious INI file to an application that parses it with ini.parse, they will pollute the prototype on the application. This can be exploited further depending on the context.

Severity CVSS v4.0: Pending analysis

Last modification:

02/12/2022

CVE-2020-7792

Publication date:

11/12/2020

This affects all versions of package mout. The deepFillIn function can be used to &#39;fill missing properties recursively&#39;, while the deepMixIn &#39;mixes objects into the target object, recursively mixing existing child objects as well&#39;. In both cases, the key used to access the target object recursively is not checked, leading to a Prototype Pollution.

Severity CVSS v4.0: Pending analysis

Last modification:

28/06/2022

CVE-2020-7789

Publication date:

11/12/2020

This affects the package node-notifier before 9.0.0. It allows an attacker to run arbitrary commands on Linux machines due to the options params not being sanitised when being passed an array.

Severity CVSS v4.0: Pending analysis

Last modification:

17/12/2020

CVE-2020-35135

Publication date:

11/12/2020

The ultimate-category-excluder plugin before 1.2 for WordPress allows ultimate-category-excluder.php CSRF.

Severity CVSS v4.0: Pending analysis

Last modification:

06/08/2022

CVE-2020-35127

Publication date:

11/12/2020

Ignite Realtime Openfire 4.6.0 has plugins/bookmarks/create-bookmark.jsp Stored XSS.

Severity CVSS v4.0: Pending analysis

Last modification:

11/12/2020

CVE-2020-26411

Publication date:

11/12/2020

A potential DOS vulnerability was discovered in all versions of Gitlab starting from 13.4.x (>=13.4 to =13.5 to =13.6 to

Severity CVSS v4.0: Pending analysis

Last modification:

14/12/2020

CVE-2020-35132

Publication date:

11/12/2020

An XSS issue has been discovered in phpLDAPadmin before 1.2.6.2 that allows users to store malicious values that may be executed by other users at a later time via get_request in lib/function.php.

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2020-27786

Publication date:

11/12/2020

A flaw was found in the Linux kernel’s implementation of MIDI, where an attacker with a local account and the permissions to issue ioctl commands to midi devices could trigger a use-after-free issue. A write to this specific memory while freed and before use causes the flow of execution to change and possibly allow for memory corruption or privilege escalation. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.

Severity CVSS v4.0: Pending analysis

Last modification:

16/05/2023

Subscribe to Vulnerabilities